Cross-site scripting (クロスサイトスクリプティング, XSS) is an attack that exploits a flaw in how a website handles input, so that an attacker's script runs in the browser of anyone who opens the page.
Text with a script is posted
Site shows it on the page as is
It runs in the viewer's browser
Login-state data goes to the attacker
The running script sends the attacker information such as the data that keeps the user logged in.
4 / 4
A script is a small program embedded in a web page and run by the browser. If a site writes text it receives, such as message-board posts, into its pages without sanitizing it (converting it into a form that cannot run as a script), a script hidden in that text runs on the viewer's screen. The script can then cause harm, for example by sending the attacker the cookie (a small piece of data a site has the browser store) that keeps the user logged in.
AnalogyIt is like slipping a gadget onto a shop's notice board that lifts the membership card from the pocket of whoever reads the notices. The gadget does its work not at the board but in the reader's hands.
How to rememberThe X in XSS is shorthand for "cross"; writing it this way keeps it from being confused with CSS, the style-sheet language.
Exam points
ExamCross-site scripting (クロスサイトスクリプティング) targets websites that output user input to their pages without sanitizing it, and makes a script run in the browser of whoever opens the page.
ExamOnce a script steals the cookie, the information that keeps the user logged in is in the attacker's hands, which leads to impersonation (成りすまし) on web services or account takeover.
ExamWeb pages are not the only place a script can be embedded. HTML-format email (HTML 形式の電子メール) can carry one too, so a malicious script may run when the message is displayed.
Cross-site request forgery (クロスサイトリクエストフォージェリ, CSRF) is an attack that lures a user who is still logged in to a legitimate site onto a trap page, making the user's browser send that site a request (asking the server to carry out some processing) the user never intended.
Logged in to the real site
Opens a trap page
Browser sends the real site a request
Server treats it as the user's action
The legitimate site's server cannot tell it apart from a request the user really made, and processes it.
4 / 4
A trap page contains a mechanism that, as soon as the page opens, sends the legitimate site a request to post something or change a setting. Because the request arrives from the logged-in user's browser, the site's server cannot distinguish it from the user's own action and carries it out. One countermeasure is for the site to check a secret value (a token) that shows whether the request came from its own genuine page.
AnalogyIt is like someone slipping a fake application form into the stack of papers a person's messenger is carrying. The messenger hands the whole stack in at the counter, and because it came from that person's own messenger, the counter accepts the fake as a genuine request.
How to remember"Forgery" here refers to a forged request to the server.
Exam points
Mix-upIn CSRF the unauthorized processing is carried out by the legitimate site's server, whereas XSS runs the attacker's script in the user's browser: they differ in where the wrongdoing happens.
Cross-Site Scripting (XSS) vs. Cross-Site Request Forgery (CSRF)
Clickjacking (クリックジャッキング) is an attack that lays another site's page, made transparent, over a trap page so that the user clicks a button they never meant to press.
Another site laid on top, invisible
User thinks they press the visible button
The hidden page's action runs
What actually gets pressed is a button on the invisible page on top, and that action is carried out.
3 / 3
The user sees only the trap page's buttons, but the button they actually press belongs to the invisible page on top. As a result, in a service the user is logged in to, settings get changed or who can see the user's content gets switched without the user knowing. One countermeasure is a setting that stops the site's own pages from being displayed inside other sites.
AnalogyIt is like standing a clear panel with its own switch in front of a sign's button, so that anyone reaching for the sign's button presses the panel's switch instead.
How to rememberThe "jacking" is the same "jack" as in hijack. What gets hijacked is the user's click.
Exam points
Mix-upClickjacking (クリックジャッキング) abuses the user's own click, while in CSRF the browser sends a request as soon as the page opens: they take over the user's actions in different ways.
A drive-by download (ドライブバイダウンロード) is an attack that infects a user with malware (malicious programs) without their knowledge, simply because they opened a web page.
Malicious code planted in a page
User opens the page
Flaw exploited, device infected
A flaw in the browser or similar software is exploited, and malware gets in without the user doing anything.
3 / 3
The attacker plants malicious code in advance, either on a legitimate site they have tampered with or on a trap site of their own. When the user opens the page, a vulnerability (a security weakness) in the browser or a plug-in (an add-on to the browser) is exploited, and infection happens even without actions such as opening a file. The main defense is to update the OS and browser so that their vulnerabilities are closed.
