Cross-Site Scripting Tops CWE's Most Dangerous List

silversurfer

Level 85
Thread author
Verified
Honorary Member
Top Poster
Content Creator
Malware Hunter
Well-known
Aug 17, 2014
10,176
Cross-site scripting has topped the 2020 list of the 25 Most Dangerous Software Weaknesses compiled by the Common Weakness Enumeration (CWE).

The vulnerability, described by the CWE as "improper neutralization of input during web page generation," was given a threat score of 46.82.

Describing the dangers posed by cross-site scripting (XSS), CWE wrote: "The attacker could transfer private information, such as cookies that may include session information, from the victim's machine to the attacker. The attacker could send malicious requests to a web site on behalf of the victim, which could be especially dangerous to the site if the victim has administrator privileges to manage that site.

"Phishing attacks could be used to emulate trusted web sites and trick the victim into entering a password, allowing the attacker to compromise the victim's account on that web site. Finally, the script could exploit a vulnerability in the web browser itself possibly taking over the victim's machine, sometimes referred to as 'drive-by hacking.'"
 

Gandalf_The_Grey

Level 76
Verified
Honorary Member
Top Poster
Content Creator
Well-known
Apr 24, 2016
6,600
How probable is it to get hacked via a XSS attack? Is there any way to get protected? NoScript comes to mind first but I don't like that extension.
The Netcraft extension provides protection against cross site scripting (XSS):
The Netcraft Extension is a tool allowing easy lookup of information relating to the sites you visit and providing protection from phishing and malicious JavaScript, including Coronavirus-related cybercrime.

What's new in v1.16.0?
• Added credential leak detection, for additional protection against skimming attacks
• Updated the block screen design
• Minor bugfixes
• The extension now provides analytics information to Netcraft when an attempt to visit a URL is blocked. More information can be found in our updated privacy policy: Privacy Statement | Netcraft

Key Features:

• Protection against phishing sites — The Netcraft anti-phishing community is effectively a giant neighbourhood watch scheme, empowering the most alert and most expert members to defend everyone within the community. As soon as the first recipients of a phishing mail report it, we can block it for all users of the extension providing an additional level of protection from Phishing. Netcraft processes reports of fraudulent URLs from a diverse variety of sources and proactively searches for new fraudulent sites.

• Protection against malicious JavaScript — Prevent your credit card details from being stolen by shopping site skimmers or your computer's processing power being harvested by web miners. Netcraft has been detecting shopping site skimmers, web miners, and other malicious JavaScript since 2017. The extension blocks sites that we have found to be compromised with malicious JavaScript. Additionally, it detects JavaScript that we have identified as being malicious, blocks pages that use it from loading, and automatically reports them to Netcraft to protect the rest of the community.

• Credential leak detection – Even if you come across a shopping site skimmer that Netcraft has not yet detected, the extension can still work to protect your card details. Credential leak detection inspects outgoing requests on the fly, blocking them if they carry your sensitive data to potentially malicious external domains. The compromised site is then blocked and reported to Netcraft.

• Detailed site reports – simply click the Netcraft logo to access a wealth of information about the sites you visit, helping you to make informed choices about their safety.

• Risk Ratings – we evaluate the characteristics of the site and compare these against those depicted by fraudulent sites. The result is a simple visual summary displayed on the site report.

• Conveniently report suspected phishing & fraudulent sites – At the click of the button you can report suspected web forgeries to Netcraft, helping to protect the community. Netcraft operates an incentive scheme for Phishing site submissions, including iPads, backpacks, mugs, and more… Netcraft Report

• PFS indicator – check if sites using SSL for encryption support Perfect Forward Secrecy (PFS). PFS ensures that if the private key of the site is compromised – for example by a court order, social engineering, an attack against the site, or cryptanalysis – your historical encrypted traffic is still safe.

• Heartbleed indicator – check if sites are still using an SSL certificate that was potentially compromised by Heartbleed. The extension uses data from Netcraft's SSL Survey to determine whether a site offered the heartbeat TLS Extension prior to the Heartbleed disclosure. If this is the case, the extension will also check to see if the site's SSL certificate has been replaced; if it has not, then the site is considered to be unsafe, as the certificate's private key could have been compromised.

• Protection against cross site scripting (XSS) — The extension optionally traps XSS and other suspicious URLs which contain characters highly likely to deceive.

Find out more about the Extension, including detailed tutorials, FAQs, phishing statistics, and how to protect yourself from online fraud at: Netcraft Protection | Netcraft
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top