Click here to Skip to main content
15,891,529 members
Home / Discussions / C#
   

C#

 
QuestionHow to Prevent DOM xss attack -shortened- Pin
computer_programmer121-Sep-13 5:29
computer_programmer121-Sep-13 5:29 
AnswerRe: How to Prevent DOM xss attack -shortened- Pin
Richard MacCutchan21-Sep-13 7:13
mveRichard MacCutchan21-Sep-13 7:13 
QuestionHow to set Voucher Print C# window application Pin
Member 1024557620-Sep-13 19:09
Member 1024557620-Sep-13 19:09 
AnswerRe: How to set Voucher Print C# window application Pin
Richard MacCutchan20-Sep-13 21:39
mveRichard MacCutchan20-Sep-13 21:39 
QuestionNeed Basic Silverlight Projects Pin
Rajkumar Kothandapani20-Sep-13 17:46
Rajkumar Kothandapani20-Sep-13 17:46 
AnswerRe: Need Basic Silverlight Projects Pin
codestar00720-Sep-13 18:59
professionalcodestar00720-Sep-13 18:59 
AnswerRe: Need Basic Silverlight Projects Pin
Abhinav S22-Sep-13 3:44
Abhinav S22-Sep-13 3:44 
QuestionPreventing DOM based XSS Script PROBLEM -with details- Pin
computer_programmer120-Sep-13 8:05
computer_programmer120-Sep-13 8:05 
Hi everyone I hope you all are fine and happy.

I need some help here and i will not forget this favor.

This problem is about protecting the users from Malicious DOM Scripts Attacks that the users may be tricked to execute in his/her Browser.

I will explain What is DOM and What is DOM XSS Attack and if you are already know that you can go to


OK OK What do I need here?
to what my plan is and then read My Straight Questions which is the section i want the help from you and I hope you will help me instantly

Now I will explain What DOM and What DOM Based XSS attacks briefly:

First of all (DOM defenition):
DOM is for Document Object Model it is the Tree that any web site or a web application uses , nowadays almost every web site or web application has DOM.
as a great advantage to users , DOM can be used as a good facility for users to access and Manipulate DOM Tree according to user's preferences with a dynamic script language like Java script.
a good example about when a user can modify and manipulate DOM is when user can change the web page's Title or the web page's background color.


The Danger of DOM Based XSS:

DOM Based XSS Attack is when a hacker Modify DOM with a script in a way that a server will never want to , and not according to user's preferences but according to the attackers bad intentions.a hacker or an attacker can trick or persuade the client to run a malicious script to make a DOM attack.

DOM Based XSS Attack is the third type of XSS Vulnerability , sometimes referred as XSS Type 0 Vulnerability which is when the attacker exploits a vulnerable web page to DOM vulnerability and let clients (users) execute and run Malicious DOM scripts at their machines -server never interfere with that- and thus without the wise of clients the server reputation is not good specially if a malicious hackers for example put a bad insults in the title tag to insult the client when visits it because the Malicious DOM Scripts exploits the vulnerabilities of a web page and the Updating and modification of DOM has happened.


OK OK What do I need here?


I need to make a simple tool that prevent DOM based XSS vulnerability which occurs at client side with 4 steps , 3 steps are main steps and the 4th step is optional.

This tool is a windows Application runs at client side.

This tool has a sandbox to prevent the Malicious java script Attacks then take the bad script and extract the tiny point which causes an attack FINALLY it will convert the bad function which causes the attack for example using the dangerous eval() function to a good function and safe function like JSON method. ONLY IF IT POSSIBLE

1-It is a simple browser with its address bar that when a user put a URL ..... a SANDBOX will start and this sandbox will inspect if this URL contains a Malicious Java script (Malicious DOM) then it will detect it and make it stop and never run it in the browser.
I studied and tried the AppDomain class and SecurityManager.GetStandard Method but all of them are for making a sandbox for .exe and Assembly Binary Files I studied Iframe sand Box too and how to sandbox HTML by Iframe and DOM Cheat Sheet in OWASP but i was confused because I don't want to only prevent but instead want to prevent then convert the malicoius scipt to good script the run the good script

2-After the detection of that Malicious DOM it will take that script and take the exact unsafe script point (the unsafe code which refers as unsafe sinks which is the UNSAFE Function) example


3-After taking the exact unsafe DOM code point it will try to convert the unsafe sinks to safe sink for example converting eval() function if causes a malicious script to a good function that may not make trouble if it be used.

