WEBVTT

1
00:00.000 --> 00:00.090 align:middle line:84%


2
00:00.090 --> 00:02.130 align:middle line:90%
So now we've seen how
hackers can actually

3
00:02.130 --> 00:03.630 align:middle line:84%
use our code against us.

4
00:03.630 --> 00:07.140 align:middle line:90%
They can send SQL commands
in through our website,

5
00:07.140 --> 00:09.360 align:middle line:90%
and then perform actions
against our database.

6
00:09.360 --> 00:11.400 align:middle line:90%
A very similar
attack, it's almost

7
00:11.400 --> 00:13.708 align:middle line:90%
like a JavaScript
injection, is what

8
00:13.708 --> 00:15.000 align:middle line:84%
we're going to talk about next.

9
00:15.000 --> 00:18.210 align:middle line:90%
What we're talking about this
time is cross-site scripting.

10
00:18.210 --> 00:20.897 align:middle line:90%
So rather than sending SQL
commands into our code,

11
00:20.897 --> 00:22.980 align:middle line:90%
they're going to be sending
in JavaScript commands

12
00:22.980 --> 00:23.820 align:middle line:84%
through our code.

13
00:23.820 --> 00:25.560 align:middle line:90%
And still, just like we
did in the last Nugget,

14
00:25.560 --> 00:27.455 align:middle line:90%
where we saw a way that
we could practice it,

15
00:27.455 --> 00:28.830 align:middle line:90%
there's resources
out there where

16
00:28.830 --> 00:31.332 align:middle line:90%
you can practice the
cross-site scripting attack.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:28.830 --> 00:31.332 align:middle line:90%
you can practice the
cross-site scripting attack.

17
00:31.332 --> 00:33.540 align:middle line:90%
So let's talk more about
how the cross-site scripting

18
00:33.540 --> 00:35.520 align:middle line:90%
attack works, and then
roll up our sleeves

19
00:35.520 --> 00:38.010 align:middle line:90%
and see a little demo, or a
way that we can practice it.

20
00:38.010 --> 00:39.070 align:middle line:84%
Let's get going.

21
00:39.070 --> 00:41.610 align:middle line:90%
The cross-site scripting
attack is another big one.

22
00:41.610 --> 00:45.120 align:middle line:90%
It's kind of like an injection
where we're inserting code

23
00:45.120 --> 00:46.332 align:middle line:84%
into the application.

24
00:46.332 --> 00:47.790 align:middle line:90%
Just like in the
last Nugget, where

25
00:47.790 --> 00:50.460 align:middle line:90%
we were talking about maybe
having a search bar where

26
00:50.460 --> 00:52.710 align:middle line:90%
we could inject
SQL code, well now,

27
00:52.710 --> 00:55.030 align:middle line:90%
we're trying to inject
JavaScript code.

28
00:55.030 --> 00:57.660 align:middle line:90%
And in order to understand where
this attack is taking place,

29
00:57.660 --> 01:00.450 align:middle line:90%
you need to know a little bit
about JavaScript because it
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
00:57.660 --> 01:00.450 align:middle line:90%
you need to know a little bit
about JavaScript because it

30
01:00.450 --> 01:02.890 align:middle line:84%
is very JavaScript specific.

31
01:02.890 --> 01:05.970 align:middle line:90%
You see, again, when we go to
a website, what we're really

32
01:05.970 --> 01:08.700 align:middle line:90%
doing is just downloading
a bunch of files,

33
01:08.700 --> 01:11.760 align:middle line:90%
like HTML documents,
CSS documents,

34
01:11.760 --> 01:12.900 align:middle line:84%
and JavaScript documents.

35
01:12.900 --> 01:14.910 align:middle line:90%
You can open these
files up with Notepad

36
01:14.910 --> 01:16.628 align:middle line:84%
and see the underlying code.

37
01:16.628 --> 01:19.170 align:middle line:90%
Or take it a step further, if
I actually bring a website back

38
01:19.170 --> 01:22.292 align:middle line:90%
up here, and press F12,
this shows you the code

39
01:22.292 --> 01:23.250 align:middle line:84%
that you've downloaded.

40
01:23.250 --> 01:26.220 align:middle line:90%
Here's the HTML code,
here's some JavaScript code.

41
01:26.220 --> 01:28.740 align:middle line:90%
When you see the script, there
is the JavaScript itself.

