OWASP ModSecurity Securing WebGoat Section4 Sublesson 03.1 - Revision history

Stephen Evans at 09:31, 13 November 2008

2008-11-13T09:31:16Z

Stephen Evans: /* Implementation */

2008-10-29T11:44:03Z

‎Implementation

Stephen Evans: /* Comment */

2008-10-29T11:41:52Z

‎Comment

Stephen Evans: typo

2008-10-29T11:35:03Z

typo

Stephen Evans at 07:49, 21 October 2008

2008-10-21T07:49:12Z

Stephen Evans: /* Implementation */

2008-10-20T04:30:28Z

‎Implementation

Stephen Evans: /* Implementation */

2008-10-20T04:28:55Z

‎Implementation

Stephen Evans: /* Implementation */

2008-10-20T04:28:08Z

‎Implementation

Stephen Evans: /* Implementation */

2008-10-20T04:26:25Z

‎Implementation

Stephen Evans: /* Implementation */

2008-10-20T04:13:24Z

‎Implementation

@@ Line 32: / Line 32: @@
 === Implementation ===
-A ModSecurity solution could be to use the blacklist rules for XSS provided by the core ruleset but this has previously been done in other lessons in Section 8: Cross-Site Scripting (XSS).
+Since this vulnerability is in the JavaScript code, the attack payload stays on the client side and ModSecurity will not see it since it will not be sent to the server.
-Instead, our solution will be to replace the 'displayGreeting' function with our own by appending it to the end of the HTML page and calling the 'escapeHTML' function in 'escape.js'. While not practical (an attacker could bypass the new function), replacing an existing Javascript function with a new one will be demonstrated.
+Instead, our solution will be to replace the 'displayGreeting' function with our own by appending it to the end of the HTML page and calling the 'escapeHTML' function in 'escape.js'. While not practical (an attacker could bypass the new function), replacing an existing JavaScript function with a new one will be demonstrated.
-The Javascript function:
+The JavaScript function:
 <pre>
 <script language="JavaScript1.2" type="text/javascript">
@@ Line 51: / Line 51: @@
 A phase 2 rule is not necessary; the function can be placed in every HTML page for this lesson.
-The phase 4 rule in 'rulefile_03-1_DOM-based-XSS.conf' is (the Javascript should be packed on one line):
+The phase 4 rule in 'rulefile_03-1_DOM-based-XSS.conf' is (the JavaScript should be packed on one line):
 <pre>
    SecRule RESPONSE_CONTENT_TYPE "!^text/html" "phase:4,t:none,allow,nolog"
@@ Line 70: / Line 70: @@
 === Comments ===
-* This lesson demonstrates replacing an existing Javascript function with a new one.
+* This lesson demonstrates replacing an existing JavaScript function with a new one.

@@ Line 67: / Line 67: @@
 [[Image:OWASP_ModSecurity_Securing_WebGoat_DOM_based_XSS_SS1.jpg]]
 === Comments ===
 * This lesson demonstrates replacing an existing Javascript function with a new one.

@@ Line 70: / Line 70: @@
 (screenshot lesson03.1_DOM-based-XSS_solved.jpg)
-=== Comment ===
+=== Comments ===
 * This lesson demonstrates replacing an existing Javascript function with a new one.

← Older revision		Revision as of 11:35, 29 October 2008
Line 1:		Line 1:
−	3.1 LAB: DOM-Based cross-site scripting	+	3. AJAX Security -> 3.1 LAB: DOM-Based cross-site scripting

	=== Lesson overview ===		=== Lesson overview ===

@@ Line 3: / Line 3: @@
 === Lesson overview ===
-Refer to the zip file with the WebGoat lesson overviews. See Appendix A for more information.
+The WebGoat lesson overview is included with the WebGoat lesson solution.
 === Lesson solution ===

@@ Line 59: / Line 59: @@
      msg:'appending javascript in rulefile_03-1_DOM-based-XSS.conf',
      append:'<script language=\"JavaScript1.2\" type=\"text/javascript\">
-function displayGreeting(name) {if (name != \"\") {document.getElementById(\"greeting\").innerHTML=\"Hello, \"
+function displayGreeting(name) {if (name != \"\")
 + escapeHTML(name) + \"!\";}}</script>'"
 </pre>

@@ Line 55: / Line 55: @@
    SecRule RESPONSE_CONTENT_TYPE "!^text/html" "phase:4,t:none,allow,nolog"
-   # Here check if session variable set; if so, then substitute the 'displayGreeting' function
+   # Here check if session variable set; if so, then subst. 'displayGreeting' function
-   SecRule SESSION:LESSON031 "@eq 1" "phase:4,t:none,log,auditlog,pass,msg:'appending javascript in rulefile_03-1_DOM-based-XSS.conf', append:'<script language=\"JavaScript1.2\" type=\"text/javascript\">function displayGreeting(name) {if (name != \"\"){document.getElementById(\"greeting\").innerHTML=\"Hello, \" + escapeHTML(name) + \"!\";}}</script>'"
+   SecRule SESSION:LESSON031 "@eq 1" "phase:4,t:none,log,auditlog,pass,
 </pre>

← Older revision		Revision as of 04:13, 20 October 2008
Line 60:		Line 60:

	When malicious input is entered, it is properly escaped and displayed on the HTML page:		When malicious input is entered, it is properly escaped and displayed on the HTML page:
		+
		+	[[Image:OWASP_ModSecurity_Securing_WebGoat_DOM_based_XSS_SS1.jpg]]
		+
	(screenshot lesson03.1_DOM-based-XSS_solved.jpg)		(screenshot lesson03.1_DOM-based-XSS_solved.jpg)