What is blind XSS?

You probably have heard of XSS attacks already, but to start our article, we will first review their meaning and the reasons they are designed for. We also will see their different types and their functions. Finally, you will learn how to protect your information against these attacks.

XSS attacks

XSS is one of the most common vulnerabilities in web applications and occurs when the application uses invalid or unencrypted user inputs in the generated output. In this method, the attacker does not directly target the victim; rather, it uses vulnerabilities in a web application visited by the victim. In this way, the vulnerable website is how the malicious script is transmitted to the victim's browser. XSS can attack VBScript, ActiveX, and Flash; But the most important target of these attacks is JavaScript. To execute malicious JavaScript code in a browser, an attacker must place their code between the pages victims visit (victims are users who visit pages infected with malicious code). JavaScript has limited access to the operating system and files for security reasons:

- JavaScript cannot read, write, copy and run files on the hard disk and does not have direct access to the operating system.

- Modern browsers allow JavaScript to work with files, provided that the file is selected through input into the web page with the user's permission and is limited to accessing the same file.

- When you open a new tab in the browser, the JavaScript of these two tabs (two separate pages) has no access to each other.

Given the above limitations, how do malicious scripts compromise our security?

- JavaScript accesses cookies (small text files store user information from a site, such as a username and a password). Cookies are used to store session tokens. Therefore, if the hacker can obtain a user's session cookie, they can use their identity and impersonate it.

- JavaScript allows changes to the browser DOM (inside the page where JavaScript is running).

- JavaScript can use the XMLHttpRequest object to send HTTP requests with the desired content to the destination.

- In today's modern browsers, accessing the camera, microphone, GPS and, certain files is possible through HTML5 APIs.

Types of XSS methods

- Reflected XSS Attack

In this method, the malicious script is part of the victim's request from the website. The website also sends it to the user as a response.

- The hacker creates a URL containing the malicious string and sends it to the victim.

- The hacker tricked the victim into various ways, including social engineering, to request that URL.

- The website puts the malicious thread inside the URL in response to the user.

- The victim browser executes the malicious script in the response, and as a result, the victim cookie is sent to the location specified by the hacker.

You may be wondering how a victim submits a URL containing malicious code to hack themselves! If someone does not intentionally hack themselves. But there are two ways to do this:

1. A hacker can target a specific user and send them a malicious URL via email or other messengers, using social engineering to persuade them to request that URL.

2. If a hacker intends to target many users, they can publish a link (malicious URL) on their website or social networks and wait for users to request it (click on it).

- Stored XSS Attack

The hacker enters the malicious code into the database (inject) in this method. Suppose there is an XSS bug in the product comment section, and the hacker can enter the malicious script. This malicious code is stored in the database, and every time a user visits this page, the malicious code is executed in their browser.

- DOM-based XSS

- The hacker sends a URL containing malicious code to the victim.

- The victim clicks on the link. The website responds to the request, but the malicious code is not included in the response.

- The victim's browser executes the non-malicious script inside the response, causing the malicious script to enter the page.

- By executing malicious code inside the victim's browser, their cookie will be sent to the destination specified by the hacker.

What is the Blind XSS vulnerability?

A blind XSS vulnerability is a type of Persistent XSS vulnerability. The vulnerability occurs when an intruder test input is stored on a web server and executed by a script in another part of the program or totally in another program.

For example, an attacker injects a malicious plugin into the Contact or Feedback page, and the upload is executed when the webmaster is watching the feedback sent by the attacker. An intruder upload can be executed in a completely different application (for example, an internal application, where the administrator sees access logs or application errors).

Vulnerability exploitation

As you know, Google has a big scope, and it is a difficult way to detect intruders detect bugs and exploits. After identifying the Stored XSS vulnerability in Google Ads, the next goal of the hacker test in this section is the Google Analytics part. Hacker Test works on Google Analytics for about five days and examines various vulnerabilities such as access enhancement, IDOR, Stored XSS, and logical vulnerabilities. But they do not find a specific case. The hacker test states that it examines the Blind XSS vulnerability as the endpoint whenever it intends to end the test. To this end, the hacker test begins to identify the Blind XSS vulnerability by placing different feeds in different parts of the program. It should be noted that in this step, the intruder test uses the uploads have created in XSS Hunter. By registering in XSS Hunter, you will receive an upload to your subdomain.

Ways to deal with these attacks

1. One of the most important ways to deal with XSS attacks is to constantly monitor the incoming information to the site. Due to sending malicious code through the forms, the security of the forms should be increased in such a way as to prevent the entry of any unauthorized queries.

2. To send information to the database, use the query method to check the information separately and increase the site's security, speed, and efficiency during attacks.

3. Be careful when posting a message or alert on the site that the message or alert does not include tips to help hackers identify the site's vulnerabilities.

4. Always keep your databases and your site content up to date with the latest available versions.

5. Frequently check users' access to databases so that if another user's information is disclosed, there will not be a possibility to access the site database.

6. Maximize the security of your site and hosting.

7. Use strong passwords in your databases so that hackers can not easily identify them. Also, put these passwords in the most secure state.

8. Sometimes, the database may send an error message on the site, and by hiding such messages, you can protect your site from hackers.

9. Changing your database prefix can make hacking almost impossible for hackers. Because hackers usually use the default wp-prefix to access the database.

10. Using trusted plugins and templates, you can create more security for your site against attacks. And also, use the WAF web application firewall to prevent hackers from entering your site.

One of the most useful defenses against XSS attacks

Web application firewall (WAF) is the most common solution for protecting against XSS or cross-site scripting attacks and web applications. WAFs use a variety of methods to deal with attack vectors. In the case of XSS, they rely more on signature-based filters to detect and block malicious requests. The Imperva cloud web application firewall also uses signature filters to deal with cross-site script attacks in line with industry best practices. Imperva Cloud WAF is offered as a managed service, regularly run by a team of security experts who constantly update the security law with signatures of newly discovered attack vectors. Imperva clutch technology automatically collects data through its network and attacks the benefit of all customers. The crowded approach responds quickly to zero-day threats and protects the entire user community from any new threats when a single attack is detected. Crowdsourcing also enables the use of an IP reputation system that blocks recurring offenders, including botnet resources that multiple criminals are reusing.