WebFu Dojo – XSS self defence

Thursday, 8 November 2007

Kung Fu master

Welcome my young apprentice so you want to learn how to defend yourself from the onslaught of XSS ninjas do you? Well in my first Dojo lesson I shall show you techniques of the shaolin crane style to defend yourself from the XSS punch.

XSS roundhouse

Use the roundhouse wisely my young master and always proceed with caution. When a XSS ninja attacks you with the XSS punch:-

"><script>alert(/XSS PUNCH/)</script>

You should respond quickly with the XSS roundhouse:-

<script>
if (top == self) {
 setInterval('alert(/XSS ROUNDHOUSE/)',500)
} else {
 top.location.href = 'http://www.yourdojohere';
}
</script>

I hope you enjoyed this lesson and if you require more tutoring consult the Grandmaster snake, Master null byte, The shaolin warriors or Pai Mei DaCat

The entry 'WebFu Dojo – XSS self defence' was posted on November 8th, 2007 at 4:12 pm and last modified on August 27th, 2009 at 3:16 pm, and is filed under javascript, Security, xss. You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.

14 Responses to “WebFu Dojo – XSS self defence”

  1. Ronald writes:
    No. 1 — November 8th, 2007 at 6:17 pm

    haha! excellent! 😀

    Got some WebFu also in store soon!

  2. Gareth Heyes writes:
    No. 2 — November 8th, 2007 at 7:33 pm

    Ah excellent master null byte, I look forward to learning the style of the dragon 🙂 hehhe

  3. Marco Ramilli writes:
    No. 3 — November 8th, 2007 at 8:09 pm

    HeHeHe, Funny really Funny stuff !

  4. .mario writes:
    No. 4 — November 8th, 2007 at 8:51 pm

    *Shaolin warrior bows in awe*

    N1! 🙂

  5. Pai Mei DaCat writes:
    No. 5 — November 9th, 2007 at 12:53 am

    Hehe this r0x 😛

    lately I’m seeing a lot of code that would be very cool implemented in a PHP-IPS.. it’s possible, but hard.. 😛

  6. sirdarckcat writes:
    No. 6 — November 9th, 2007 at 4:55 am

    Hehe this r0x 😛

    lately I’m seeing a lot of code that would be very cool implemented in a PHP-IPS.. it’s possible, but hard.. 😛

  7. Gareth Heyes writes:
    No. 7 — November 9th, 2007 at 11:56 am

    @Shaolin warrior mario

    I’m honoured with your presence *bow*, your IDS tiger style is legendary.

    @Pai Mei DaCat

    Likewise I’m honoured *bow* your obscufication whirlwind kick is impressive.

  8. Gareth Heyes writes:
    No. 8 — November 9th, 2007 at 11:58 am

    On a serious note….

    I’ve been thinking of implementing a WebFu self defence kit for a bit of fun, it would include the PHPIDS to detect the attacks. What do you think? Want to help? 🙂

  9. Iehrepus writes:
    No. 9 — November 9th, 2007 at 3:53 pm

    haha,I find a fun:

    http://translate.google.com/translate?u=http%3A%2F%2Fwww.thespanner.co.uk%2F2007%2F11%2F08%2Fwebfu-dojo-xss-self-defence%2F&langpair=en%7Czh-CN&hl=en&ie=UTF-8

    this is the code :
    <html>
    <body>
    hi
    <script type=”text/javascript”>
    if (top != self) {
    top.location.href = ‘http://superhei.blogbus.com/’;
    }
    </script>
    </body>
    </html>

  10. Iehrepus writes:
    No. 10 — November 9th, 2007 at 3:54 pm

    test by Ie7 🙂

  11. Gareth Heyes writes:
    No. 11 — November 9th, 2007 at 4:01 pm

    @Iehrepus

    I’m not sure what you’re pointing out here, yes my blog does have frame protection. If you want to translate then please disable javascript when translating.

    Thanks for testing in IE7 😉

  12. DaCat writes:
    No. 12 — November 10th, 2007 at 12:13 am

    Gareth.

    Oh the WebFu lessons are going to be against the all mighty powerfull PHP-IDS, .mario and christ1an? maybe also ma1?

    well, this will be interesting..

  13. .mario writes:
    No. 13 — November 10th, 2007 at 1:02 pm

    “I’ve been thinking of implementing a WebFu self defence kit for a bit of fun”

    Yep – the calls for a PHPIPS start to get louder and louder. Let’s IM about that as soon as you have some time. There are already many ideas drawn together.

  14. Gareth Heyes writes:
    No. 14 — November 10th, 2007 at 1:14 pm

    Yep I’ll look forward to it 🙂

«
»