CS88 Lab 2: Part B: Web Security: Cross-Site Scripting

Level 1: Display a user’s cookies when they visit a malicious webpage.

Level 2: Add malicious code to your webpage to become the victim’s friend.

Level 3: Add malicious code to your webpage to modify a victim’s profile.

Level 4: Deploy a worm that by definition self replicates, and both modifies users' profiles and infects these users, making them propagators of this worm.

Successfully complete all four levels of attacks.

Complete and submit your lab2b-worksheet.adoc

To install this add-on open up Firefox and use the Ctrl+Shift+A shortcut to pull up the extensions page.

In the search bar, type in HTTP Header Live and click Add to Firefox. You should now see the following screen displayed:

To see this tool in action on the Elgg social network, close all tabs, and go back to www.seed-server.com. Now, click on the Bookmarks tab on the top right corner which should pull up the HTTP Header Live sidebar on the left.

Now, click on any link inside this webpage and all the HTTP requests and responses triggered by this page will be captured and displayed inside the sidebar.

If you click on a particular HTTP message, this will produce a pop-up window to display the selected HTTP message. This pop-up feature is slightly buggy - there are times when nothing will show up inside the window unless you change its size (re-drawing seems to trigger the HTTP message to show up as expected).

Click on the three bars on the top-right corner in Firefox. Next go to Web Developer -→ Network.

Now if you click anywhere on the Elgg webpages, you should be able to see the same GET requests. Note that the requests displayed here don’t have the same level of detail as the HTTP Header Live extension, but they can be useful for quick inspection.

In-Lab Task:

Similar to the Web Developer Network Tools, we can also access the Web Developer → Console to view and debug Javascript on the webpage.

In Lab Task: Running a simple Java script attack: To test out a simple Javascript attack, login as Samy — the adversary on our social networking app.

Debugging Javascript Code:

Your task is to fill in the following statement and place it in the About Me field on Alice’s webpage. Remember to select Edit HTML to ensure that your data is treated as code!

<script>alert(document.<change this value>); </script>

To figure out what command would retrieve the document’s cookie, take a look at this link and go to Finding HTML Objects on this page. Here, you should be able to find a command that returns the document’s cookie.

If your attack is successful, then you should see a pop-up with Elgg=<alpha_numberic_string>, that shows up on Alice’s profile page. If you logout from Alice’s account and login as any other user, and visit Alice’s webpage you should see the pop-up displayed with your cookie.

We will write an XSS attack that adds Samy as a friend to any other user that visits Samy’s page. To do so, we will write a malicious JavaScript program add_friend.js that forges HTTP requests directly from the victim’s browser, without the intervention of the attacker.

To add a friend to the victim, we need to first find out how a legitimate user adds a friend in Elgg. Try to find the GET request associated with a legitimate friend request. Record the entire request in lab2b-worksheet.adoc.

When you find this GET request, you will notice three parameters being set,

__elgg_ts, __elgg_token, and `friend=number`.

Your task is to figure out the unique number associated with Samy’s account (since we want to add Samy as a friend)

 and, the unique __elgg_ts, __elgg_token values for each user that visits our webpage.

You now have all the inputs necessary to compose your attack in add_friend.js and once you complete this code, you can copy paste it into Samy’s About Me page.

If your attack is successful, then for any user in Elgg, if they visit Samy’s webpage, they should automatically have Samy added to their friend list. The user should not have to perform any action to have Samy added as a friend.

Similar to the previous task, we need to write a malicious JavaScript program that forges HTTP requests.

To modify the profile, we first need to find out how a legitimate user edits or modifies their profile in Elgg.

Login as Alice again, and this time modify her About me page and record the HTTP request that is sent out.

Search for a POST: HTTP/1.1 302 Found message that corresponds to editing Alice’s profile. Right above that line you should find the content that goes into the HTTP request headers. This should look something like the following

__elgg_token=x4g00iNjHHeLVSn3KPri2g&__elgg_ts=1664382167&name=Alice&description=<p>Yay!!</p>
&accesslevel[description]=2&briefdescription=&accesslevel[briefdescription]=2&location=&accesslevel[location]=2&interests=&accesslevel[interests]=2&skills=&accesslevel[skills]=2&contactemail=&accesslevel[contactemail]=2&phone=&accesslevel[phone]=2&mobile=&accesslevel[mobile]=2&website=&accesslevel[website]=2&twitter=&accesslevel[twitter]=2&guid=56
POST: HTTP/1.1 302 Found

We need to specify all the fields shown above in edit_profile.js except the various description fields. The description field is already provided to you. You don’t have to modify this field, you’re only required to fill the contents..

HINT: In your edit_profile.js you probably want some condition such that you don’t modify your own About me section as Samy! Think of why this would be necessary.