{"action":"created","comment":{"url":"https://api.github.com/repos/skybet/skybet.github.io/pulls/comments/55671000","id":55671000,"diff_hunk":"@@ -0,0 +1,48 @@\n+---\n+layout:     post\n+title:      XSS - Just the facts, m'aam\n+author:     dan_adams\n+date:       2016-04-02 11:00:00\n+summary:    A basic primer on Cross-site scripting (CSS) and its prevention\n+category:   security\n+tags:       security scripting xss sanitization encoding vulnerability exploit\n+---\n+\n+One of the simplest and most prevalent vulnerabilities found on web applications that we pentest is Cross-Site Scripting or XSS. It is still the third most critical vulnerability according to the [https://www.owasp.org/index.php/Top10](Owasp Top 10 Vulnerabilities) list as of 2013, and closely linked to the #1 most critical vulnerability, Injection.\n+\n+Clearly, despite its ubiquity, there is still a lot of uncertainty amongst developers and others around what exactly XSS is and how to prevent it. Very often the topic is made overly complex, when in reality it is relatively simple to both understand and defend against.\n+\n+Cross-site scripting is the slightly clunky name for the malicious insertion of unauthorised javascript into a website or web application. Javascript can be dangerous because it executes client-side within the context of the end user's browser and hence can have access to customer data as well as control of browser actions. Malicious payloads can include:\n+* Capturing user input such as passwords via a keylogger\n+* Sending cookies, tokens and other cached data to a third party\n+* Performing network requests and system operations that the user hasn't requested\n+* Forcing downloads of files to the end user PC\n+\n+At its simplest, XSS relies on a website returning executable code to a client that a third party has injected, rather than data that the webserver is intending to serve. This can take a variety of forms but usually relies on the website returning a parameter to a customer that the customer has previously entered in an earlier web request. That is, it relies on data that is intended to be passive/handled data (such as raw text) to transform context into some form of exectuable payload such as a command or script, which can then execute. If the parameter containing the executable code is passed to and executes on the server side, it can lead to a SQL injection or command execution attack, and if executed on the client side, it can lead to an XSS attack.\n+\n+An example of a website that could be vulnerable to this could be as simple as a site containing a single form that echoes your name back to you: you enter your name (\"Bob\") in a login form field, and the website returns \"Hello, Bob\" in its HTTP response. If the website can instead be forced to process the name of \"&lt;script&amp;... &lt;script&amp;\" then it is possible to inject javascript into unsuspecting visitors' browsers.\n+\n+![Bobby Tables cartoon](https://imgs.xkcd.com/comics/exploits_of_a_mom.png)\n+\n+It is this combination of the widespread susceptibly to XSS with the powerful payloads that the vulnerability that can deliver and the relative simplicity of exploiting it that make XSS such an important threat to protect against.\n+\n+The reason that XSS vulnerabilities are so prevalent is that whilst XSS is a trivial vulnerability to prevent against, doing so requires robust and consistent coding practices that are consistently implemented over time - the consideration of data handling of input and output data by almost every piece of code you write at every level of your stack.","path":"_posts/2016-04-02-xss-justthefacts.md","position":29,"original_position":29,"commit_id":"a04f976debd2c2ba81e42ead9da77fd9e4f6a176","original_commit_id":"a04f976debd2c2ba81e42ead9da77fd9e4f6a176","user":{"login":"medains","id":914674,"avatar_url":"https://avatars.githubusercontent.com/u/914674?v=3","gravatar_id":"","url":"https://api.github.com/users/medains","html_url":"https://github.com/medains","followers_url":"https://api.github.com/users/medains/followers","following_url":"https://api.github.com/users/medains/following{/other_user}","gists_url":"https://api.github.com/users/medains/gists{/gist_id}","starred_url":"https://api.github.com/users/medains/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/medains/subscriptions","organizations_url":"https://api.github.com/users/medains/orgs","repos_url":"https://api.github.com/users/medains/repos","events_url":"https://api.github.com/users/medains/events{/privacy}","received_events_url":"https://api.github.com/users/medains/received_events","type":"User","site_admin":false},"body":"\"to prevent against\" seems a bit of a strange phrase, drop the \"against\".