Ask HN: Testing your site for XSS exploits

https://news.ycombinator.com/item?id=761610

by mshafrir • 17 years ago

4 9 17 years ago

news.ycombinator.com

What tools or techniques do you use to test for and secure your site from XSS exploits?

yan• 17 years ago

I would pay someone like me to assess your code and pentest your site :)

If you're planning on doing this yourself, OWASP (www.owasp.org) is a great resource.

tonystubblebine3• 17 years ago

For people using Rails, sanitize all input before it goes in. Here's a library for web params. http://code.google.com/p/sanitizeparams/

there• 17 years ago

so when some new technique comes out down the road that your input filtering didn't catch, are you going to update everything in your database? and what about data that gets in from other sources?

i don't see the benefit in filtering input; html and alert()'s inside a database don't affect anything until they come back out.

mbrubeck• 17 years ago

Also, proper sanitization is different for HTML, JavaScript, SQL, URIs, and other contexts.

tonystubblebine3• 17 years ago

The benefit to filtering input is that it is less error prone for programmers. The filter on output method that most Rails programmers use involves setting it up on an output-by-output method. I like the input technique because it only needs to be configured once.

I think the risk of new techniques getting by this filter are low (although the risk of the filter having bugs is high, as judged by the number of bugs that popup in more critical software). In XSS there are only a limited set of attack vectors (iframe, javascript, flash), and those get filtered completely. The underlying filter is based on whitelisting, so it's not like new additions to the HTML spec are going to open security holes before we have a chance to close them (it's the opposite, new, safe HTML additions will need to be explicitly allowed before they can be used).

planck• 17 years ago

Assume all data entered by users is malicious and encode it properly on display. That's really all there is to it.

pwmanagerdied• 17 years ago

Amen to that.

Everyone overcomplicated the issue, it's not a difficult issue to solve: whenever untrusted data is to be displayed to a user, escape it. Problem solved.

lhorie• 17 years ago

Tools like Paros http://www.parosproxy.org/index.shtml will spider/scan for some common attack patterns.

It's also definitely nice to have a dedicated qa person (preferably someone familiar with the code) trying to break your site, both manually and with tools like Selenium http://seleniumhq.org/

Ask HN: Testing your site for XSS exploits

Related Stories