0

I know a little about security risks and know that Javascript could be dangerous and compromise my computer, everything was just fine but suddenly reading one article of OWASP that says XSS (cross-site scripting) is the most frecuent type of attack I try to search on internet how could I know what is javascript exactly doing, actually I run firefox with javascript deactivated by default, and just allow pages that I trust, this is the default on BackTrack5 R2, but I'd like to know if it's possible to know or view what is going on

4
  • JS is client-side, you can check the code and see what it does.
    – Karan
    Oct 17, 2012 at 0:17
  • everything? @karan
    – poz2k4444
    Oct 17, 2012 at 0:18
  • Well, there is some server-side JS as well using node.js or similar, so probably not everything. But client-side JS should be visible to you as it's executed by your browser.
    – Karan
    Oct 17, 2012 at 0:23
  • what about xss when is in their hexadecimal form? @karan
    – poz2k4444
    Oct 17, 2012 at 0:44

2 Answers 2

1

Firebug is your friend. It allows you to see all of the calls that are being made, how long they take, and other great information.

2
  • nice, so this extension will tell me the final result of the code?
    – poz2k4444
    Oct 17, 2012 at 1:08
  • A debugging feature is provided so you can set breakpoints and view the values of variables during processing. Oct 17, 2012 at 12:46
1

It is worth pointing out that Javascript runs in a sandboxed environment. This means that XSS could allow in the worst case a malicious site to execute Javascript in the context of a different (vulnerable) site and execute actions as if it were the vulnerable site.

So for example, if you visit www.youtube.com who has adverts from www.evil_side_adverts.com and it sends you to an XSS in www.google.com, then www.evil_side_adverts.com can execute javascript within www.google.com's page on your machine and can interact with www.google.com as if it were you.

That means it can steal your cookies, make requests on your behalf (but not login) and generally misbehave. When the browser or webpage closes, the XSS ends and no more badness happens on your machine.

The key feature here is that even if you are attacked via an XSS in a site that you use, the attacker doesn't get to run malware on your system, and doesn't get to look at the documents on your machine or install malicious programs on your desktop.

It's also worth pointing out that a number of more modern browsers have mitigations in place to reduce the effect of some types of XSS vulnerability. Make sure that you are using at least IE9 or a recent version of Firefox, Chrome or Opera to make sure that you are fully protected.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .