Warning: preg_replace(): The /e modifier is deprecated, use preg_replace_callback instead in ..../includes/class_bbcode.php on line 2962
Stop XSS?
Results 1 to 2 of 2

Thread: Stop XSS?

  1. #1
    Advisor beezlebubsbum's Avatar
    Join Date
    May 2004

    Stop XSS?

    Hi All.
    I just did a acunetix scan on my website, and it came up with a few cross site scripting problems on my site. My question is, what exactly is a cross site script, and is there a way I can prevent it. Or is the problem lie within my CMS? Another weird thing, it reckons my server has Bonjour service running, which I thought was weird because I have Linux, and didn't know bonjour existed on that.
    My Website: http://ttgale.com
    My Website Uptime: http://img.uptimeprj.com/holastickbo...dee9bae2e2.png
    My Server Specs: AMD Athlon X2 3800+, 2gb DDR2 RAM, 1.5TB HDD, Ubuntu 9.10
    My Gaming PC: Intel Core 2 Duo 2.93ghz, 4gb DDR2 RAM, 9800GTX+

  2. #2
    XSS is actually the exploitation of JavaScript on many different sites. If you remember "phishing", XSS is more or less extreme-phishing. Instead of tricking you into a site via a URL change, you're visiting sites through an altered JS script (This is only ONE of many ways to use XSS). Avoiding it isn't that easy right now. Best way is to disable JavaScript when visiting new/unknown sites.

    Another way is to use Firefox, and start downloading some addons. To help protect against XSS, NoScript, SafeHistory, SafeCache, Anti-Phishing Toolbar, and more. The ones mentioned will help keep data from a JS script from reflecting to another server.

    As for your issue, with your own site, make sure to secure your JS files as much as possible. If you are using CMS software from a company, just hope they keep up on the vulnerabilities. Watch SecurityFocus for your specific CMS to come up with an XSS exploit (many have in the past week), and find out what is causing it. You might want to lock down parts of the CMS software, or make sure it's only used over a VPN, or LAN. Without knowing much more about the CMS software itself, I can't really help. The issue is in the code, not through an application. XSS exploits can dodge webserver logs completely, and be almost completely undetectable.

    I could go on and on about XSS, but that would turn out to be a book. I will be submitting a light tutorial for 2600 on XSS (hopefully getting people to start securing browsers for such exploits), presenting an exploit at Defcon (2010), and a few exploits for MetaSploit. Maybe after that, people will start coding to protect against such.
    arrogance breeds ignorance

    Screaming Electron, Full of BSD Goodness

Similar Threads

  1. Hey, any ideas on how i can stop this?
    By TeRG in forum General Chat
    Replies: 7
    Last Post: 03-14-2004, 01:18 AM
  2. SCO will pay you to stop using Linux
    By Tyr_7BE in forum General Chat
    Replies: 3
    Last Post: 11-08-2003, 08:11 AM
  3. Can you guys freaking stop .....
    By Compunuts in forum General Chat
    Replies: 12
    Last Post: 07-03-2003, 11:17 PM
  4. iptables stop a DoS attack?
    By imported_RedHat in forum Security
    Replies: 1
    Last Post: 04-20-2003, 03:05 AM
  5. VNC: still accesable after #>vncserver stop
    By Blaqb0x in forum Linux - Software, Applications & Programming
    Replies: 0
    Last Post: 05-16-2002, 06:56 AM


Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts