PugJr Posted April 6, 2009 Share Posted April 6, 2009 How severe of a condition is it if your page can be attacked with XSS? Like what is the very worst they can do to your website? Completely destroy it? Steal cookies? So more or less is a site inoperable assuming it can be XSSed? Link to comment https://forums.phpfreaks.com/topic/152846-solved-what-can-you-do-with-xss/ Share on other sites More sharing options...
Daniel0 Posted April 6, 2009 Share Posted April 6, 2009 Execute arbitrary Javascript on the client computer, and all that entails. Link to comment https://forums.phpfreaks.com/topic/152846-solved-what-can-you-do-with-xss/#findComment-802688 Share on other sites More sharing options...
PugJr Posted April 6, 2009 Author Share Posted April 6, 2009 Is there a way to disable jscript? So far my website has never used any jscript so if I was to disable it all together would that fix it? EDIT: And by disabling it I don't mean by client side but like server side? Edit: Oh wait a minute, what am I saying? All jscript is, is something on the webpage that the client reads, so how could you disable that? Link to comment https://forums.phpfreaks.com/topic/152846-solved-what-can-you-do-with-xss/#findComment-802689 Share on other sites More sharing options...
Daniel0 Posted April 6, 2009 Share Posted April 6, 2009 You can turn it off in your user agent. Once you've sent the output from your server then you no longer control it. You'll just have to ensure that people have no means of injecting the Javascript in the first place. Link to comment https://forums.phpfreaks.com/topic/152846-solved-what-can-you-do-with-xss/#findComment-802695 Share on other sites More sharing options...
PugJr Posted April 6, 2009 Author Share Posted April 6, 2009 Alright. Thanks. Was hopeing there might have been an easy way out but that doesn't look like it. Link to comment https://forums.phpfreaks.com/topic/152846-solved-what-can-you-do-with-xss/#findComment-802698 Share on other sites More sharing options...
nrg_alpha Posted April 6, 2009 Share Posted April 6, 2009 According to Chris Shiflett's book on essential PHP security, XSS can wreck a range of havoc on applications that displays input from possibly spoofing forms to cross-site request forgery (CSRF) (which translates to sending arbitrary http requests from the victim) for example. Link to comment https://forums.phpfreaks.com/topic/152846-solved-what-can-you-do-with-xss/#findComment-802721 Share on other sites More sharing options...
PugJr Posted April 6, 2009 Author Share Posted April 6, 2009 Oh wait, I also have another question then. Can XSS do anything that damages the server? Only the client right? Link to comment https://forums.phpfreaks.com/topic/152846-solved-what-can-you-do-with-xss/#findComment-802728 Share on other sites More sharing options...
nrg_alpha Posted April 6, 2009 Share Posted April 6, 2009 My understanding is it is the client, not the server. Think in terms of the display of webpages (and what can be manipulated if those pages are not secure enough). You can also google XSS for more info as well, such as XSS info on wikipedia for example. Link to comment https://forums.phpfreaks.com/topic/152846-solved-what-can-you-do-with-xss/#findComment-802734 Share on other sites More sharing options...
PugJr Posted April 6, 2009 Author Share Posted April 6, 2009 Okay that'll be all. Thanks everyone! Link to comment https://forums.phpfreaks.com/topic/152846-solved-what-can-you-do-with-xss/#findComment-802736 Share on other sites More sharing options...
Daniel0 Posted April 6, 2009 Share Posted April 6, 2009 You might want to read this: http://www.phpfreaks.com/tutorial/php-security It's meant to be a primer on the most important security aspects in PHP. Link to comment https://forums.phpfreaks.com/topic/152846-solved-what-can-you-do-with-xss/#findComment-802745 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.