5 ms·
Ask HN: Testing your site for XSS exploits
What tools or techniques do you use to test for and secure your site from XSS exploits?
- yan 17y agoI would pay someone like me to assess your code and pentest your site :) If you're planning on doing this yourself, OWASP (www.owasp.org) is a great resource.
- tonystubblebine 17y agoFor people using Rails, sanitize all input before it goes in. Here's a library for web params. http://code.google.com/p/sanitizeparams/ http://code.google.com/p/sanitizeparams/
- there 17y agoso when some new technique comes out down the road that your input filtering didn't catch, are you going to update everything in your database? and what about data that gets in from other sources? i don't see the benefit in filtering input; html and alert()'s inside a database don't affect anything until they come back out.
- mbrubeck 17y agoAlso, proper sanitization is different for HTML, JavaScript, SQL, URIs, and other contexts.
- tonystubblebine 17y agoThe question is specifically about XSS, so the context is by definition HTML and Javascript.
- tonystubblebine 17y agoThe benefit to filtering input is that it is less error prone for programmers. The filter on output method that most Rails programmers use involves setting it up on an output-by-output method. I like the input technique because it only needs to be configured once. I think the risk of new techniques getting by this filter are low (although the risk of the filter having bugs is high, as judged by the number of bugs that popup in more critical software). In XSS there are only a limited set of attack vectors (iframe, javascript, flash), and those get filtered completely. The underlying filter is based on whitelisting, so it's not like new additions to the HTML spec are going to open security holes before we have a chance to close them (it's the opposite, new, safe HTML additions will need to be explicitly allowed before they can be used).
- planck 17y agoAssume all data entered by users is malicious and encode it properly on display. That's really all there is to it.
- pwmanagerdied 17y agoAmen to that. Everyone overcomplicated the issue, it's not a difficult issue to solve: whenever untrusted data is to be displayed to a user, escape it. Problem solved.
- lhorie 17y agoTools like Paros http://www.parosproxy.org/index.shtml http://www.parosproxy.org/index.shtml will spider/scan for some common attack patterns. It's also definitely nice to have a dedicated qa person (preferably someone familiar with the code) trying to break your site, both manually and with tools like Selenium http://seleniumhq.org/ http://seleniumhq.org/