DOM XSS Explained - Part 1

<div dir="ltr" style="text-align: left;" trbidi="on"><div style="text-align: center;">         <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkufYujP-e1K53Zy3Wa2Lkc-anLsMLtKV9xMh2kh25HzjIhtU4WiDMnVUHNusEZjhBSnwkbJQzPHdri_RI3vuO2-ahl85a9SklT9z1ServaWeiEKpJrjdhP_8X77-wwsSYyPt89MaJSis/s1600/DOMInatrixss.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkufYujP-e1K53Zy3Wa2Lkc-anLsMLtKV9xMh2kh25HzjIhtU4WiDMnVUHNusEZjhBSnwkbJQzPHdri_RI3vuO2-ahl85a9SklT9z1ServaWeiEKpJrjdhP_8X77-wwsSYyPt89MaJSis/s1600/DOMInatrixss.png" width="370" /></a></div><br />Cross Site scripting (XSS) has been a problem for well over a decade now, XSS just like other well known security issues such as SQL, XPATH, LDAP Injection etc fells inside the category of input validation attacks. An xss vulnerability occurs when an input taken from the user is not filtered/santized before it's returned back to the user. The XSS can be divided into the following three categories:<br /><br /><a name="more"></a><br /><br /><b>1) Reflected XSS</b><br /><b>2) Stored XSS </b><br /><b>3) DOM Based XSS </b><br /><br />As time has passed by the security community has came up with lots of solutions to mitigate XSS attacks such as encoding libraries, Web Application filters based upon blacklists, Browser based XSS filters, Content security policy etc, however all of them have had some limitation either not being able to mitigate xss attacks in a certain context. For example - We have a well known PHP based protection library called HTML purifier, it offers great protection against XSS attacks in lots of different context, however currently it has no support for HTML 5, talking about content security policy which dubbed as the best solution for mitigating xss attacks has no support for inline JS as well as no support for mobile browsers.<br /><br />However, traditional XSS has been mitigated to some extent where the input is sent to the server and when is returned without any sanitation. However what happens in case where the user input is never sent to the server side and get's executed on the client side?. In that case all the server side defenses would fail as the payload never arrives the server. This is what is referred as DOM based XSS when the payload is never sent to the server and is executed on the client side, in order to understand DOM based XSS better, we would need to understand, what's DOM.<br /><h4 style="text-align: left;">What is DOM?    </h4>DOM stands for document object model and all it is a javascript's way of accessing page. Each and every HTML element has a correspoding entity inside of DOM.<br /><h4 style="text-align: left;">What is DOM Based XSS? </h4>A DOM based XSS vulnerability occurs when a source get's executed as a sink without any sanitization. A source is commonly refered as any thing that takes input, which apparentely in javascript is "Everything taken from a URL". Common sources inside javascript are document.url, location.hash, location.href, document.referer. A more detailed list is available at the DOM based XSS Wiki.<br /><br />A sink is refered to anything that creates HTML in an insecure way. There are wide variety of different sinks depending upon the javascript libraray you use. For example: In javascript document.write, innerHTML, eval are the most commonly found sinks, where as in jquery we have .html(), .appendto() etc. We can find a list of commonly used sinks at DOM based XSS wiki.<br /><h4 style="text-align: left;">How to find DOM Based XSS?</h4>There are couple of different approaches to detecting DOM based XSS such as black box fuzzing, static analysis and Dynamic analysis. We will discuss all three of them.<br /><br /><b>Black Box Fuzzing</b><br /><br />In black box fuzzing approach, we try injecting different XSS vectors inside different javascript sources and hoping for  javascript to be executed. A tool called Ra-2 is an example of blackbox fuzzing approach towards DOM based XSS. The Fundamental problem with this approach is that it's not context aware and contains several false negatives.<br /><br /><b>Static Analysis</b><br /><br />Another approach is to detecting DOM based XSS is by performing a static source code analysis, where by we try finding out the sources/sinks and we trace if a source is being executed as a sink.DOM based XSS wiki contains a list of regular expressions which would help you find out the sources/sinks:<br /><br />The following regular expressions would help you determine all the sources and sinks in a javascript file:<br /><br /><h4 style="text-align: left;">Finding Sources: </h4><br />/(location\s*[\[.])|([.\[]\s*["']?\s*(arguments|dialogArguments|innerHTML|write(ln)?|open(Dialog)?|showModalDialog|<br />cookie|URL|documentURI|baseURI|referrer|name|opener|parent|top|content|self|frames)\W)|(localStorage|sessionStorage|<br />Database)/<br /><br /><h4 style="text-align: left;">Finding Javascript Sinks:</h4><br />/((src|href|data|location|code|value|action)\s*["'\]]*\s*\+?\s*=)|((replace|assign|navigate|getResponseHeader|open<br /><br />(Dialog)?