Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2050
  • Last Modified:

Could an XSS attack be mounted using Firebug?

This may be in the "dumb questions category." But I was wondering if it would be possible to use Firebug to create an XSS attack. It seems to be possible but only in the trivial case of disclosing the attackers information only.

But I was wondering if anyone could see a way to make a non-trivial attack. And how would one defend against such?

Any ideas?
0
jasimon9
Asked:
jasimon9
1 Solution
 
ProfessorBindokasCommented:
Hi

Main defenses against cross site scripting are:
1.validation checks in the code framework, e.g., Microsoft's ASP.NET has a nice suite of built-in validation checks that can be used to defend against XSS issues.  J2EE has safeguards as well;
2. the use of a web application firewall "in front" of your application to prevent execution calls to "foreign" websites for script execution (caveat, ensuring that ALL traffic goes through the web application firewall and no send-arounds are possible).

An example of a non-trivial attack would be hijacking of account credentials, which are stored in the form of a SessionID on a cookie and the use of that cookie to impersonate the user on another system.  Another example is use of a XSS vulnerability to modify the information a user is posting to a website, which can be non-trivial if the post information is mission critical or financial in nature.
0
 
jasimon9Author Commented:
You have defined XSS. But you have not addressed my question about Firebug as a means of attacking at all.
0
 
rajivvishwaCommented:
Firebug is nothing but an enhanced HTTP Request-Response parser. To perform XSS attacks, firebug needs automation capabilities to send request in a particular format and validate the response for XSS pattern. For that you have different Firefox addons like XSS Me (https://addons.mozilla.org/en-US/firefox/addon/7598).

To be frank even I was thinking in the same lines i.e to extend firebug to make it work like a security scanner.
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
btanExec ConsultantCommented:
Firebug intercept "execution code" of Firefox browser. It is more of client proxy web code debugger. It does not directly tamper with the web traffic but more of able to set breakpoint of each web call as you browse through the website using firefox. We may change parameter in the code for testing purpose or even tamper that instance of code. It is is just reflected at that instance not at client.

The key is XSS will only occur if real website has such vulnerability. in other word, if website has XSS flaw, firebug can single step through and identify that active javascript to be executed. You may change the script content but having a browser proxy like burp or paros can do more to tamper the web traffic (recv and send out).

in summary, I will say that firebug can help to discover XSS (esp DOM based) instead of directly injecting XSS for persistent Check out this short example on DOM based XSS

@ http://www.net-security.org/dl/articles/Blueinfy-JavaScript-Hacking.pdf 
0
 
jasimon9Author Commented:
You are getting close to the exact nature of my question.

I am essentially wondering if Firebug could be used to create a vulnerability on a page where no vulnerability previously exists. You are saying that this cannot happen, and that there would already have to be a vulnerability to exploit.

If that is in fact what you are saying, then I am thinking my question is answered.

The further point about using Firebug to discover vulnerabilities is also interesting, but is really outside the scope of my question.
0
 
btanExec ConsultantCommented:
I will say Firebug is good as an DOM inspector or JavaScript interpreter. It can to extend inject attack into the website for testing purpose but that is also just validating that the website is vulnerable and not made vulnerable. If interested more, can check out
@ http://www.tekbar.net/hackers-and-security/proficient-in-javascript-attacked-the-framework.html

Hope it helps
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now