Cross Site Scripting Scanning ("XSSS")

XSSS Software

xsss is a brute force cross site scripting scanner

Download v0.40 beta. License: GPL

Agenda of the lecture "Cross Site Scripting Scanning" @ WTH

The lecture will be divided into three parts:

Introduction to Cross Site Scripting (aka XSS)
Safe coding practices
Scanning for vulnerabilities

The introduction tries to cover all aspects of the problem, starting with its impact, followed by a discussion of the browser's JavaScript security model and browser cookies that are relevant to the problem. This part ends with a live step-by-step session hijacking demonstration.

The second part, "Safe coding practices" targets mostly web developers. I will show typical vulnerable code and talk about perl's taint mode and PHP's functions for sanitizing data. Making session cookies more theft-resistant is also a topic.

Finally, XSS scanning is discussed, illustrated by a live demonstration of a new, free scanning tool which I am releasing at What The Hack. Scan your site before others do it for you!

What The Hack 2005 slides

Download PDF (V3)

Cross Side Scripting (XSS) links

List of XSS vulnerabilities
Finding XSS vulnerabilities
PHP security guide
Nessus XSS plugins
Mozilla XBL vulnerability - works with JavaScript off (Firefox 1.04 demo)
Chorizo!, a vulnerability scanner service by Mayflower
more links coming up ...