This document discusses DOM-based cross-site scripting (XSS) vulnerabilities. It provides examples of DOM XSS issues that tools like DOMinator fail to detect. The key points are: - DOM XSS arises due to client-side coding practices and the complex browser context, not just server-side issues. - Examples show how input can be injected into the DOM without appearing in the page source, bypassing detection. - Frameworks like YUI and jQuery are not inherently unsafe - it is insecure coding practices like insecure templating and lack of input sanitization that cause vulnerabilities. - Browser behaviors like automatic decoding can also facilitate DOM XSS unless coding accounts for context changes. - Def

1. DOM XSS: ENCOUNTERS OF THE 3RD KIND
http://www.flickr.com/photos/8407953@N03/5990642198/

2. OBJECTIVES
http://www.w3schools.com/htmldom/default.asp
http://www.flickr.com/photos/spaceodissey/2580085025/sizes/z/in/photostream/
http://www.flickr.com/photos/22841448@N08/2337148051/
http://www.flickr.com/photos/jesse_sneed/2383953694/
http://www.flickr.com/photos/diavolo/5870934960/

3. UNDERSTANDING DOM

4. COMPLEX BROWSER CONTEXTS
JavaScript URI XSS HTML->DOM->HTML Auto Decoding
(to be covered in Demo#7)
JavaScript Auto Decoding
(not covered. Similar to Demo#7)
Ref: http://www.cs.berkeley.edu/~dawnsong/papers/2011%20systematic%20analysis%20xss

5. WHY WORRY?
Who is safe? Those who write
quality code – DOM Construction
and Input Sanitization
But, could they (YUI/jQuery/Browsers) do better?
Yes, MY WISHLIST
- make it easier to do the right thing
- Warn on unsafe & abuse-able APIs
- Provide in-function sanitization capability
Predicted to be one of the top 5 (Aah, context-sensitive auto-sanitization would be
security issues for 2011 great, but let’s not be too optimistic ATM)
http://jeremiahgrossman.blogspot
.com/2011/02/top-ten-web- Native APIs & Frameworks do no protect.
hacking-techniques-of-2011.html Context, performance & security after thought.
IBM found 2370 vulnerabilities on 92 sites out of Minded Security found 56 out of
850 Fortune 500 Alexa top 100 sites vulnerable
http://public.dhe.ibm.com/common/ssi/ecm/en/raw http://blog.mindedsecurity.com/20
14252usen/RAW14252USEN.PDF 11/05/dominator-project.html
(They released a commercial add-on to AppScan (They also released a free tool -
called JSA. Not available for eval yet) DOMinator, we will eval that)

6. SAMPLE #1: DOM XSS (WITH DOMINATOR)
Q#1: New? No, first discovered by Amit Klein in 2005 www.webappsec.org/projects/articles/071105.shtml
Q#2: Then why now? Because code shifted client side - RIA, AJAX, Web2.0
Q#3; What are the tools?
- Do you think they solve the problem?
- Clever people solve, wise avoid. Code Defensively
- Anyways DOMinator and AppScan appear to do a bit but not enough
- Besides DOMinator false negatives, I found it quite unstable on RIA with lots of YUI and jQuery. It crashed
repeatedly.

7. SAMPLE #1: WHAT WENT WRONG?
WHAT WOULD HAVE SAVED THE DAY?
Taint Sources
(Direct or Indirect)
Taint Sinks
(eval, location.replace)
Defensive Coding
Taint Sources & Sinks: http://code.google.com/p/domxsswiki/wiki/Introduction

8. SAMPLE #2: NOT IN VIEW SOURCE
Myth#1 : we have default framework auto-sanitization at the server
– Sever-side auto-sanitization like PHP Filter will not protect
– They has no way of intercepting DOM

9. SAMPLE #2: GENERATED SOURCE DOES
SHOW

10. SAMPLE #2: DOMINATOR FALSE NEGATIVE

11. SAMPLE #3: YUI / JQUERY ISN’T BAD.
DOM TEMPLATING IS!

12. SAMPLE #4: YUI / JQUERY ISN’T BAD.
DOM TEMPLATING IS!
(DOMINATOR DIDN’T CATCH THIS ONE TOO)

13. SAMPLE #5: YOU DON’T NECESSARILY NEED
FILTERING. YUI / NATIVE JS API (INNERTEXT) / OTHERS LET YOU PLAY
SAFE. THIS IS CALLED DOM CONSTRUCTION

14. SAMPLE #5: BEWARE OF CONTEXTS.
AGAIN YUI / NATIVE JS API / OTHERS ARE NOT BAD.
NO FILTERING / CONTEXT INSENSITIVE FILTERING IS!

15. SAMPLE #6: BEWARE OF CONTEXTS.
AGAIN YUI / NATIVE JS API / OTHERS ARE NOT BAD.
NO FILTERING / CONTEXT INSENSITIVE FILTERING IS!

16. SAMPLE #7: BEWARE OF AUTO-DECODING.
AGAIN YUI / NATIVE JS API / OTHERS ARE NOT BAD.
INSECURE CODING / INSUFFICIENT FILTERING IS!
(ANOTHER THING DOMINATOR DIDN’T CATCH)
Myth#2 : I encoded server-side right?
– Exception. When DOM and HTML are mixed they tend to explode
– HTML->DOM->HTML means switching of context and browser auto decoding

17. THANKS FOLKS…
bish@route13.in yukinying@gmail.com
twitter:b1shan twitter: yukinying