|showModalDialog|eval|evaluate|execCommand|execScript|setTimeout|setInterval)\s*["'\]]*\s*\()/<br /><br /><b>Finding Jquery based sinks</b><br /><br />/after\(|\.append\(|\.before\(|\.html\(|\.prepend\(|\.replaceWith\(|\.wrap\(|\.wrapAll\(|\$\(|\.globalEval\(|\.add\(|<br /><br />jQUery\(|\$\(|\.parseHTML\(/<br /><br /><br /><b>JSprime</b> and <b>IBM appscan </b>apply this particular approach to detecting DOM based XSS. The fundamental problem with this approach is that javascript code may be compressed, packed or Obfuscated, in that scenario Static analysis won't help us. Also in case where the code is encoded and is decsoded and executed at runtime a static code analyzer won't be able to detect it. An example of this would be the following statement:<br /><br /><b>eval('var a'+'=loc'+'ation'+'.hash');</b><br /><br />The strings would are spilitted and would be joined together in memory at runtime and would be executed by using the eval function.<br /><h4 style="text-align: left;">Dynamic Analysis </h4>As mentioned above, a static code analyzer won't be able to detect obfuscated and code which would execute at the run-time. In that case, we have another approach called as Dynamic taint tracking. The taint flag is added to the source and it's tracked until it is executed via a source at run-time. Dominator is currently the only tool in the market that utilizes this methodology, however there are several places where dominator is not effective<br /><br /><b>1)</b> Human interaction is necessary for the analysis to be performed.<br /><b>2)</b> If a human misses to test a feature dominator would also miss.<br /><b>3) </b>A better dynamic taint tracking is required.<br /><br />Let's now talk about few examples:<br /><br /><b>Example:</b><br /><br /><HTML><br /><TITLE>Welcome!</TITLE><br />Hi<br /><SCRIPT><br />var pos=document.URL.indexOf("name=")+5;<br />document.write(document.URL.substring(pos,document.URL.length));<br /></SCRIPT><br /><BR><br />Welcome to our system<br />…<br /></HTML><br /><br />The following code is taken from Amiet klien's paper on "DOM based XSS", In the above script we see a javascript source <b>document.url </b>that takes input from a url, The indexof property searches for the name parameter inside the url and is saved into the "pos" variable, later the user input stored inside the pos variable is being directly written to the DOM without any sanitization.<br /><br />By inserting the following payload, javascript would be executed and hence would finalize the DOM based XSS attack:<br /><br /><b>http://www.target.com/page?name=<script>alert(1);</script></b><br /><br />In the above case one might argue that the payload would be sent to the server in initial requests, but in the following scenario where we specify a hash before the name variable, the payload would not be sent to the server.<br /><b><br /></b><b>http://www.target.com/page?#name=<script>alert(1);</script></b><br /><br />Let's take a look at another example:<br /><br /><html><br /><body><br /><h2>POC for settimeout DOMXSS</h2><br /><body><br /><script><br />var i=location.hash.split('#')[1];<br />(function () {<br />setTimeout(i,3000);<br />})();<br /></script><br /></body><br /></html><br /><br />In this case, the source is location.hash, the split function is used which would split up everything after hash, the user input is being stored under variable "i" which is later executed via setTimeout() function which is a known javascript sink.<br /><br />The following would trigger an alert after three seconds:<br /><br /><b>http://www.target.com/page.html#alert(1)</b><br /><br /><b>Example 3 </b><br /><br /><script><br />var redir = location.hash.split("#")[1];<br />x = document.getElementById('anchor');<br />x.setAttribute('href',redir);<br /></script><br /><br />The following is another very simple example of DOM based XSS, the input is taken from location.hash and is stored inside redir variable. Next, we use getElementByID method to  search for anchor element with id "<b>anchor</b>". next the value of redir is assigned to the href attribute via the setAttribute API. The sink in this case is the href. You may try replacing href with src and it would still result in the javascript being executed.<br /><h4 style="text-align: left;">Cross Browser Detection</h4>Some browsers encode special characters when taken from a particular before displaying it back to the DOM and due to this reason a DOM based XSS vulnerability might trigger in one browser, but does not trigger in another browser. For example: Firefox encodes every thing sent after ?, where as internet explorer doesn't. A list of these characters is already compiled up on DOM based XSS wiki.  Consider, Spending some time reviewing it.<br /><ul style="text-align: left;"><li><a href="https://code.google.com/p/domxsswiki/wiki/LocationSources" rel="nofollow" target="_blank">https://code.google.com/p/domxsswiki/wiki/LocationSources</a></li></ul><br /><h4 style="text-align: left;">Defending Against DOM Based XSS</h4>The following steps shall be taken to mitigate DOM based XSS attacks<br /><br /><b>1) </b>Unsafe sinks shall not be used. They shall be replaced with safe methods. For example: innerHTML is classified as a dangerous sink, however innertext could be used in place of innerHTML, which is a safe DOM method. Similarly in jquery, .html() (equivalent to innerHTMLof javascript) is classified as a dangerous method, alternatively we have .text() method to safely write things to the DOM.<br /><br /><b>2) </b>As there are several different javascript libraries, community should make effort in classifying all the dangerous sinks in that particular libraray and introduce safe methods<br /><br /><br />This concludes the introductory post on DOM based XSS, Stay tuned for the part 2. </div>