\r\nRepetition of consistent, maybe just \"robust coding practices\".\r\nThe final part of the sentence doesn't flow well - maybe \"considering how data is handled at input and output in almost every ... \"","created_at":"2016-03-10T12:20:19Z","updated_at":"2016-03-10T12:20:19Z","html_url":"https://github.com/skybet/skybet.github.io/pull/73#discussion_r55671000","pull_request_url":"https://api.github.com/repos/skybet/skybet.github.io/pulls/73","_links":{"self":{"href":"https://api.github.com/repos/skybet/skybet.github.io/pulls/comments/55671000"},"html":{"href":"https://github.com/skybet/skybet.github.io/pull/73#discussion_r55671000"},"pull_request":{"href":"https://api.github.com/repos/skybet/skybet.github.io/pulls/73"}}},"pull_request":{"url":"https://api.github.com/repos/skybet/skybet.github.io/pulls/73","id":62377503,"html_url":"https://github.com/skybet/skybet.github.io/pull/73","diff_url":"https://github.com/skybet/skybet.github.io/pull/73.diff","patch_url":"https://github.com/skybet/skybet.github.io/pull/73.patch","issue_url":"https://api.github.com/repos/skybet/skybet.github.io/issues/73","number":73,"state":"open","locked":false,"title":"Adding new article on preventing XSS attacks","user":{"login":"sbg-danadams","id":17497484,"avatar_url":"https://avatars.githubusercontent.com/u/17497484?v=3","gravatar_id":"","url":"https://api.github.com/users/sbg-danadams","html_url":"https://github.com/sbg-danadams","followers_url":"https://api.github.com/users/sbg-danadams/followers","following_url":"https://api.github.com/users/sbg-danadams/following{/other_user}","gists_url":"https://api.github.com/users/sbg-danadams/gists{/gist_id}","starred_url":"https://api.github.com/users/sbg-danadams/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sbg-danadams/subscriptions","organizations_url":"https://api.github.com/users/sbg-danadams/orgs","repos_url":"https://api.github.com/users/sbg-danadams/repos","events_url":"https://api.github.com/users/sbg-danadams/events{/privacy}","received_events_url":"https://api.github.com/users/sbg-danadams/received_events","type":"User","site_admin":false},"body":"New article on XSS prevention","created_at":"2016-03-10T11:45:28Z","updated_at":"2016-03-10T12:20:19Z","closed_at":null,"merged_at":null,"merge_commit_sha":"66cdcf3bb1c7db3a3b9204bc98a299e7bfdad285","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/skybet/skybet.github.io/pulls/73/commits","review_comments_url":"https://api.github.com/repos/skybet/skybet.github.io/pulls/73/comments","review_comment_url":"https://api.github.com/repos/skybet/skybet.github.io/pulls/comments{/number}","comments_url":"https://api.github.com/repos/skybet/skybet.github.io/issues/73/comments","statuses_url":"https://api.github.com/repos/skybet/skybet.github.io/statuses/a04f976debd2c2ba81e42ead9da77fd9e4f6a176","head":{"label":"sbg-danadams:2016-04","ref":"2016-04","sha":"a04f976debd2c2ba81e42ead9da77fd9e4f6a176","user":{"login":"sbg-danadams","id":17497484,"avatar_url":"https://avatars.githubusercontent.com/u/17497484?v=3","gravatar_id":"","url":"https://api.github.com/users/sbg-danadams","html_url":"https://github.com/sbg-danadams","followers_url":"https://api.github.com/users/sbg-danadams/followers","following_url":"https://api.github.com/users/sbg-danadams/following{/other_user}","gists_url":"https://api.github.com/users/sbg-danadams/gists{/gist_id}","starred_url":"https://api.github.com/users/sbg-danadams/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sbg-danadams/subscriptions","organizations_url":"https://api.github.com/users/sbg-danadams/orgs","repos_url":"https://api.github.com/users/sbg-danadams/repos","events_url":"https://api.github.com/users/sbg-danadams/events{/privacy}","received_events_url":"https://api.github.com/users/sbg-danadams/received_events","type":"User","site_admin":false},"repo":{"id":52801774,"name":"skybet.github.io","full_name":"sbg-danadams/skybet.github.io","owner":{"login":"sbg-danadams","id":17497484,"avatar_url":"https://avatars.githubusercontent.com/u/17497484?v=3","gravatar_id":"","url":"https://api.github.com/users/sbg-danadams","html_url":"https://github.com/sbg-danadams","followers_url":"https://api.github.com/users/sbg-danadams/followers","following_url":"https://api.github.com/users/sbg-danadams/following{/other_user}","gists_url":"https://api.github.com/users/sbg-danadams/gists{/gist_id}","starred_url":"https://api.github.com/users/sbg-danadams/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sbg-danadams/subscriptions","organizations_url":"https://api.github.com/users/sbg-danadams/orgs","repos_url":"https://api.github.com/users/sbg-danadams/repos","events_url":"https://api.github.com/users/sbg-danadams/events{/privacy}","received_events_url":"https://api.github.com/users/sbg-danadams/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/sbg-danadams/skybet.github.io","description":"SB&G