2000day in Safari

Transcript

1. 2000-day in Safari
   Anton Lopanitsyn
   @i_bo0om
   

   View Slide

2. phdays.com #PHDays
   XSS
   https://portswigger.net/web-security/cross-site-scripting
   

   View Slide

3. phdays.com #PHDays
   UXSS
   https://evil.com
   https://victim.com
   

   View Slide

4. phdays.com #PHDays
   Save as webpage, complete
   

   View Slide

5. phdays.com #PHDays
   chrome://flags
   

   View Slide

6. phdays.com #PHDays
   MHTML
   

   View Slide

7. phdays.com #PHDays
   MHTML
   

   View Slide

8. phdays.com #PHDays
   

   View Slide

9. phdays.com #PHDays
   Safari save as webarchive
   

   View Slide

10. phdays.com #PHDays
    Signed
    webarchive
    

    View Slide

11. phdays.com #PHDays
    Plaintext webarchive
    

    View Slide

12. phdays.com #PHDays
    Plaintext webarchive
    …
    

    View Slide

13. phdays.com #PHDays
    Plaintext webarchive
    

    View Slide

14. phdays.com #PHDays
    

    View Slide

15. phdays.com #PHDays
    https://blog.rapid7.com/2013/04/25/abusing-safaris-webarchive-file-format/
    

    View Slide

16. phdays.com #PHDays
    

    View Slide

17. phdays.com #PHDays
    

    View Slide

18. phdays.com #PHDays
    

    View Slide

19. phdays.com #PHDays
    

    View Slide

20. phdays.com #PHDays
    

    View Slide

21. phdays.com #PHDays
    xhtml
    

    View Slide

22. phdays.com #PHDays
    xhtml
    

    View Slide

23. phdays.com #PHDays
    file:///Users/bo0om/Library/Containers/com.apple.mail/Data/Library/Mail%20
    Downloads/2F4D2013-CCBF-4341-B05E-CEB4B76F30CE/Document.xhtm
    file:///Users/bo0om/Downloads/33h0ygug3ulny0gvwhh3d.webarchive
    

    View Slide

24. phdays.com #PHDays
    

    View Slide

25. phdays.com #PHDays
    file:///Users/bo0om/Library/Containers/com.apple.mail/Data/Downloads/x.webarchive
    file:///Users/bo0om/Library/Containers/com.apple.mail/Downloads/x.webarchive
    file:///Users/bo0om/Library/Containers/Downloads/x.webarchive
    file:///Users/bo0om/Library/Downloads/x.webarchive
    file:///Users/bo0om/Downloads/x.webarchive
    

    View Slide

26. phdays.com #PHDays
    DEMO
    https://github.com/Bo0oM/Safari2000day)
    

    View Slide

27. Thank you!
    

    View Slide