DOM XSS Explained - Part 1

          Cross Site scripting (XSS) has been a problem for well over a decade now, XSS just like other well known security issues such as S...

+ Read more »

A Tale Of A DOM Based XSS In Paypal

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkufYujP-e1K53Zy3Wa2Lkc-anLsMLtKV9xMh2kh25HzjIhtU4WiDMnVUHNusEZjhBSnwkbJQzPHdri_RI3vuO2-ahl85a9SklT9z1ServaWeiEKpJrjdhP_8X77-wwsSYyPt89MaJSis/s1600/DOMInatrixss.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkufYujP-e1K53Zy3Wa2Lkc-anLsMLtKV9xMh2kh25HzjIhtU4WiDMnVUHNusEZjhBSnwkbJQzPHdri_RI3vuO2-ahl85a9SklT9z1ServaWeiEKpJrjdhP_8X77-wwsSYyPt89MaJSis/s1600/DOMInatrixss.png" width="370" /></a></div><div class="separator" style="clear: both; text-align: left;"></div><h4>Introduction </h4><div class="separator" style="clear: both; text-align: left;">We have already disclosed lots of findings related to DOM Based XSS and this article talks about a pretty interesting DOM Based XSS vulnerability i found long time back inside paypal. A DOM Based xss vulnerability also known as the third type of XSS vulnerability or type 0. This vulnerability occurs due to the fact that developers don't sanitize the input before it reaches a sink. A Sink is defined as anything that generates HTML, not every sink is considered as dangerous, however there are some common sinks that should be avoided and are mentioned at DOM Based XSS wiki .</div><div class="separator" style="clear: both; text-align: left;"></div><a name="more"></a><br /><h4>Current Situation </h4><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">The situation with DOM Based xss is getting worse now a days, not only because of dynamic JS libraries such as YUI, Jquery, Jquery mobile etc, but also with programming languages such as PHP that are more natively supporting HTML 5 features. One of the aspects of a DOM Based XSS vulnerability that i discovered was with tracking scripts such as Eloqua, Sitestat, Omniture, etc as they often introduce dangerous sinks. Examples are<a href="http://www.rafayhackingarticles.net/2013/03/dom-based-xss-in-microsoft.html"> here</a> and <a href="http://www.rafayhackingarticles.net/2013/02/dom-based-xss-in-avg.html">here</a>. The same is the case with sharing buttons such as google plus, addthis etc. </div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;"></div><h4>A Vulnerable Example from W3schools </h4><div class="separator" style="clear: both; text-align: left;">The worsed part about DOM Based xss apart from it's complexity is the fact that lots of learning references and guides teach developers to code things in an insecure way i.e. in a way that would introduce vulnerabilities automatically. The following screenshot is taken from the jquery learning section of w3schools. The website needs no introduction, it is the most commonly referred websites for beginners to learn various programming language.</div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiSDomBsY4k_erO9hqUnfAwD1A9dbODmK04vaQcxtf0GU20v7YdFw6IkivVOhE681N0kkG5LVzevNJaxuTK4V-othALL4BH-AV7XaNA2Bx-ckn5GPwmxEHSQRTbv8TpqUoS1OU45b7Ixtc/s1600/4.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="360" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiSDomBsY4k_erO9hqUnfAwD1A9dbODmK04vaQcxtf0GU20v7YdFw6IkivVOhE681N0kkG5LVzevNJaxuTK4V-othALL4BH-AV7XaNA2Bx-ckn5GPwmxEHSQRTbv8TpqUoS1OU45b7Ixtc/s1600/4.