4-Contact the server's Web Master to tell him that the server's web page has a vulnerability and tell the developer how to fix these vulnerabilities.



My Straight Questions

1-How to make a sandbox that sandboxing and preventing Malicous Java script at URL address bar with such permissions like never change the title page , never change the images or flash or any other multimedia from outside in the page and never excute a code from outside ?

2-after detecting and preventing through Sandbox , how to take the piece of code which causes the problem from a big malicious script ? e.g. eval() is the responsible for making the problem so i want the program to catch for the 3rd step

3-if for example eval() is the bad function which causes the trouble then how to REPLACE it -mapping- with a safe function? -lets say only a mapping for eval() ,execScript , SetTimeOut , SetTimeInterval
innerHTML , outerHTML document.cookies, location.replace , location.assign , script.src href , src , Iframe -

I red many articles but i didnt find safe mapping for unsafe functions


What are the safe mapping for those unsafe functions or properties??

I red this it was helpful but not complete:
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval[^]


Optional:

4-How to contact with the server site to tell it that it hass a DOM a vulnerability even if we don't have its Web Master email??

5- What are the suggestions for fixing vulnerabilities at the server side??


Notes:

A-Actually I invented this Algorithm to protect clients even if they were tricked to run malicious java scripts what I only need is the help to implement this programmitically , but if you have some other or simpler algorithm than this you are welcomed to tell me about yours or even if modify my algorithm if you see it can make some enhancements.

B-I want this tool to be implemented with C# Language , but if you can make this algorithm and implement it programmitically in ANY OTHER LANGUAGE feel free to post your solution with the language you know well and like

C-one of my principles is to always try and I tried many times in making this and I would never post this but I have really a limited time and something like dead line

I really Really Need help asap

Thank you very much
AnswerRe: Preventing DOM based XSS Script PROBLEM -with details- Pin
Keld Ølykke23-Sep-13 19:59
Keld Ølykke23-Sep-13 19:59 
Questioncheck box in repeater Pin
ravitejsrivastava20-Sep-13 6:32
ravitejsrivastava20-Sep-13 6:32 
AnswerRe: check box in repeater Pin
NotPolitcallyCorrect20-Sep-13 7:36
NotPolitcallyCorrect20-Sep-13 7:36 
QuestionLooking for help in querying web page values with C sharp Pin
turbosupramk320-Sep-13 5:28
turbosupramk320-Sep-13 5:28 
AnswerRe: Looking for help in querying web page values with C sharp Pin
turbosupramk323-Sep-13 2:55
turbosupramk323-Sep-13 2:55 
QuestionDetect a particular color in particular location from image in c# Pin
Member 402509119-Sep-13 22:20
Member 402509119-Sep-13 22:20 
AnswerRe: Detect a particular color in particular location from image in c# Pin
Richard MacCutchan20-Sep-13 1:54
mveRichard MacCutchan20-Sep-13 1:54 
AnswerRe: Detect a particular color in particular location from image in c# Pin
Abhinav S20-Sep-13 3:16
Abhinav S20-Sep-13 3:16 
AnswerRe: Detect a particular color in particular location from image in c# Pin
BillWoodruff20-Sep-13 7:46
professionalBillWoodruff20-Sep-13 7:46 
GeneralRe: Detect a particular color in particular location from image in c# Pin
shehrozeee22-Sep-13 0:17
shehrozeee22-Sep-13 0:17 
GeneralRe: Detect a particular color in particular location from image in c# Pin
Dave Kreskowiak22-Sep-13 3:34
mveDave Kreskowiak22-Sep-13 3:34 
Questionhow to use thread in for loop in c# Pin
superselector19-Sep-13 20:00
superselector19-Sep-13 20:00 
AnswerRe: how to use thread in for loop in c# Pin
Mycroft Holmes19-Sep-13 21:06
professionalMycroft Holmes19-Sep-13 21:06 
GeneralRe: how to use thread in for loop in c# Pin
superselector19-Sep-13 21:50
superselector19-Sep-13 21:50 
GeneralRe: how to use thread in for loop in c# Pin
GuyThiebaut19-Sep-13 22:20
professionalGuyThiebaut19-Sep-13 22:20 
GeneralRe: how to use thread in for loop in c# Pin
superselector19-Sep-13 23:08
superselector19-Sep-13 23:08 
GeneralRe: how to use thread in for loop in c# Pin
GuyThiebaut19-Sep-13 23:13
professionalGuyThiebaut19-Sep-13 23:13 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.