eu-14-Hayak-Same-Origin-Method-Execution-Some-Exploiting-A-Callback-For-Same-Origin-Policy-Bypass

eu-14-Hayak-Same-Origin-Method-Execution-Some-Exploiting-A-Callback-For-Same-Origin-Policy-Bypass

Transcript

1. Ben Hayak Security Researcher Ben.Hayak@gmail.com Twitter: @BenHayak
15. Attacker Bank
16. • Document Access • Object Access • Ajax Requests • Data Leakage
17. • <img src=“[[URL]]”> • <link rel href=“[[URL]]”> • <script src=“[[URL]]”> [[External resources]] Go Ahead
21. //XML.. <xml> <person> <name>john</name> <credit>34</credit> </person> </xml>
23. var person = {“name”:”John”,”credit”:34}
24. person.name == “John” person.credit == 34 1. person = RequestData 2. {“name”:”John”,”credit”:34}
25. Easy Fast Light
26. www.telize.com/geoip?callback=getgeoip
27. http://benhayak.com
28. http://benhayak.com
29. http://benhayak.com
30. • <img src=“[[URL]]”> • <link rel href=“[[URL]]”> • <script src=“[[URL]]”> [[External resources]] Go Ahead
31. <script src= “http://external/geo?callback=getgeoip”>
44. SOME
45. .
49. SOME
55. <script src= “http://emailservice/contacts?callback= ” > initTable Test Attack Function initTable(jsondata) { //doSomething in www.google.com (example) }
56. text/javascript
57. AttackerInput();
63. Callback=<XSS>aaa Only [A-Za-z0-9.] allowed Callback=;alert()
64. Setup the Environment
65. 1. Redirect MAIN
66. Share 1. Redirect MAIN
67. Share 2. Redirect placeholder to SOME
68. Share 2. Redirect placeholder to SOME Are you sure? Yes No
69. Are you sure? Yes No 3. Redirect 2nd placeholder to SOME
70. Your Album is now Public Mission Accomplished
73. We don’t need them
74. We only need alphanumeric and a dot
75. We can use Windows
76. Use a popup bypass
77. No restrictions when using windows
79. Ben Hayak Security Researcher Ben.Hayak@gmail.com Twitter: @BenHayak