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;">The code uses the html() function inside of jquery to output html, however the problem is that html() is not a safe jquery function and is represented as a dangerous sink as per <a href="https://code.google.com/p/domxsswiki/wiki/jQuery" rel="nofollow" target="_blank">DOM Based XSS Wiki</a>. In case, where a user controlled input outputted through html() sink without sanitization would lead to a DOM Based xss. The html() function inside of jquery is the equivalent to the innerHTML function inside of javascript. The fundamental problem is that the developers are not advised to use a safe function. Therefore, in my opinion w3schools shall be renamed to w3fools. </div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"></div><h4>The Tale Of Paypal DOM Based XSS</h4><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;">The <b>financing.paypal.com</b> subdomain was a subject of DOM Based xss vulnerability. The subdomain had a feature which triggered my interest, which allowed the users to create ad units of different sizes. The size of the ad was being handled on the client side with the help of jquery.</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><b>Example</b></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><b>https://financing.paypal.com/ppfinportal/adGenerator/webCopy?460 * 80</b></div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;">The above input would display "<b>460 * 80</b>" in front of the Selected Size Option, Changing the text with our own input would result in the same text being outputted on to the screen. This means that our input that is taken from a source is being passed through a sink to be displayed upon the screen. So, what happens if we change the input with our XSS payload, for example - <b><svg/onload=prompt(1)>.</b></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><span style="font-weight: bold;">https://financing.paypal.com/ppfinportal/adGenerator/webCopy?</span><b><svg/onload=prompt(1)></b></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh0dCeLGKGE2Mc3dx5s9B1iRZBuroaC8eb7tZaANs1PwenyEdpq88cHKiwjL6vRXtDl9uydtQZOtpGzfAnqIsEkgLQOjfQEx1eN8X2yLigLXWwfT-RNtmP3MjR49i9cSJo8N8JTKlqNAqU/s1600/rafay2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="370" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh0dCeLGKGE2Mc3dx5s9B1iRZBuroaC8eb7tZaANs1PwenyEdpq88cHKiwjL6vRXtDl9uydtQZOtpGzfAnqIsEkgLQOjfQEx1eN8X2yLigLXWwfT-RNtmP3MjR49i9cSJo8N8JTKlqNAqU/s1600/rafay2.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">Unfortunately, the results were returned URL encoded. Now there could be two possibilities, whether the javascript is encoding our input before rendering it on the screen or it's a general browser behaviour. Turns out that Google Chrome and Firefox browsers encode everything sent after ?, but what about Internet explorer?, Internet explorer returns the characters as URL unencoded and therefore, we inside of internet explorer we are able to render our javascript. </div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiWDuuAi4zeZT_vQgC8jd63rMsKtBjmjhJXqejdp995n7TA2Tc2Atg9nOYfVO-pw2WOY9IBCQN7RuJTovf8cydycx7E7tKZ_igIUS5-FT4v2dcKZm7WUoR8tXQJOsmTKb1870W2L78rvCA/s1600/5.png" imageanchor="1" style="clear: left; margin-bottom: 1em; margin-right: 1em; text-align: center;"><img border="0" height="150" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiWDuuAi4zeZT_vQgC8jd63rMsKtBjmjhJXqejdp995n7TA2Tc2Atg9nOYfVO-pw2WOY9IBCQN7RuJTovf8cydycx7E7tKZ_igIUS5-FT4v2dcKZm7WUoR8tXQJOsmTKb1870W2L78rvCA/s1600/5.