Answer

How to defend against a DOM-based XSS attack

What is the difference between a DOM-based cross-site scripting (XSS) attack versus a typical XSS attack? How should enterprise defenses differ for DOM-based attacks?

    Requires Free Membership to View

Ask the Expert!

SearchSecurity expert Nick Lewis is standing by to answer your questions about enterprise security threats. Submit your question via email. (All questions are anonymous.)

DOM-based XSS attacks are a type of XSS attack where the JavaScript code embedded in a webpage is modified so unexpected JavaScript is run, allowing the attacker to access cookies or other sensitive data. It does not modify the HTML on the victim webpage like a traditional XSS, but it can be just as damaging.

Enterprise defenses against DOM-based XSS attacks are similar to those against regular XSS attacks, but they do vary when it comes to defending clients versus servers.

To defend a client system, it would be helpful to use a Web browser that blocks potential XSS attacks -- like Firefox with the NoScript plug-in -- or use client-side host intrusion prevention software that blocks XSS attacks.

On the server side, either a network-based Web application firewall or an intrusion prevention system with XSS signatures could be used. The potentially vulnerable application should also include input validation, which not only ensures that only valid input is used, but also offers additional security benefits, such as preventing SQL injection. Validation of the submitted data in the system can also reduce the manual processes to clean the data.

Currently, there are new attack prevention techniques being discussed, such as the anti-XSS framework conceived by researchers Joseph Bugeja and Geraint Price, but there are no silver bullets to block all XSS attacks. Bugeja and Price described their anti-XSS framework as a layer that sits between a Web application and user-generated input, allowing an enterprise to write rules about what application input can be accepted or blocked. If this rule-based mechanism proves viable, it may be a worthwhile emerging defense against DOM-based XSS attacks.

This was first published in December 2013

There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: