View source for Webscarab XSS-CRLF plugin

==The XSS/CRLF Injection plugin==

===Overview===

The XSS/CRLF plugin examines suspicious HTTP requests for cross-site scripting and CRLF injection (HTTP response splitting) vulnerabilities. Unlike other tools, plugin doesn't crawl the site trying to discover vulnerable URLs, instead it passively analyzes all HTTP conversations passing through WebScarab. The plugin will inspect each request and response too check if:

* Any value of GET/POST parameters is reflected in body of HTTP response, which indicates a potential for a reflected XSS vulnerability;
* Any value of GET/POST parameters is reflected in HTTP headers of HTTP response, which indicates a potential for a CRLF injection vulnerability;

The table in the upper half of the plugin's window will show all suspicious HTTP requests. By clicking the "Check" button plugin will attempt to perform a test to check whether test strings for XSS and CRLF injection vulnerabilities pass through successfully. 

'''NOTE:''' depending on vulnerability specifics and application, automated testing may not produce reliable results (e.g. less than and greater than characters are filtered, however exploitation of XSS is still possible without use of these characters, for example if XSS occurs within the 'script' tag).

For XSS, plugin will send a user-controlled XSS test string as a value of a potentially vulnerable parameter and check the response body for the presence of the test string, if the string was discovered it may indicate that application is vulnerable to cross-site scripting vulnerability. For CRLF injection (HTTP response splitting), plugin will again send user-controlled CRLF test string, which is supposed to create new HTTP header, as a value of a potentially vulnerable parameter and check the response HTTP headers for the presence of new HTTP header created by CRLF test string, if the header is present it may indicated that application is vulnerable to cross-site scripting vulnerability.

===Limitations===

Stored cross-site scripting vulnerabilities aren't supported yet.
[[Category:OWASP WebScarab Project]]
[[Category:OWASP Top Ten Project]]
[[Category:OWASP Testing Project]]