Session XSS

Java Script is used for making webpages a little more interactive , it could also be used for making games.

JavaScript can change all the HTML elements in the page
JavaScript can change all the HTML attributes in the page
JavaScript can change all the CSS styles in the page
JavaScript can remove existing HTML elements and attributes
JavaScript can add new HTML elements and attributes
JavaScript can react to all existing HTML events in the page
JavaScript can create new HTML events in the page

Basic syntax:

<script></script>
e.g Giving popup--> <script>alert('hello')</script>


<!DOCTYPE html>
<html>
<head>
    <title>JavasScript</title>
</head>
<body>

<button onclick="alert('hello world!')">Click me!</button>
</body>
</html>

DOM

<p id="cali">Hello World!</p>
<button id="jingle">Change text</button>

<script>
    document.getElementById("jingle").onclick = function(){
        document.getElementById("cali").innerHTML="Hello Hackers"
    }
</script>
___________________
Cross Site Scripting (XSS)

It is an attack in which hackers are able to execute javascript code on a web site, It is of three types
->XSS Reflected
->XSS Stored
->DOM(Document object model) based XSS


This attack can be used by hacker to execute javascript code in victim browser to hijack user sessions,deface website, insert content, etc


XSS Payloads
= = ==========
    <h1>hello</h1>
    <script>alert("hacked")</script>
    <script>alert(document.cookie)</script>
    <iframe src="http://www.lucideus.com"></iframe>
    <input onfocus=javascript:alert(1) autofocus>

cheatsheet
https://gist.github.com/kurobeats/9a613c9ab68914312cbb415134795b45

Broken Authentication and Session Management

In broken authentication or session management hackers make an attempt to steal account from another users, Attackers/hacker uses leaks and flaws in the authentication or session management Functions.

like weak credentials or defualt login credentials

Why this attack occurs

->User credentials are not protected when stored using hashing or encryption
->Credentials can be guessed or overwritten through weak management functions e.g(Hacker is able to guess session id , or change password)
->Session id's are exposed in the url
->Session id's don't time out
->passwords,credentials,session-ids are sent over in unencrypted form




dom->Document Object Model-> Environment Code:
<!DOCTYPE html>
<html>
<head>
    <title>DOM Based XSS</title>
</head>
<body>
    <form>
    <h1 id=greeting></h1>
<h1>Enter your name</h1>

<input type="text" name="person" onkeyup="displayGreeting(person.value)" value=""></input>

</form>
<script type="text/javascript">
    function displayGreeting(name){
        if (name!=''){
            document.getElementById('greeting').innerHTML="hello ,"+name+ "!";
        }
    }
</script>
</body>
</html>