XSS Web Page Vulnerability

Video Summary

This is a Youtube video discussing a common vulnerability on a web page called cross site scripting (XSS), and is created by the Youtuber, PwnFunction, a youtuber I find myself coming acrossed ever so often. His content mainly consists of educational content regarding ethical hacking and cyber security. Many of his videos talk about more obscure topics pertaining to the subject, which I appreciate in the endless Youtube sea of generic "hacking" and cybersecurity tutorials. Though this video is pretty old now, I still think it contains some value information about what XSS is, how it is exploited, and how it can be prevented.

Mr. PwnFunction starts off the main premise of the video explaining how JavaScript poses some security risks on its own. It his access to HTML, which in turn gives it the power to alter web content, read cookies, and obtain csrf tokens. That's great and all, but how exactly would an attacker utilize this? Well, as Mr. Function states, that's where XSS comes in with JS injection.

He starts with a basic example of injection, with a simple http web page with an input text box that asks for the user's name, and returns "Hello [name]!" It takes the input, sends it to the server as an http GET parameter, and the server returns an html response that will be displayed on the page. Since the browser perceives the response as entirely html, if someone where to put an something like <script>[example code]<script> it would simply execute the code without knowing the difference, if that makes sense at all. The video is much better at explaining this than I am, and provides lots of visuals to help you better understand. What I described here is only a bare bones example of what an XSS attack can look like as it comes in multiple types.

XSS Attack Types

Mr. Pwn also differentiates the different types of XSS attacks into four primary types:

Reflected

-A type of attack where the input is reflected back in the response on the page, like the example I gave above.

Stored

-Input is stored in a database instead of only being reflected back to the page, slightly more troubling

DOM

-Only exists on the client side where the attacker injects malicious code into a DOM property. To be honest, I still don't totally understand how this one works.

Mutated

-Seemingly safe input is injected and makes it past sanitation, but mutates once assigned to a DOM property. I think.

Prevention

Mr. Function states that patching these vulnerabilities is not as simple as it seems. There are many possible solutions to this problem, like blocking script tags or html tags in general, but these come with their own complications. However, this has been a known issue long enough that there are a plethora of function solutions out there. PwnFunction suggests DOMPurify, a library that sanitizes input that leaves only outputs safe content. Since this is an old video, I'm not sure how great this holds up now, but I will still link it below.

I'm not sure if this video technically fulfills the requirements for this assignment. It's not technically a tutorial, persay, but I sorta think it is if you squint.