web security write-ups and rants. by paulos yibelo mesfin
“Clickjacking” is becoming less practical as modern browsers set all cookies to “SameSite: Lax” by default. Even if an attacker site can frame another website, the framed site would be unauthenticated, because cross-site cookies are not sent. This significantly reduces the risk of successful clickjacking attacks, as most interesting functionality on websites typically requires authentication.…
I've uncovered a technique that exposes a new class of client side web vulnerability. By leveraging two seemingly unrelated browser features, an attacker can trick an unsuspecting user into performing actions on a different website with minimal user interaction. While browsers implementing SameSite: Lax/Strict by default eradicates vulnerability classes like CSRF, antiCSRF tokens and SameSite…
CVE-2019-8761 is an interesting macOS bug I found that lets attackers execute HTML within a TXT file, leak files, and do all sorts of other funky things when a TXT file is opened. This research originated when I realized the default text reader on OSX, TextEdit is used to open files with TXT extension by default. On the interface of TextEdit, it looked like you can do basic customization to your…
TL,DR; not a while ago, a couple friends and I decided we wanted to explore the current security state of popular Network Attached Storage (NAS) devices. We decided to download a bunch of popular NAS firmwares and started looking into them. The first one we picked up was called Axentra . While dissecting the firmware, it became clear to us the target is extremely widespread. many popular NAS…
Today, we are the big bad wolf. We have malicious intents. As we should, right? It is commonly believed in our community we need to think like an attacker to effectively be security researchers; the kind of situation where to be one, you must be the other as well. Understanding what an application does and how it does it always gives you a broader attack surface. If you know how to abuse them…
TL,DR; After my last month's finding in Hotspot Shield, I decided to look at and audit more VPNs to see how many of the major VPN vendors are vulnerable to information leakage. Together with File Descriptor , we decided to look at 3 random major VPN clients to see what we can find. Our research was supported by the privacy advocate vpnmentor . We initially selected PureVPN, Hotspot Shield, and…
Lately, I’ve been interested in VPN clients. I was focusing my research on paid commercial VPN clients with 2M+ installs. o ne of the clients that stood out was Hotspot Shield, with similar builds on Android, Windows and Chrome. With each carrying over 3M+ installs worldwide. While analyzing this application, I noticed its riddled with bugs that allow sensitive information disclosure. In this blog…
The following post is inspired by an all charset unicode shazz by @insertscript . After I saw it being referred in a tweet by Gareth Heyes , I immediately started fuzzing for more characters Internet Explorer & MS Edge may interpret horribly, and confuse the anchor host parser to ultimately use and bypass Facebook's Linkshim . Fuzzing: <a href= ”/[$]example.com” id= ”fuzzmeiah” > fuzz </a>…
Few months back, I came across an oauth xss accompanied by a nice CSP bypass in Twitter. While creating an application, a developer can set their terms and service URL for their app, which Twitter configured to be: ([https?:])\w+ Unfortunately the regexp is missing a ^ char in the start making malicious URLs like data:CONTENT#https:// … work -- so we got HTML Injection, but almost useless for a…
A few weeks ago, I found a stored cross site scripting bug in Instagram that was tricky to craft a real exploit from. In Instagram Developers , you can create your own OAuth applications to be granted by the user and use the API. the vulnerable parameter is the "url" POST parameter, where you provide your site's address and the user could navigate to see the developer. The parameter was properly…
TL,DR; Its been a while last I published a post. so this is going to be a short post about an interesting-ish RCE found in all versions of eFront LMS - reported over 120 days ago but eFront cutting the open-source version as a response instead of a patch, I am forced to notify people of this vulnerability. I will update this post if a patch for this bug is out. In /efront/libraries/globals.php :…
This is going to a very short post about a redirect_uri bypass technique I found in Moves. Moves is a company owned by Facebook and one of the acquisitions in scope for the bug bounty program they are running. I have written about an XSS bug caused in this same parameter entitled " Moves OAuth XSS " and this will cover a not so common redirect_uri bypass method. Anyway, there are a lot of known…
