Information Security Project (for College) demonstrating the 3 types of Cross Site Scripting vulnerabilities (Stored, Reflected, DOM)

Mentor: Professor Jatin Sethi - [email protected]

Team:

Shubhrika Maurya - Research & Documentation - [email protected]

Mridhul Bhambri - UI/UX Development - [email protected]

Vatsal Jain - Implementation of Reflected XSS & Documentation - [email protected]

Raghav Dua - Implementation of Back-end API & Stored XSS - [email protected]

Technologies:

JavaScript - Core & JQuery on Front End, Node.js & Express.js on Back End

EJS (Embedded JavaScript) templating engine

HTML, Bootstrap

Database: MongoDB

Why is the site vulnerable?

The vulnerability originates from the way we have used EJS. For displaying submitting comments, we use <%- ... %> tags in EJS. Thus, Node simply does a text substitution. So any HTML tags are interpreted as HTML instead of plain text.

The vulnerability can be fixed if we replace those tags with:

<%= ... %> (NOTICE THE '-' HYPHENE IS REPLACED BY '=' EQUAL TO)

This encodes the HTML tags, i.e., <script> becomes &lt;script&gt;

Update: Ours was declared the best Information Security Project amongst all presented by renowned Cyber Security Expert Rakshit Tandon during the inaugural ceremony of ISSA, Dehradun.

https://twitter.com/ChandraDevershi/status/733916026828521472