AnalogyIt is like walking past a house and having a parcel tossed over the wall at you, though you never went through the gate. The parcel arrives whether or not you did anything to accept it.
How to remember"Drive-by" means done while passing in a car. Just passing by, which here means merely viewing a page, is enough to be hit.
Exam points
ExamA drive-by download (ドライブバイダウンロード) uses a flaw in the browser or similar software to slip malware (マルウェア) in just because a page was displayed, and the user rarely notices the infection.
SQL injection (SQLインジェクション) is an attack that slips fragments of SQL (the command language for operating a database) into an input field of a web application so that the database runs commands the developers never expected.
SQL fragments typed into a field
Input joined straight into the command
Database runs an unexpected command
The database runs the command with its meaning rewritten, and data is read out or altered.
3 / 3
In a program that joins input strings directly into its commands, symbols and words mixed into the input change what the command means. The result can be leaked private member data, altered or deleted records, or a bypassed login check. The countermeasures are a mechanism that handles input separately from the command (placeholders) and validation of input values.
AnalogyIt is like phoning in an order, naming a product, then adding "and while you are at it, read out the safe combination", and the clerk does that too, just as it was written on the order slip.
How to remember"Injection" is the same word used for a shot given with a syringe.
Exam points
ExamSQL injection (SQLインジェクション) is not a trick that preys on people's carelessness or assumptions but a technical attack on a weakness in how a program handles input.
Mix-upIf what is slipped into the input field is a command for the database, the attack is SQL injection; if it is a script that runs in the viewer's browser, it is XSS.
Directory traversal (ディレクトリトラバーサル) is an attack that mixes path notation for going up a level into a requested file name in order to read files on the server that were never made public.
File name includes go-up steps
Climbs out of the public folder
Private files are read
The contents of files that should never be visible from outside, such as configuration files, are sent back.
3 / 3
A path is notation that shows where a file is by tracing the levels of folders (directories); for example, "../" means one level up. If a program returns contents using a user-supplied file name as is, repeating "../" lets the request escape the public folder. Countermeasures include validating requested file names so they cannot move between levels and tightening access rights to files that are not public.
AnalogyIt is like asking a reference desk not for "the third book on this shelf" but for "back out of this shelf to the corridor, then the first book in the closed stacks", and the clerk hands over the restricted material without checking.
How to remember"Traversal" comes from "traverse" (to travel across or through). Read as a phrase, "directory traversal" names the trick itself: travelling through the directory levels and out.
Exam points
Mix-upDirectory traversal (ディレクトリトラバーサル) goes after files on the server, while SQL injection (SQLインジェクション) makes the database run commands, so the two have different targets.
A buffer overflow attack (バッファオーバーフロー攻撃) sends a program more data than the memory area it reserved for input (the buffer) can hold, making the program behave in unexpected ways.
← Scroll the figure sideways →
In a program that does not check input length, data spilling out of the area overwrites the neighboring memory. This can make the program crash or run commands the attacker sent in. Besides checking input length, the countermeasure is to apply fixes for the flaw (patches) to the software.
AnalogyIt is like pouring rice into a fixed-size measuring box until it spills into the box next to it and mixes with what is already there.
How to remember"Overflow" means to spill over. "Buffer" originally means a cushion or a place to hold things for a while.
Exam points
ExamA buffer overflow attack (バッファオーバーフロー攻撃) feeds a program data larger than the area reserved for its input, causing the program to behave in unexpected ways.
ExamThe cause is a flaw in how the software is built (a vulnerability, 脆弱性), so applying a fix for that flaw (a patch, パッチ) is an effective countermeasure.
Mix-upA buffer overflow attack is caused by a single input that is too long. It is a different thing from a DoS attack (DoS 攻撃), which floods a server with requests until it can no longer respond.
Cross-Site Scripting (XSS) vs. Buffer Overflow Attack
Aspect
Cross-Site Scripting (XSS)
Buffer Overflow Attack
What is sent in
Text with a script mixed in
Data longer than the reserved area
Key differenceWeakness exploited
Outputting input without sanitizing it
Not checking input length
Where the damage occurs
The viewer's browser
The attacked program itself
Key points
Most attacks in this unit target programs that use input received from users without checking it. Sanitizing and validating input is the common basic countermeasure.
Some attacks start doing harm the moment a page is displayed, so keeping the OS and browser up to date to close vulnerabilities is the defense on the user's side.
Some attacks, such as CSRF and clickjacking, exploit the fact that the user is still logged in and have processing the user never intended carried out as the user's own action.