May 2007
dotnetids
Just a quick note to announce the start of dotnetids, a port of phpids to the .NET Framework. http://code.google.com/p/dotnetids/
(C)SRF one-time token bypass using AJAX and XSS
This morning I knocked up some proof of concept code to illustrate the retrieval of one-time authentication tokens. The situation in which this is handy is when a site follows best practices and implements a one-time authentication token, but is vulnerable to a XSS attack. A one-time authentication…
XSS Tutorial
This page is designed to give an overview of Cross Site Scripting attacks on web sites, how they come into being, how to exploit them and how to protect against them. To fully comprehend Cross Site Scripting, or XSS as it is known (CSS is NOT used as an abbreviation because it causes confusion when…
String.fromCharCode Encoder
Enter JavaScript in the box below and press "encode":…
Bypassing Same Origin Policy using Mash-Ups
GNUCITIZEN has been going on about this for some time now, but the truly devastating impact of what he has been saying only actually hit me today when reading about his JavaScript interface to Johnny's Google Hacking Database. The scenario is as follows. The interface contains NO SERVER SIDE…
RSnake + Jeremiah Grossman's Book Released
ha.ckers are reporting that their book on Cross Site Scripting has finally been released! Buy a copy at Amazon!
XSF: Cross Site Flashing
Stefano Di Paola presented an interesting paper on Flash security at OWASP 2007 which highlights the dangers of HTML being rendered from within Flash via GET querystrings. Of particular note is the non-sanitization of comments (filter evasion by // .jpg) so check it out.
MOSEB month of search engine bugs
Purpose of this Month of Bugs is a demonstration of real state with security in search engines, which are the most popular sites in Internet. To let users of search engines and web community as a whole to understand all risks, which search engines bring to them. And also to draw attention of search…
heise Security reports backdoor in Artmedic CMS
As the title says, heise Security have found a backdoor in the Artmedic CMS system. The interesting question is how this backdoor was implanted - giving the benefit of the doubt it's possible that the development server was compromised and the code injected (the changes date back to the 2nd of…
XSS in eXceSS: A "learn-XSS tool"
kishord today presents a tool, called XSS in eXceSS and hosted by .mario that will allow you test attack vectors against a page in different contexts. On top of that it also incorporates PHP IDS, allowing you to skip whichever rules you choose. From kishord's post: It takes the input via various…
XSS Cheat Sheet
Just a quick note to point out this invaluable resource for those interested in XSS attack vectors; rsnake's XSS Cheat Sheet.
PHP IDS
For those who haven't yet seen this, .mario and christ1an over at sla.ckers has been working on a PHP Intrusion Detection System and the results are fairly promising! The system is based on regular expressions and seems to catch everything I've jammed into it so far. Here's an example of catching a…
JavaScript eval String.fromCharCode encoder
Here is a nice tool for encoding JavaScript into eval(String.fromCharCode(x,x,x)) format. A full HTML page is listed here, or you can try it out live at the bottom of this post.
Amendments to the British Computer Misuse Act
pdp has an interesting post from last month about amendments to the British Computer Misuse Act that specify the illegality of "making, supplying or obtaining articles for use in computer misuse offences". Time to make a "terms and conditions" for this site.
Bypass ASP.NET XSS Protection in Internet Explorer
ASP.NET comes preloaded with some default XSS protection which is actually pretty nifty. However, it turns out that the system can be circumvented by a variety of methods, as illustrated by this test input:
httpOnly Cookie Detection
Admittedly of limited use, here is a JavaScript function I wrote to detect the presence of httpOnly cookies. In Firefox the function will overwrite the real value of the cookie, so before using this function it is vital to try and read the cookie normally! Here is the script embedded in a test PHP…
Evaluating the security of the JSONRequest object
A proposed extension to the currently supported set of ...Request objects is JSONRequest, interesting from a security point of view because the proponents of the project wish to allow JSONRequest to violate the Same Origin Policy. This post will give a brief overview of the security features toted…
JavaScript Referer Scripts XSS Injection
Many sites use JavaScript methods to inject a hidden form field into 404 pages to trace the original page that points to the invalid link. An example of this can be found at http://www.yaldex.com/FSPageDetails/_404Referrer.htm. The attentive observer will spot that this method of writing the field…
Firefox XBL-JS Loader v1.0
Today I wrote a simple tool to illustrate the binding of a Javascript document to a page using Firefox's XBL support (-moz-binding) in an XSS context. The process works as follows: Inject attributes as follows (different encodings may be necessary): <element style =…