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">With that being said, as per DOM Based XSS wiki google chrome does not encode certain characters when passed after a hash. Therefore, we could add an additional hash after the ? mark to get our payload executed. </div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;"><b>Example</b></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><span style="font-weight: bold;">https://financing.paypal.com/ppfinportal/adGenerator/webCopy<span style="color: red;">?#</span></span><b><span style="color: red;"><svg/onload=prompt(1)></span></b></div><div class="separator" style="clear: both; text-align: left;"><b><span style="color: red;"><br /></span></b></div><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpHTRGUrz1FTkpnSitVC5SKpVwMmj-2R78ApE2nJnFJay9FLRS0b5_IXhkaDN0G1BLeU9cSyHeyuNSPI23CUxBdFGQbe2SXc_qpsTio486Hdp58ZwwSNQEppojijRJQ5Ntsn90iQ917pY/s1600/domxss.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="272" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpHTRGUrz1FTkpnSitVC5SKpVwMmj-2R78ApE2nJnFJay9FLRS0b5_IXhkaDN0G1BLeU9cSyHeyuNSPI23CUxBdFGQbe2SXc_qpsTio486Hdp58ZwwSNQEppojijRJQ5Ntsn90iQ917pY/s1600/domxss.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"></div><h4>Vulnerable Code</h4><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;">With some debugging i was able to determine the exact cause of the vulnerability. The following screenshot highlights the line of code that was responsible for the cause of this vulnerability. </div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWHrIsMI-_48Zbw1uCTzvyec99VE3MTEdaTPhnpUGM4KXXqGQK41n17vpvvC_sOsCITVRlOUAQj0UxVuLF8h7nKXJEvfV1LsQ28BUNUo-mu8yvHSrrQmSXuDTKxiz9zdng2mz91y4ESpM/s1600/rafay3.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="375" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWHrIsMI-_48Zbw1uCTzvyec99VE3MTEdaTPhnpUGM4KXXqGQK41n17vpvvC_sOsCITVRlOUAQj0UxVuLF8h7nKXJEvfV1LsQ28BUNUo-mu8yvHSrrQmSXuDTKxiz9zdng2mz91y4ESpM/s1600/rafay3.png" width="577" /></a></div><br />The line 517 represents the source being <b>document.url,</b> a split function is called which splits everything being sent after the ? mark and saves it inside a variable called <b>url</b>.<br /><br /><div class="separator" style="clear: both; text-align: left;"><b>Example</b></div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><span style="font-weight: bold;">https://financing.paypal.com/ppfinportal/adGenerator/webCopy<span style="color: red;">?#</span></span><b><span style="color: red;"><svg/onload=prompt(1)></span></b><br /><div class="separator" style="clear: both; text-align: left;">The split function would return <b><svg/onload=prompt(1)> </b>from the url and then is saved inside a variable called <b>url.</b> Next inside the <b>521 line </b>we can see that html() function is used to output url variable, which in this case contains our xss paylaod. The payload would be outputted to the screen and hence would execute the javascript for us. </div><div class="separator" style="clear: both; text-align: left;"><h4>Conclusion</h4></div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;">DOM Based XSS are growing and would continue to grow as more and more people would start using dynamic javascript libraries and as more people more towards server side javascript i.e. node js, the impact would be much more high. This article demonstrates the importance of sanitizing the user supplied input not only on the server side but also on the client side. </div><div class="separator" style="clear: both; text-align: left;"><br /></div>Pass the comments!. </div>

