what is XSS and how can they affect a board with HTML turned on?

[Gutspiller]

Are they certain HTML commands?

[filburt1]

XSS is cross-side scripting. In a nutshell it allows people to inject malicious Javascript that captures the user's cookies (which remember, one of them is the user's hashed password) and redirect them to their own side so they can be brute force attacked and eventually reverted back to the original password.

[okrogius]

Additionally to that with some javascript can have arbitrary commands executed when an admin views a page with the malicious code.

i.e. iframe with src pointing to /admin/....?....&username="+getCookie('bbusername')+"

[filburt1]

I'm not sure if iframes inherit the cookies.

[Erwin]

There is no way of enabling HTML and keeping your site secure.

In any case, there is a thread on vB.com about turning on HTML and keeping it as safe as possible.

[Gutspiller]

Is there a way to block Xss scripts without upgrading? Is the only other way to turn off html? If there is a certain command to run xss scripts, can't you just add that command to your censor list?

I have "<iframe" added to my censor list and nobody can run an iframe, yet they can still run html. Something like this possible?

[filburt1]

Never, ever enable HTML anywhere on your board. There is no 100% secure way of enabling it and still letting users post in it.

[Gutspiller]

Today at 05:51 PM filburt1 said this in Post #6
Never, ever disable HTML anywhere on your board. There is no 100% secure way of enabling it and still letting users post in it.

You mean never ever enable it.

Maybe I could get some help. how creating a secure way to run it.

[Logician]

Today at 01:53 AM Gutspiller said this in Post #8
You mean never ever enable it.

Maybe I could get some help. how creating a secure way to run it.

Why do you need HTML? What feature does it add to your board that you can not have with bbcode?

You can really create a new bbcode for many HTML commands you need in your site and then disable the HTML altogether.

Or another alternative may be enabling it for certain (trusted) usergroups only and disabling for the rest (Check Hack releases forum for this hack).

As filbert stated do not enable it for all if you don't want a site that has serious security gaps.

[okrogius]

Yesterday at 06:53 PM Gutspiller said this in Post #8
You mean never ever enable it.

Maybe I could get some help. how creating a secure way to run it.

bbcode is your secure way of running it.