Engineering Site","fork":true,"url":"https://api.github.com/repos/sbg-danadams/skybet.github.io","forks_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/forks","keys_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/keys{/key_id}","collaborators_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/teams","hooks_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/hooks","issue_events_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/issues/events{/number}","events_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/events","assignees_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/assignees{/user}","branches_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/branches{/branch}","tags_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/tags","blobs_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/git/refs{/sha}","trees_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/git/trees{/sha}","statuses_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/statuses/{sha}","languages_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/languages","stargazers_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/stargazers","contributors_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/contributors","subscribers_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/subscribers","subscription_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/subscription","commits_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/commits{/sha}","git_commits_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/git/commits{/sha}","comments_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/comments{/number}","issue_comment_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/issues/comments{/number}","contents_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/contents/{+path}","compare_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/compare/{base}...{head}","merges_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/merges","archive_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/downloads","issues_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/issues{/number}","pulls_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/pulls{/number}","milestones_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/milestones{/number}","notifications_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/labels{/name}","releases_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/releases{/id}","deployments_url":"https://api.github.com/repos/sbg-danadams/skybet.github.io/deployments","created_at":"2016-02-29T15:29:33Z","updated_at":"2016-02-29T15:29:34Z","pushed_at":"2016-03-10T11:45:01Z","git_url":"git://github.com/sbg-danadams/skybet.github.io.git","ssh_url":"git@github.com:sbg-danadams/skybet.github.io.git","clone_url":"https://github.com/sbg-danadams/skybet.github.io.git","svn_url":"https://github.com/sbg-danadams/skybet.github.io","homepage":"http://engineering.skybettingandgaming.com","size":12268,"stargazers_count":0,"watchers_count":0,"language":"CSS","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"skybet:master","ref":"master","sha":"446e6bfb379bf5eeeb6be320df3777f08f368e4f","user":{"login":"skybet","id":2715474,"avatar_url":"https://avatars.githubusercontent.com/u/2715474?v=3","gravatar_id":"","url":"https://api.github.com/users/skybet","html_url":"https://github.com/skybet","followers_url":"https://api.github.com/users/skybet/followers","following_url":"https://api.github.com/users/skybet/following{/other_user}","gists_url":"https://api.github.com/users/skybet/gists{/gist_id}","starred_url":"https://api.github.com/users/skybet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/skybet/subscriptions","organizations_url":"https://api.github.com/users/skybet/orgs","repos_url":"https://api.github.com/users/skybet/repos","events_url":"https://api.github.com/users/skybet/events{/privacy}","received_events_url":"https://api.github.com/users/skybet/received_events","type":"Organization","site_admin":false},"repo":{"id":40681301,"name":"skybet.github.io","full_name":"skybet/skybet.github.io","owner":{"login":"skybet","id":2715474,"avatar_url":"https://avatars.githubusercontent.com/u/2715474?v=3","gravatar_id":"","url":"https://api.github.com/users/skybet","html_url":"https://github.com/skybet","followers_url":"https://api.github.com/users/skybet/followers","following_url":"https://api.github.com/users/skybet/following{/other_user}","gists_url":"https://api.github.com/users/skybet/gists{/gist_id}","starred_url":"https://api.github.com/users/skybet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/skybet/subscriptions","organizations_url":"https://api.github.com/users/skybet/orgs","repos_url":"https://api.github.com/users/skybet/repos","events_url":"https://api.github.com/users/skybet/events{/privacy}","received_events_url":"https://api.github.com/users/skybet/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/skybet/skybet.github.io","description":"SB&G