A Tale Of A DOM Based XSS In Paypal

Introduction  We have already disclosed lots of findings related to DOM Based XSS and this article talks about a pretty interesting DOM Base...

+ Read more »

Kali Linux DOM Based XSS Writeup

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh0gXfptzDeN178HKpIfrkRQH3lVGIrThgvQtDpoKAzSgv76Upo0fNo9SjtSy2aDHS3bfgNw7LNIGP4fLIKuFgyGGh1Pnpw4sA9Cw6O83lxLp5nUBwbiQC8Drei7Hush6419XQGSQPOzq0/s1600/images.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="302" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh0gXfptzDeN178HKpIfrkRQH3lVGIrThgvQtDpoKAzSgv76Upo0fNo9SjtSy2aDHS3bfgNw7LNIGP4fLIKuFgyGGh1Pnpw4sA9Cw6O83lxLp5nUBwbiQC8Drei7Hush6419XQGSQPOzq0/s400/images.jpg" width="400" /></a></div><br />Recently, I have been on a mission to find XSS in popular security training websites, Since these are the ones who care about their security the most. I have been successful in finding in almost all of them i have tried up to date, This one was a bit interesting to i thought to write a post on it, Basically it was not a reflected/stored xss, however it was a DOM based XSS, similar to the one i found in <a href="http://www.rafayhackingarticles.net/2013/03/dom-based-xss-in-microsoft.html" target="_blank">Microsoft</a>. Unlike others, this particular XSS occurs in client side javascript.<br /><a name="more"></a><br />In order to provide features to the users lots of webmasters/Vendors are moving their code towards client side, the data is embedded in the DOM and before it's reflected back to the user it is not filtered out, which results in a DOM based XSS. The main cause of this vulnerabilities are dangerous Sinks. <a href="https://code.google.com/p/domxsswiki/" rel="nofollow" target="_blank">DOM based XSS wiki </a>is a good source where you would find dangerous sources and sinks.<br /><br />On checking out the source of kali.org, i immediately found out that i was running <b>wordpress version 3.5.1</b>, The version is the latest version of the wordpress and has no known public vulnerabilities till date, therefore i moved towards testing plugins.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgXXJOZbYAQ7-dv22krInK3MucxwrDDAUyp6vuV11zFDIJXMdbbtCIfaph3G1dSRlysF8Uw8Myl8ratRNdisQHzf4ULE7xgVSH8_EMW4z6BKNVjaJDSBKuPXxHqcAtcm3qwOhtL_5FQq54/s1600/1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="308" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgXXJOZbYAQ7-dv22krInK3MucxwrDDAUyp6vuV11zFDIJXMdbbtCIfaph3G1dSRlysF8Uw8Myl8ratRNdisQHzf4ULE7xgVSH8_EMW4z6BKNVjaJDSBKuPXxHqcAtcm3qwOhtL_5FQq54/s640/1.png" width="577" /></a></div><br />I tested couple of plugins, however did not find any one of them vulnerable, by analyzing the source more deeply i found a pretty interesting plugin <b>"WP-Pretty Photo" </b>which caught my interest. Which is a jquery based lightbox for wordpress platform.