Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I know a little about security risks and know that Javascript could be dangerous and compromise my computer, everything was just fine but suddenly reading one article of OWASP that says XSS (cross-site scripting) is the most frecuent type of attack I try to search on internet how could I know what is javascript exactly doing, actually I run firefox with javascript deactivated by default, and just allow pages that I trust, this is the default on BackTrack5 R2, but I'd like to know if it's possible to know or view what is going on

share|improve this question
    
JS is client-side, you can check the code and see what it does. –  Karan Oct 17 '12 at 0:17
    
everything? @karan –  poz2k4444 Oct 17 '12 at 0:18
    
Well, there is some server-side JS as well using node.js or similar, so probably not everything. But client-side JS should be visible to you as it's executed by your browser. –  Karan Oct 17 '12 at 0:23
    
what about xss when is in their hexadecimal form? @karan –  poz2k4444 Oct 17 '12 at 0:44

2 Answers 2

up vote 1 down vote accepted

Firebug is your friend. It allows you to see all of the calls that are being made, how long they take, and other great information.

share|improve this answer
    
nice, so this extension will tell me the final result of the code? –  poz2k4444 Oct 17 '12 at 1:08
    
A debugging feature is provided so you can set breakpoints and view the values of variables during processing. –  KayakJim Oct 17 '12 at 12:46

It is worth pointing out that Javascript runs in a sandboxed environment. This means that XSS could allow in the worst case a malicious site to execute Javascript in the context of a different (vulnerable) site and execute actions as if it were the vulnerable site.

So for example, if you visit www.youtube.com who has adverts from www.evil_side_adverts.com and it sends you to an XSS in www.google.com, then www.evil_side_adverts.com can execute javascript within www.google.com's page on your machine and can interact with www.google.com as if it were you.

That means it can steal your cookies, make requests on your behalf (but not login) and generally misbehave. When the browser or webpage closes, the XSS ends and no more badness happens on your machine.

The key feature here is that even if you are attacked via an XSS in a site that you use, the attacker doesn't get to run malware on your system, and doesn't get to look at the documents on your machine or install malicious programs on your desktop.

It's also worth pointing out that a number of more modern browsers have mitigations in place to reduce the effect of some types of XSS vulnerability. Make sure that you are using at least IE9 or a recent version of Firefox, Chrome or Opera to make sure that you are fully protected.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.