RE: Detecting cross-site scripting attacks

From: Calderon, Juan C (CORP, DDEMESIS) <Juan.Calderon(at)ddemesis.ge.com>
Date: Wed May 14 2003 - 11:15:19 EDT

---

I am new to web application security, a lot of layer 7 application security products detect cross-site scripting attacks (ex: sanctum appshield). How these products do?

---

I agree with Roshen, this products look for <script> tags into the Query string (parameters part of URL) or the POST bytes flow into HTTP requests.

How ever not only this tag could be used for data stealing, some other like <FORM> can be used as well by "replacing" real forms, making users send sensitive information to a diferent site that the one intended. This is the same basis than in XSS, except that your are not running any script.

you may find interesting this article from CERT http://www.cert.org/advisories/CA-2000-02.html Received on Wed May 14 11:58:58 2003