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUJ0IEZkmwqEE2revCwNLdIsm4d9sTZb_mX9X05zgAfY9Y8P1gRrqsHCci6o_jTQCa459wXV7zHwdvQt0soDE7w7IXqbdEordTpy5CtGUEjDbt5sNcsJFdB9nh0PkeNdZICjI_Cg2JpX4/s1600/2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="316" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUJ0IEZkmwqEE2revCwNLdIsm4d9sTZb_mX9X05zgAfY9Y8P1gRrqsHCci6o_jTQCa459wXV7zHwdvQt0soDE7w7IXqbdEordTpy5CtGUEjDbt5sNcsJFdB9nh0PkeNdZICjI_Cg2JpX4/s640/2.png" width="577" /></a></div><br />Next i performed a detailed analysis on the prettyphoto.js file, hunting for DOM based XSS. After my analysis i managed to construct a valid payload to trigger the DOM based XSS. You can find my detailed analysis about the prettyphoto.js DOM xss vulnerability <a href="http://cxsecurity.com/issue/WLB-2013110149" rel="nofollow" target="_blank">here</a>.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjn-muJ5u3f_4STPRkchLwuB72IX-PvTzz9qFgxoKU7wPAbs6HVDL4e0b0Vtj9hOTTZLMtwwbHz0zzl35ABqZfc0x-MK37r3d1oYJBYZKe_kBR0tnZfJGoixcCn9HRKrkrflUJD2xDZ7CI/s1600/rafay.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="248" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjn-muJ5u3f_4STPRkchLwuB72IX-PvTzz9qFgxoKU7wPAbs6HVDL4e0b0Vtj9hOTTZLMtwwbHz0zzl35ABqZfc0x-MK37r3d1oYJBYZKe_kBR0tnZfJGoixcCn9HRKrkrflUJD2xDZ7CI/s640/rafay.png" width="577" /></a></div><b><br /></b><b><br /></b><br /><b>POC:</b><br /><b><br /></b><b><i>http://www.kali.org/#!%22%3E%3Cimg%20src=1%20onerror=prompt%280%29;%3E//</i></b><br /><br />Some debugging with chrome JS console, led me to the <b>line 79 </b>of the <b>jquery.prettyPhoto.js</b>, the line of code which was responsible for the cause of the DOM Based XSS.<br /><i><b><br /></b></i><i><b>http://www.kali.org/wp-content/themes/persuasion/lib/scripts/prettyphoto/js/jquery.prettyPhoto.js?ver=2.1</b></i><br /><i><b><br /></b></i><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjcts6VpHl2JMCgObZH-m2M_2qkM_TzKtYRSnq85eACEGUiCztcjBkPmgclRxdMQP5OiC1vwnazwmXkju3zRGy5Q_YSe43509YBHgSSNxGY5NgPxosMPtz-8YNd8Hm0byt_5Ca01tyA4go/s1600/untitled.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="280" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjcts6VpHl2JMCgObZH-m2M_2qkM_TzKtYRSnq85eACEGUiCztcjBkPmgclRxdMQP5OiC1vwnazwmXkju3zRGy5Q_YSe43509YBHgSSNxGY5NgPxosMPtz-8YNd8Hm0byt_5Ca01tyA4go/s640/untitled.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div>It was also obvious from the code that it required us ! sign to successfully execute the javascript.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgAQqemNnaSLQnWRe05NFlQthE1EIgr_JTHN24uM_-MruykVvOhqWXWIMgmXhpOzZstDlokaUVWhUavZxiFxlGG3cjioiRpd6CTzCSGpAGnsecmGLeeOjqlp7ppJkN9ljd2k_wYsmd4ckI/s1600/new.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="260" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgAQqemNnaSLQnWRe05NFlQthE1EIgr_JTHN24uM_-MruykVvOhqWXWIMgmXhpOzZstDlokaUVWhUavZxiFxlGG3cjioiRpd6CTzCSGpAGnsecmGLeeOjqlp7ppJkN9ljd2k_wYsmd4ckI/s640/new.png" width="577" /></a></div><br />The input inside the hashrel was not filtered out before it was being displayed to the user, which resulted in the DOM Based XSS.