Normal 0 false false false EN-US X-NONE X-NONE MicrosoftInternetExplorer4 I am writing this blog post because both the teams that handled this bug were quite amazing. (Vulnerable 3rd party and Offensive Security) They acknowledged, fixed and rewarded my report in <1hr of my submission. (both of them) This, for someone with experience with responsible disclosure is unbelievable. So it starts out…
Today I would like to post about a recent bug I have found in PHP, CVE-2015-2348 . This bug is fairly severe. (considering the amount of developers & packages affected). I have to admit checking the file extension and saying a file is safe can still cause many other security issues. However, checking for this exact vulnerability in your code is pretty unrealistic, considering it can pass the…
I wasn't going to post about it then I thought it could be an interesting article to post because this is the 3rd vulnerability that got fixed in the same parameter 6 months later. You can find my initial linkshim bypass to this exact position which later turns out to be XSS if you click here . In the first bug I found in the continue parameter, it is possible to bypass linkshim and force a…
Normal 0 false false false false EN-US X-NONE X-NONE MicrosoftInternetExplorer4 First off, before going in-depth about this I would like to paste you what a crossdomain.xml file is,here is something that are taken from Ookla, you can read more here . What is the crossdomain.xml file? The crossdomain.xml file is a cross-domain policy file. It grants the Flash Player permission to talk to servers…
Normal 0 false false false EN-US X-NONE X-NONE Site: morfy.monstra.org; Executing Commands like a Boss! (*cough cough*) Versions <= 1.0.5 are vulnerable to the following attacks if certain requirements fulfill 1. Remote Command Execution Vulnerable Code ./install.php Line 57 $post_site_url = isset($_POST['site_url']) ? $_POST['site_url'] : ''; ./install.php Line 64-77…
Normal 0 false false false false EN-US X-NONE X-NONE VL-MAG: http://magazine.vulnerability-db.com/?q=articles/2014/12/11/whitehat-hacker-discovered-details-application-side-facebook-studio-dashboard This is a cool Second-Order-Injection XSS against Facebook Studio that was caused by data input on Facebook Mobile ( Facebook Studio ). This vulnerability is created because of improper user input…
Monstra CMS 3.0.1 (current version at the time of writing) and below Vulnerabilities HTTP Response Splitting (CRLF Injection) http://packetstormsecurity.com/files/129043/Monstra-3.0.1-HTTP-Response-Splitting.html /plugins/captcha/crypt/cryptographp.php <?php ... SetCookie("cryptcookietest", "1"); Header("Location: cryptographp.inc.php?cfg=".$_GET['cfg']."&sn=".session_name()."&".SID); ... ?> So…
ZTE 831CII suffers from login bypass, cross site request forgery, hardcoded administrative credential, and cross site scripting vulnerabilities. Hardcoded administrative credential In ZTE routers the username is a constant which is “admin” and the password by default is “admin” Insecure Direct Object Reference [CVE-2014-9184] ZTE ZXDSL 831CII suffers from an insecure direct object reference…
ZTE is providing a ADSL routers in my home country. Since there is only one ISP and they are giving everyone ZTE routers when they get ADSL internet I thought looking into this would be interesting. Even though different router models are given, I was surprised to find out how similarly the software operated. After testing about 7 different ZXDSL models, I think all these bugs are present in all…
Normal 0 false false false false EN-US X-NONE X-NONE Hacking the Hackers “ So your friend have DB-UUA? & you want to hack his ass?? :P ” Here is the exploit link: http://pastebin.com/A7WV5MbK “Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help…
This is the second part of the series on how I found an XSS in Facebook. I wrote about the first bug here . It was a Linkshim evasion and URL redirection bug. I used “../http://site.com” in the continue parameter for redirection, bypassing the Linkshim and I explained how there. After Facebook triaged my bug, promised me a 1000$ bounty and after fixing the issue, I realized something. The bug…
Web applications frequently redirect and forward users to other pages and websites, and use untrusted data to determine the destination pages. Without proper validation, attackers can redirect victims to phishing or malware sites, or use forwards to access unauthorized pages. An unaware user is most probably tricked by attackers to a malware site or a phishing site and gets infected by various…