Engineering Site","fork":false,"url":"https://api.github.com/repos/skybet/skybet.github.io","forks_url":"https://api.github.com/repos/skybet/skybet.github.io/forks","keys_url":"https://api.github.com/repos/skybet/skybet.github.io/keys{/key_id}","collaborators_url":"https://api.github.com/repos/skybet/skybet.github.io/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/skybet/skybet.github.io/teams","hooks_url":"https://api.github.com/repos/skybet/skybet.github.io/hooks","issue_events_url":"https://api.github.com/repos/skybet/skybet.github.io/issues/events{/number}","events_url":"https://api.github.com/repos/skybet/skybet.github.io/events","assignees_url":"https://api.github.com/repos/skybet/skybet.github.io/assignees{/user}","branches_url":"https://api.github.com/repos/skybet/skybet.github.io/branches{/branch}","tags_url":"https://api.github.com/repos/skybet/skybet.github.io/tags","blobs_url":"https://api.github.com/repos/skybet/skybet.github.io/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/skybet/skybet.github.io/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/skybet/skybet.github.io/git/refs{/sha}","trees_url":"https://api.github.com/repos/skybet/skybet.github.io/git/trees{/sha}","statuses_url":"https://api.github.com/repos/skybet/skybet.github.io/statuses/{sha}","languages_url":"https://api.github.com/repos/skybet/skybet.github.io/languages","stargazers_url":"https://api.github.com/repos/skybet/skybet.github.io/stargazers","contributors_url":"https://api.github.com/repos/skybet/skybet.github.io/contributors","subscribers_url":"https://api.github.com/repos/skybet/skybet.github.io/subscribers","subscription_url":"https://api.github.com/repos/skybet/skybet.github.io/subscription","commits_url":"https://api.github.com/repos/skybet/skybet.github.io/commits{/sha}","git_commits_url":"https://api.github.com/repos/skybet/skybet.github.io/git/commits{/sha}","comments_url":"https://api.github.com/repos/skybet/skybet.github.io/comments{/number}","issue_comment_url":"https://api.github.com/repos/skybet/skybet.github.io/issues/comments{/number}","contents_url":"https://api.github.com/repos/skybet/skybet.github.io/contents/{+path}","compare_url":"https://api.github.com/repos/skybet/skybet.github.io/compare/{base}...{head}","merges_url":"https://api.github.com/repos/skybet/skybet.github.io/merges","archive_url":"https://api.github.com/repos/skybet/skybet.github.io/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/skybet/skybet.github.io/downloads","issues_url":"https://api.github.com/repos/skybet/skybet.github.io/issues{/number}","pulls_url":"https://api.github.com/repos/skybet/skybet.github.io/pulls{/number}","milestones_url":"https://api.github.com/repos/skybet/skybet.github.io/milestones{/number}","notifications_url":"https://api.github.com/repos/skybet/skybet.github.io/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/skybet/skybet.github.io/labels{/name}","releases_url":"https://api.github.com/repos/skybet/skybet.github.io/releases{/id}","deployments_url":"https://api.github.com/repos/skybet/skybet.github.io/deployments","created_at":"2015-08-13T20:54:03Z","updated_at":"2016-02-29T22:13:38Z","pushed_at":"2016-03-10T11:45:28Z","git_url":"git://github.com/skybet/skybet.github.io.git","ssh_url":"git@github.com:skybet/skybet.github.io.git","clone_url":"https://github.com/skybet/skybet.github.io.git","svn_url":"https://github.com/skybet/skybet.github.io","homepage":"http://engineering.skybettingandgaming.com","size":14868,"stargazers_count":7,"watchers_count":7,"language":"CSS","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":21,"mirror_url":null,"open_issues_count":7,"forks":21,"open_issues":7,"watchers":7,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/skybet/skybet.github.io/pulls/73"},"html":{"href":"https://github.com/skybet/skybet.github.io/pull/73"},"issue":{"href":"https://api.github.com/repos/skybet/skybet.github.io/issues/73"},"comments":{"href":"https://api.github.com/repos/skybet/skybet.github.io/issues/73/comments"},"review_comments":{"href":"https://api.github.com/repos/skybet/skybet.github.io/pulls/73/comments"},"review_comment":{"href":"https://api.github.com/repos/skybet/skybet.github.io/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/skybet/skybet.github.io/pulls/73/commits"},"statuses":{"href":"https://api.github.com/repos/skybet/skybet.github.io/statuses/a04f976debd2c2ba81e42ead9da77fd9e4f6a176"}}}}