Cross-Site Scripting: A 25-Year Threat That Is Still Going Strong

Рет қаралды 37,974

IBM Technology

Күн бұрын

Пікірлер: 46

@kalideb-y3y Ай бұрын

I love how he just used "validate" instead of "sanitize" which is not overwhelming to hear 🥰

@rida_brahim Ай бұрын

this is something someone new to programming would fall for, i can see also self taught developers in their early days falling for this. as someone who learned programming this year i see myself doing some mistakes when i want to build something fast, which is the case for any freelancer who wants to deliver the project and doesn't have much experience. thanks for the video.

@jeffcrume Ай бұрын

It’s requires extra effort to guard against this and usually we just want to focus on getting the functions to work so the problem persists even among veteran programmers

@rida_brahim Ай бұрын

@jeffcrume indeed, thank you!

@J_G_Network Ай бұрын

Thank you for sharing, I am studying this material in my ethical hacking class, and your explanation clarified some things for me about XSS. It makes more sense. I would like to work for IBM sometime.

@yogeshbavishi64325 Ай бұрын

thank you. nice and simple explanation

@jeffcrume 19 күн бұрын

Glad you liked it!

@cybi8056 Ай бұрын

Thank you for adding English subtitles to make it easier for the AI to translate into Korean.

@jeffcrume Ай бұрын

I hope I still make sense in Korean 😊

@ah89971 Ай бұрын

Good luck in coding script with Korean

@fahad90909 16 күн бұрын

How could a code typed in a website comments section execute an attach. Can a code run in the comments section?

@jeffcrume 16 күн бұрын

It doesn’t run in the web site. It runs in the user’s browser under the security context of that web site

@Archibong.samuel Ай бұрын

Damn I was late for class I'm interested in understanding how the industry is working to genuinely solve XSS (Cross-Site Scripting) attacks. Since trusted websites can sometimes be manipulated to execute an XSS attack, it raises an important question: How can end users know if a 'trusted service' has been compromised? While I understand that there are browser extensions aimed at detecting OWASP Top 10 vulnerabilities, I'm curious how effective they are in practice. Additionally, as a software engineer, I'm aware that methods like command injection can also exploit systems, and that attackers could theoretically use the browser API to bypass certain defenses. How does the industry address these challenges, and what are the best approaches for ensuring users' security when using trusted websites?

@jeffcrume Ай бұрын

This is mostly a problem for the web site owners to solve. If it were easy to do, it would have been done years ago. Unfortunately, it persists

@seansingh4421 Ай бұрын

Browser isolation

@Archibong.samuel Ай бұрын

@@jeffcrume This is interesting. Thank you.

@Archibong.samuel Ай бұрын

@@seansingh4421 Please explain

@mikemaldanado6015 Ай бұрын

ok but how is that malicious code persisting on the server? shouldn't only apply for the hackers session? ie how has he modified the coder on the server to now include his code as part of the servers. your example would only happen once, to the attacker. this only makes sense if the xss is doing an sql injection into the server which will then serve it up for all future users

@jeffcrume Ай бұрын

In the example I cited, the code is injected into the comment section. It will persist until the comment is deleted

@CrypticNord Ай бұрын

You are awesome sir.

@jeffcrume Ай бұрын

You are very kind!

@CrypticNord Ай бұрын

@@jeffcrume Followed you on LinkedIn. I am a current cyber operations and resilience student at Boise State University. Your videos are extremely useful for understanding these topics. Thanks.

@Myexpectationsarerealistic Ай бұрын

These exist because of the hard drive cartels not releasing certain technology to the public, which kept storage prices high. It was cheaper to have multiple servers, which used XSS to connect them as a single website.

@krishnaSagar69 Ай бұрын

I still remember the first time I read about this. It was a masterpiece. Absolutely genius!

@jeffcrume Ай бұрын

I do too. I thought it was so convoluted that it would just go away. I was clearly wrong

@AlexWindsor Ай бұрын

How is he able to write mirrored letters so quickly?

@fiaztv3206 Ай бұрын

I think he writes normally.. it is mirrored for us in software

@amritbhattarai5083 Ай бұрын

The video is flipped in the horizontal axis. You can see his watch appears to be in his right hand but pretty sure he wore it on his left. Gives way for very intuitive explanation videos :)

@FredBlogs-j7j 11 күн бұрын

I suspect that it is quite easy to get used to. I work in a primary school and often have to tutor small groups. Facing across a table, I often have to write "upside down" so that it appears to the pupils as the right way up and it has become second nature.

@KevinStefferDk Ай бұрын

Great topic but the explanation is lacking of details. Show some examples of how to place malicious code in a comment on a forum with a guided instruction on how to construct malicious code that makes stuff execute with an intension of an attack when bringing up this topic. It would make difference for developers and why it is important to protect against this type of vulnerability.

@johndawson6057 Ай бұрын

Great expalanation. Any recommendations for someone interested in getting into cybersecurity?

@dofilamingo8848 Ай бұрын

great video like always

@jeffcrume Ай бұрын

Thanks for saying so!

@thefourthbrotherkaramazov245 Ай бұрын

You don't necessarily need to make the user interact with the XSS attack payload right? Can't it just run through the web browser loading the page?

@jeffcrume Ай бұрын

If by “client” you mean the user, then yes.

@thefourthbrotherkaramazov245 Ай бұрын

@jeffcrume Yes thank you, changed it to say user instead.

@cheveznyc Ай бұрын

Ty u.

@markjakker2091 Ай бұрын

He’s been hijacking Amazon employees. He’s hijacking techs to edit and inject exploit code on EC2 and light sail

@sdwone Ай бұрын

So the Bottomline... NEVER... EVER... TRUST USER INPUT!!! As a web developer, your DEFAULT position should be... ALL USERS ARE EVIL!!! Stick to that... Along with copious amounts of paranoia!!! 😂 And the websites and apps that you build... Should be fine! 😊

@jeffcrume Ай бұрын

Good point 😊

@chillyvanilly6352 Ай бұрын

that is in all honesty a terrible video...bcs it doesn't actually talk about ANYTHING really, feels like `let semantics = null` if u catch my drift... It doesn't even mention the 2 flavours of this attack, nor does it say what is it exactly that happens, that would result in a random user getting back trusted with mixed-in malicious code... This is akin to the annoying uprising of "the coding bootcamp" crap that "anybody can program" which is actually rather damaging to the industry as a whole, destroys the possibility to work with amazing engineers (ideally passionate about the topic not "just as a job") and ofc unnecessarily lowering payments for those that have actually have skills and passion for the craft... #analogy Instead of watching this, just read the OWASP wesbite on it and associated links...

@Zbezt Ай бұрын

It delves into cyberwarfare use your head

@chillyvanilly6352 Ай бұрын

@@Zbezt what exactly is it in that vid that is actually "delving" into? Except nothing... don't be rude just cuz meaningless vids satisfy your tiny brain...