Cross-Site Scripting Continued

XSS Sandbox

The sandbox can be found [HERE](../../Applications/Week-02/02-CrossSiteScriptingSandbox)

[Mozilla Web Event Reference](https://developer.mozilla.org/en-US/docs/Web/Events)

The Notorious Eval

Notes to come...

Quick Discussion on Scope

Understanding scope in JavaScript in an important a part of being an effective web developer, and it also has influence on the security of our web applications.

Look at the two examples below and try to guess what their output will be. Hint: we expect two outputs per example.

Scope in JavaScript is defined by functions. Any functions or variables created in the global scope will be attached to the `document` object. Therefore they will be directly accessible by any code (or users!) running in the browser.

Try it: copy the above example into your Chrome console then try running the following two commands:

corey();

shuman();

Notice how the `corey()` function is in the global scope, but `shuman()` is scoped within the `corey()` function and is not directly accessible.

Dissecting a Malicious Site

Iotaseed was a website that generated seeds used by Cryptocurrency wallets. Even though they shared their code on github, they managed to sneak some malicious code into their site and track users's seeds. They stole over $4 million from user's wallets.

We will use [this article](https://thatoddmailbox.github.io/2018/01/28/iotaseed.html) to discover exactly how their malicious code worked.

[Photo Forensics](https://29a.ch/photo-forensics/#pca)

Keylogging

Let's use the following [Keylogger](https://wiremask.eu/articles/xss-keylogger-turorial/) tutorial to build a keylogger and inject it into our sandbox.

Our keylogging code: