Purpose Demonstrate how XSS (cross-site scripting) is possible in order to allow javascript located at one website to be loaded and used within another website. One of the advantages of this approach is to allow multiple websites to use the same code (in a single location) instead of each website containing their own copy of the javascript code - which also removes the problem of version control. Overview You can digitally sign several different types of files to identify those files as being "trusted"; that is, the file(s) that have been digitally signed was done so by an entity (such as a company) that can be identified by a certificate authority such as Verisign or Thawte. This is done through the use of an SSL certificate that is issued to the entity from SSL providers such as Verisign and Thawte. If you do not have server administrator access to the web server the SSL certificate is installed on and where the javascript file(s) will be located at, you will not be able to digitally sign files. In order to have XSS enabled in a web browser (such as Firefox or Internet Explorer) you need to attach a digital signature to the javascript files (site A) that are going to be used by another website (site B). The other website (site B) does not need to do anything special other than link to the javascript file(s) in a manner such as: Site B Importing Javascript From Site A:
... Once linked (and the sample.js file is digitally signed), Site A can freely access any javascript functions and variables that may be present in the sample.js file. As well, the sample.js file at Site B can freely access any javascript functions, variables and page data that may be present in the calling webpage at Site A. With this level of trust, accessing a javascript function, for instance, is done in the same way as if the javascript function was actually part of the site. That is, Site A can call a function in sample.js which is at Site B by doing nothing more than calling the function such as alert(somefunction()). This also means that you can pass data from Site A to a function or variable in sample.js of Site B and visa-versa. Digitally Signing a Javascript File On Site A:
This part is a little time-consuming and I've actually broken it down into a step-by-step process if you have a Windows 2003 web server, with an SSL certificate for a specific website issued by a valid certificate authority that a web browser will recognize. I also include information on the same process for Apache/Linux (may be incomplete as I did not have the box with an SSL certificate to analyze).
STEP 1
Download the Windows 2008/.Net 3.5 SDK (approximately 15Gb) and install following the instructions
http://www.microsoft.com/downloads/details.aspx?FamilyId=E6E1C3DF-A74F-4207-8586-711EBE331CDC&displaylang=en
STEP 2
Go to Start -> Run -> Enter "cmd" and press enter.
Navigate to C:\Program Files\Microsoft SDKs\Windows\v6.1\Bin
STEP 3
At the command prompt type in "signtool signwizard" without the quotes and press enter.
STEP 4
Under the File Selection window, browse to the javascript (.js) file (which is on the same web server as well as the cert)
STEP 5

(Enlarge)
Change filetype to "All Files" so you can select the javascript file.
STEP 6

(Enlarge)
Select "Custom" under the signing options window.
STEP 7

(Enlarge)


(Enlarge)
Click the "Select From File" button
STEP 7.1
If this is the first time you've used the .cer file then you may need to perform the following 7.x series of steps.
Open the MMC.
STEP 7.2
Select File and add/remove snap-in.
STEP 7.3
Add the "Certificates" snap-in and select "Computer Account" when prompted.
STEP 7.4
Select "Local Computer" at the "Select Computer" pane.
STEP 7.5
Click "Close" on the "Add Standalone" snap-in pane.
STEP 7.6
Click "OK" on the "Add Standalone" snap-in pane.
STEP 7.7
Under the console root, expand the certificates of the local computer.
STEP 7.8
Expand "Personal".
STEP 7.9
Under "Certificates" right-click the desired cert being used to sign the file.
STEP 7.10

(Enlarge)


(Enlarge)


(Enlarge)
Select "All Tasks" and then "Export".
STEP 7.11
Verify your settigns and click "Finish".
STEP 8

(Enlarge)
Select .cer for the filetype.
STEP 9
Select the .cer file that you exported in Step 7.
STEP 10

(Enlarge)
Verify the certificate you selected.
STEP 11

(Enlarge)
Select "Private Key in CSP" and the correct key container. You will not be able to select "Next" until you select the proper key container.
STEP 12

(Enlarge)
Select "Sha1" for the hash.
STEP 13

(Enlarge)
Under the "Additional Certificates" pane make sure both "Only the signature certificate" and "No additional certificates" are selected.
STEP 14
Select the "Add a timestamp to the date" checkbox and enter the following text:
http://timestamp.verisign.com/scripts/timstamp.dll
STEP 15

(Enlarge)
Verify your settings and click "Finish".
STEP 16

(Enlarge)
Open the javascript file with Notepad.
At the end of the javascript code you should see that the digital signature was appended to it.
The javascript file can be edited (such as adding javascript functions) and it will continue to operate without needing another digital signature being created for it as long as you do not alter the digital signature that was originally appended to it.
Finally, you can add the digital signature (via copy-n-paste) to the end of other javascript files of the same website; this means you do not need to manually create a digital signature for each javascript file.


Another helpful application (which will cut down on the number of steps that you may need to perform) is known as Crypto4 PKI; used mainly to select .cer for the public key export and .pvk for the private key export...this means you may not need to download the Windows 2008/.Net 3.5 SDK (approximately 15Gb) and install it on the Windows web server.