Exploitation Vulnerability Research
Back in 2012 I gave a talk at a conference titled Blended Threats and JavaScript . I demonstrated how anybody could design an internet worm that targeted common network devices like routers and turn them into a powerful botnet that is able to monitor traffic across all types of networks. For the presentation, I demonstrated a vulnerability in the uber-popular Linksys WRT54GL router. Well, it's…
A flaw in Internet Explorer could expose users to JavaScript exploits and Universal XSS by abusing the way the browser classifies websites into specific security zones. What is Universal XSS? Generic Cross-Site Scripting (XSS) flaws only affect the original website that has the XSS vulnerability. For example, XSS in facebook.com grants an attacker access to the victim's Facebook session, but…
Check out the slides to our talk " Blended Threats and JavaScript " presented at BlackHat USA 2012! This version of the presentation features 3 additional slides not shown during the conference. Please also check out the demonstration code on Github, and leave feedback in the comments below. Follow myself @superevr and my co-presenter @savant42 on Twitter. Black Hat USA 2012 - Blended Threats and…
Following up on yesterdays post Pluck SiteLife software multiple XSS vulnerabilities , let's take a look at how to exploit XSS in JSON responses using Internet Explorer. Quick introduction to JSON JSON is a model for encoding data, used by many web applications that want to serve dynamic or updating content within a single web page. It's formatted like so:…
On November 30, 2011 I reported to US-CERT that I found multiple XSS vulnerabilities in Demand Media's Pluck SiteLife software. The details of the vulnerabilities (now patched) were published yesterday as US-CERT Vulnerability Note VU#400619 . Heres the original report I sent to US-CERT and on November 30, 2012: I would like to report multiple XSS vulnerabilities. ... Here are the vulnerability…
I think it's great that companies have started programs to reward ethical hackers that responsibly disclose vulnerabilities before they become a problem to their customers. Each of the vulnerabilities that I will be posting has already been fixed by the group responsible, or the site has been retired. I'm publishing this information because it was an interesting exercise to find these…
Here's something that I had never seen before: A Top-Level Domain being used as a hostname for a website. ac It's actually a mirror of http://nic.ac/, but web browsers are able to access it at http://ac/ or http://ac./ The extra period is sometimes required to force a DNS lookup, but isn't required on subsequent requests. These URL's all go to the same place: http://ac/ http://ac./ http://ac.:80/…
I have three new web bugs to demonstrate. Each of them take advantage of how a semicolon character is interpreted by a web server or browser. Each of these bugs can be demonstrated on the latest release of Apache Tomcat 7.0.22, and the latest browsers. Exploitation of these bugs requires unique issues on a vulnerable website. 1. XSS via Request URI: Avoiding "Page Not Found" Errors With Path…
Skype has fixed the security vulnerability I reported in Skype for iOS 3.01 with their 3.5.84 and subsequent 3.5.117 update. Now it's time to tell how it worked. There are several parts to the attack. The Full Name field injection This goes into a Skype users "Full Name" field, and will run in Skype for iOS when the message is read. The Full Name field is limited on space, and script tags don't…
I've been working on some interesting research to help achieve one of my recent goals: present at a security conference. On Sunday, October 9th, I will be giving a 20-minute talk at ToorCon San Diego titled Post-Exploitation with JavaScript - The New Cross-Site F-U! This presentation is about the incremental risk of Cross-Site Request Forgery ( CSRF ) attacks that involve submission of arbitrary…
Skype for iOS contains an XSS vulnerability that allows attackers steal information. A Cross-Site Scripting vulnerability exists in the "Chat Message" window in Skype 3.0.1 and earlier versions for iPhone and iPod Touch devices. Skype uses a locally stored HTML file to display chat messages from other Skype users, but it fails to properly encode the incoming users "Full Name", allowing an attacker…
Update! 2/24/2012 I found out that the latest versions of Firefox and Chrome now give error messages instead of preferring the first or second header. This is probably the safest way to handle the situation, since this trick can really only be used for evil }:) Where does your browser send you when the HTTP Response contains two location headers? [code autolinks="false"]HTTP/1.1 302 Found Date:…
This post was originally available on the Web Application Security Mailing List Feb 10, 2011. The issue has since been resolved in some browsers. Additional References: http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2011-February/007533.html http://news.ycombinator.com/item?id=2203367 http://www.mozilla.org/security/announce/2011/mfsa2011-10.html…
Here is a really strange bug that appears to be fixed in the latest web browser versions. Some browsers will actually render <script> tags inside of <link>, <a href>, <div>, <img>, and possibly many other tags. See some examples on my test page . If you are running a vulnerable browser, some alert boxes will pop up. If you are running a browser where the bug has been fixed, then you won't really…
Can you trust your web browser? Many web browsers have bugs that cause them to render some characters from different character sets incorrectly. The following pages will demonstrate these bugs by example by showing how Despite what your browser may display on the following pages, none of the linked pages are <script> tags might be inserted even if the " < " and " > " are properly filtered by the…