42
01:28.740 --> 01:30.630 align:middle line:90%
And if you even go to
the network section,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

42
01:28.740 --> 01:30.630 align:middle line:90%
And if you even go to
the network section,

43
01:30.630 --> 01:32.850 align:middle line:90%
it will show you which
files you've downloaded.

44
01:32.850 --> 01:33.840 align:middle line:84%
You get the idea.

45
01:33.840 --> 01:37.290 align:middle line:90%
All a web browser does downloads
these little text documents,

46
01:37.290 --> 01:39.480 align:middle line:90%
and turns them into a
website based on what

47
01:39.480 --> 01:41.000 align:middle line:84%
the text documents say to do.

48
01:41.000 --> 01:43.500 align:middle line:90%
So at the time that
we visited a website,

49
01:43.500 --> 01:47.040 align:middle line:90%
our web browser is now holding
this website in memory,

50
01:47.040 --> 01:48.360 align:middle line:84%
in its own memory.

51
01:48.360 --> 01:52.780 align:middle line:90%
And it's executing the HTML,
CSS and JavaScript code.

52
01:52.780 --> 01:57.000 align:middle line:90%
So if we were to write a
little JavaScript code here,

53
01:57.000 --> 02:00.240 align:middle line:90%
like trigger on alert,
this JavaScript code
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
01:57.000 --> 02:00.240 align:middle line:90%
like trigger on alert,
this JavaScript code

54
02:00.240 --> 02:03.940 align:middle line:90%
could be executed
immediately in our browser.

55
02:03.940 --> 02:06.480 align:middle line:90%
Now what are some other things
that our web browser does?

56
02:06.480 --> 02:09.360 align:middle line:90%
For instance, if we
log into a website,

57
02:09.360 --> 02:13.620 align:middle line:90%
our web browser is going to be
holding a token or a cookie.

58
02:13.620 --> 02:16.770 align:middle line:90%
So it is theoretically possible
that if the website itself

59
02:16.770 --> 02:20.130 align:middle line:90%
is poorly written, we could
create a cross-site scripting

60
02:20.130 --> 02:23.100 align:middle line:90%
attack, send someone
to a malicious website,

61
02:23.100 --> 02:25.260 align:middle line:90%
and then steal their
token or cookie.

62
02:25.260 --> 02:28.740 align:middle line:90%
We could grab their token or
cookie out of their website,

63
02:28.740 --> 02:30.923 align:middle line:90%
and do something else like
email it to ourselves.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

63
02:28.740 --> 02:30.923 align:middle line:90%
and do something else like
email it to ourselves.

64
02:30.923 --> 02:32.340 align:middle line:90%
So the first thing
you should know

65
02:32.340 --> 02:34.230 align:middle line:90%
about the cross-site
scripting attack

66
02:34.230 --> 02:36.760 align:middle line:90%
is that it can
attack content that's

67
02:36.760 --> 02:40.110 align:middle line:90%
within the web browser
itself without ever talking

68
02:40.110 --> 02:41.610 align:middle line:84%
to a server or database.

69
02:41.610 --> 02:44.670 align:middle line:90%
But beyond that
JavaScript can still

70
02:44.670 --> 02:47.020 align:middle line:84%
talk to a server or a database.

71
02:47.020 --> 02:49.110 align:middle line:90%
So it could perform
similar malicious things

72
02:49.110 --> 02:50.950 align:middle line:90%
like we saw in
the SQL injection.

73
02:50.950 --> 02:54.090 align:middle line:90%
This is all about exploiting
the weakness in the website

74
02:54.090 --> 02:56.790 align:middle line:90%
code itself, and
accessing resources

75
02:56.790 --> 03:00.390 align:middle line:90%
like servers or databases,
or tokens or information
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

75
02:56.790 --> 03:00.390 align:middle line:90%
like servers or databases,
or tokens or information

76
03:00.390 --> 03:03.630 align:middle line:90%
that may be stored within
the web browser itself.

77
03:03.630 --> 03:05.250 align:middle line:90%
Within the web
browser itself, this

78
03:05.250 --> 03:08.940 align:middle line:90%
is called the document object
model, or the DOM for short.

79
03:08.940 --> 03:11.400 align:middle line:90%
So all items that are
loaded by a website

80
03:11.400 --> 03:14.917 align:middle line:90%
can now be accessed by
JavaScript using the DOM.

81
03:14.917 --> 03:16.500 align:middle line:90%
And just like in the
last Nugget where

82
03:16.500 --> 03:19.740 align:middle line:90%
we had a way to practice
the SQL injection,

83
03:19.740 --> 03:21.900 align:middle line:90%
this time we have
a way to practice

84
03:21.900 --> 03:23.467 align:middle line:84%
the cross-site scripting attack.

