Web Security demos

Demo webpages for Web Security

This directory contains toy examples of web pages to illustrate some features of the web -- or, more specifically, of HTTP, HTML and URLs. They are all bare-bones examples with just a few lines of HTML to keep things as simple as possible and make the fundamental concepts clear. For simplicity the web pages do not use CSS, which is the proper way to control the layput of webpages, but they rely on more basic HTML-tags for e.g. colouring.

Web pages that include JavaScript are also called web apps. Usually these make use of large JavaScript libraries (aka JavaScript frameworks) and interact with some server-side application, but the demo pages here only involve client-side functionality.

Demos for lecture 1:

demo_get_post.html is a page with GET and POST requests to inspect in the browser or using a proxy.
demo_javascript.html is a page with some simple JavaScript that uses the DOM API.
demo_DOM.html is a JavaScript demo that shows some more features of the DOM.

Demo for lecture 2:

mixed_content.html is a page which mixes HTTP and HTTPS content.

Demos for lecture 4:

test_SOP.html is a page with an iframe (an inline frame, essentially a webpage embedded inside another webpage) that tests the Same Origin Policy (SOP): it shows JavaScript from one origin cannot access content coming from another origin.

Demos for lecture 5:

demo_DOM2.html gives more examples of how JavaScript can use the DOM API, for instance to inspect the URL and insert parts of the URL inside a webpage.
XSS_via_DOM.html shows how a webpage can import parameters from the URL, and how that can be abused for a DOM-based XSS attack, where JavaScript is sneaked into a webpage via a poisoned parameter in the URL.

Demos for lecture 7:

Web pages with ClickJacking/UI redressing:
- clickjack_basic.html
- clickjack_some_button.html
  and a version where the inner redressed frame is made transparent:
  clickjack_some_button_transparent.html
- clickjack_some_button_transparent.html
Brightspace does not have any protection against reusing Brightspace webpages inside other pages:
the webpage UI_redressing_brightspace.html includes Brightspace inside another page without any problems.
framebusting1.html shows how the iframe framebuster.html it includes will bust the outer framebusting1.html and become the top webpage.
framebusting2.html shows how using sandboxing for the iframes can prevent such framebusting.