85
03:23.467 --> 03:25.050 align:middle line:90%
And that's what we're
going to do now.

86
03:25.050 --> 03:26.910 align:middle line:90%
Let's fire up a new
website, and we'll

87
03:26.910 --> 03:29.370 align:middle line:90%
get started seeing how
the cross-site scripting

88
03:29.370 --> 03:30.640 align:middle line:84%
attack can really work.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

88
03:29.370 --> 03:30.640 align:middle line:84%
attack can really work.

89
03:30.640 --> 03:32.720 align:middle line:90%
Now this website URLs
a little bit longer.

90
03:32.720 --> 03:34.262 align:middle line:90%
I'm going to put it
up on the screen,

91
03:34.262 --> 03:36.000 align:middle line:90%
you can see it now
from my web browser.

92
03:36.000 --> 03:36.990 align:middle line:90%
I'm going to press
Enter and it's

93
03:36.990 --> 03:38.490 align:middle line:90%
going to take us to
this particular page

94
03:38.490 --> 03:39.810 align:middle line:90%
and this is cool
there's actually

95
03:39.810 --> 03:41.227 align:middle line:90%
a bunch of different
ways that you

96
03:41.227 --> 03:43.380 align:middle line:90%
can test your cross-site
scripting skills.

97
03:43.380 --> 03:45.480 align:middle line:90%
But there's
absolutely none that's

98
03:45.480 --> 03:49.170 align:middle line:90%
better than Google's very own
cross-site scripting game.

99
03:49.170 --> 03:51.660 align:middle line:90%
You see if we go to the Google
cross-site scripting game,

100
03:51.660 --> 03:54.360 align:middle line:90%
it tells you up
front that Google

101
03:54.360 --> 03:57.540 align:middle line:90%
will pay people to report
cross-site scripting

102
03:57.540 --> 03:59.220 align:middle line:84%
vulnerabilities or bugs.

103
03:59.220 --> 04:02.405 align:middle line:90%
Look at that, that's not a small
amount of money, 7,500 bucks.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
03:59.220 --> 04:02.405 align:middle line:90%
Look at that, that's not a small
amount of money, 7,500 bucks.

104
04:02.405 --> 04:03.780 align:middle line:90%
So what they're
trying to do here

105
04:03.780 --> 04:07.110 align:middle line:90%
is they're trying to train
you how to find and exploit

106
04:07.110 --> 04:09.000 align:middle line:90%
cross-site scripting
vulnerabilities,

107
04:09.000 --> 04:10.570 align:middle line:90%
so that you can
report it to them,

108
04:10.570 --> 04:11.738 align:middle line:84%
and they can help you out.

109
04:11.738 --> 04:13.530 align:middle line:90%
So this is a little
game that will actually

110
04:13.530 --> 04:15.690 align:middle line:90%
walk you through
like trivia on how

111
04:15.690 --> 04:18.180 align:middle line:90%
you can execute cross-site
scripting vulnerabilities.

112
04:18.180 --> 04:20.850 align:middle line:90%
If we click let me at
'em, here's our first one.

113
04:20.850 --> 04:22.740 align:middle line:90%
You can toggle the
target code here,

114
04:22.740 --> 04:26.540 align:middle line:90%
and it will show you a little
Python code that's written here

115
04:26.540 --> 04:28.590 align:middle line:90%
that hasn't been
written in such a way

116
04:28.590 --> 04:33.210 align:middle line:90%
that it will handle stopping the
injection of JavaScript code.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

116
04:28.590 --> 04:33.210 align:middle line:90%
that it will handle stopping the
injection of JavaScript code.

117
04:33.210 --> 04:36.930 align:middle line:90%
You see in HTML, when we want
to write JavaScript code,

118
04:36.930 --> 04:39.180 align:middle line:84%
we simply write a script tag.

119
04:39.180 --> 04:43.330 align:middle line:90%
Now our challenge here is to
fire off the alert JavaScript

120
04:43.330 --> 04:43.830 align:middle line:84%
code.

121
04:43.830 --> 04:45.450 align:middle line:90%
This is when it pops
up on your screen

122
04:45.450 --> 04:46.980 align:middle line:84%
and says an error has occurred.

123
04:46.980 --> 04:48.870 align:middle line:90%
And then close the
tag with a script tag

124
04:48.870 --> 04:52.320 align:middle line:90%
this is going to be sending in
an HTML script of JavaScript

125
04:52.320 --> 04:53.460 align:middle line:84%
code saying alert.

126
04:53.460 --> 04:55.170 align:middle line:90%
So I typed this in
and click Search.

127
04:55.170 --> 04:57.930 align:middle line:90%
And look at that it actually
fired off the JavaScript

128
04:57.930 --> 05:00.120 align:middle line:84%
alert in my very own browser.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

128
04:57.930 --> 05:00.120 align:middle line:84%
alert in my very own browser.

129
05:00.120 --> 05:02.470 align:middle line:90%
So if we move on to the
next attack target here,

130
05:02.470 --> 05:03.720 align:middle line:84%
it shows us a little bit more.

131
05:03.720 --> 05:05.527 align:middle line:90%
Now we're looking
at a message forum

132
05:05.527 --> 05:07.110 align:middle line:90%
and if we toggle the
target code here,

133
05:07.110 --> 05:08.700 align:middle line:84%
it's again some Python script.

134
05:08.700 --> 05:12.540 align:middle line:90%
But this time it's been
written to handle these script

135
05:12.540 --> 05:14.940 align:middle line:90%
tags so that we
don't inject script

136
05:14.940 --> 05:16.872 align:middle line:84%
tags with-- into the code.

137
05:16.872 --> 05:18.330 align:middle line:90%
But there's still
ways that you can

138
05:18.330 --> 05:22.080 align:middle line:90%
handle, or send in JavaScript
code with other tags.

139
05:22.080 --> 05:24.330 align:middle line:90%
A popular one is
through the image tag,

140
05:24.330 --> 05:26.880 align:middle line:90%
where we want to embed an
image into our website.

141
05:26.880 --> 05:29.490 align:middle line:90%
So what we can do to actually
send in JavaScript code

142
05:29.490 --> 05:32.940 align:middle line:90%
without using a script tag
is we can use the image tag,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

142
05:29.490 --> 05:32.940 align:middle line:90%
without using a script tag
is we can use the image tag,

143
05:32.940 --> 05:35.010 align:middle line:84%
but force it to throw an error.

144
05:35.010 --> 05:38.010 align:middle line:90%
You see, if I say an
image with no source,

145
05:38.010 --> 05:39.780 align:middle line:90%
that will obviously
trigger an error.

146
05:39.780 --> 05:43.950 align:middle line:90%
And we can say upon the
event where an error occurs,

147
05:43.950 --> 05:46.140 align:middle line:84%
run this JavaScript code.

148
05:46.140 --> 05:49.300 align:middle line:90%
I'll close the tag here
and hit share look at that.

149
05:49.300 --> 05:50.110 align:middle line:84%
There we go.

150
05:50.110 --> 05:51.600 align:middle line:90%
So you can see
immediately, there

151
05:51.600 --> 05:54.060 align:middle line:90%
are a few different ways
that hackers can send

152
05:54.060 --> 05:55.980 align:middle line:84%
in malicious JavaScript code.

153
05:55.980 --> 05:57.840 align:middle line:90%
And ultimately, they
can perform whatever

154
05:57.840 --> 05:59.680 align:middle line:90%
actions they want
you on the server,

155
05:59.680 --> 06:01.710 align:middle line:90%
as long as the web
application or JavaScript
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

155
05:59.680 --> 06:01.710 align:middle line:90%
as long as the web
application or JavaScript

156
06:01.710 --> 06:03.120 align:middle line:84%
itself can access that.

157
06:03.120 --> 06:05.700 align:middle line:90%
And just like before, it
can access anything that's

158
06:05.700 --> 06:07.540 align:middle line:84%
in the DOM at this point too.

159
06:07.540 --> 06:09.540 align:middle line:90%
So if the application
or the security section

160
06:09.540 --> 06:11.610 align:middle line:90%
were holding tokens
JavaScript would

161
06:11.610 --> 06:13.500 align:middle line:90%
be able to exfiltrate
those tokens

162
06:13.500 --> 06:15.400 align:middle line:84%
and send it wherever we want.

163
06:15.400 --> 06:17.520 align:middle line:90%
So that's been the
cross-site scripting attack.

164
06:17.520 --> 06:19.260 align:middle line:90%
I hope this has been
informative for you,

165
06:19.260 --> 06:22.160 align:middle line:90%
and I'd like to thank
you for viewing.