<br /><b><br /></b><b>The Fix</b><br /><br />The following url discusses, about the fix:<br /><br /><a href="https://github.com/Duncaen/prettyphoto/commit/3ef0ddfefebbcc6bbe9245f9cea87e26838e9bbc" rel="nofollow" target="_blank">https://github.com/Duncaen/prettyphoto/commit/3ef0ddfefebbcc6bbe9245f9cea87e26838e9bbc</a><br /><br />If, this was not enough for you, then listen to this, Offensive-security team was very awesome in a sense, that they gave me a free voucher for their famous certification PWB 3.0.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgCzQMEDA1Xljo93YwzeApw5Htapqhz-bTaS3196QwB2RtezYX3FiJ6_dO4026q5IHGEiHj3m2LqpndbdlwREJzWsTuIZNPhGkuN8RBftwdiTDGVie_x5FbX4Zu30MwZaWXQm14S1hQSmw/s1600/268818_10151517350038001_194305879_n.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="328" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgCzQMEDA1Xljo93YwzeApw5Htapqhz-bTaS3196QwB2RtezYX3FiJ6_dO4026q5IHGEiHj3m2LqpndbdlwREJzWsTuIZNPhGkuN8RBftwdiTDGVie_x5FbX4Zu30MwZaWXQm14S1hQSmw/s640/268818_10151517350038001_194305879_n.jpg" width="577" /></a> </div>I was really surprised to see that Dominator was not detecting it which is the only good tool for finding DOM Based XSS leaving IBM javascript scan apart, in past i have tried dominator against various websites suffering from DOM Based XSS and have found that, at some spots it's very good and at some spots it needs much improvement. Here is the screenshot:<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiyfrDVmS2elPhuQQNM475iTe_tmvluFgoTVadYspTbo-rIqPe2dAZL87H7y15-8sJ3c846UNM_23vJsyRe739aP5QlOH2d6j06jGRpqGkbNZjIXKsBgMGPDF2eBS_HnY323-R-rHJx4jU/s1600/Untitled.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="402" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiyfrDVmS2elPhuQQNM475iTe_tmvluFgoTVadYspTbo-rIqPe2dAZL87H7y15-8sJ3c846UNM_23vJsyRe739aP5QlOH2d6j06jGRpqGkbNZjIXKsBgMGPDF2eBS_HnY323-R-rHJx4jU/s640/Untitled.png" width="577" /></a></div><br /><br />I would like that every one would be act the same way i did and responsibly disclose every issue you find.</div>

Kali Linux DOM Based XSS Writeup

Recently, I have been on a mission to find XSS in popular security training websites, Since these are the ones who care about their security...

+ Read more »

DOM Based XSS In Microsoft

<div dir="ltr" style="text-align: left;" trbidi="on">           <img src="https://twimg0-a.akamaihd.net/profile_images/1272438885/DOMInatrixss.png" style="background-color: white; color: #333333; font-family: Verdana; font-size: 11.818181991577148px; line-height: 19.190340042114258px; padding: 10px; text-align: center;" /><br />Lately, i have been researching on DOM based XSS a bit, In my previous post i talked about the <a href="http://www.rafayhackingarticles.net/2013/02/dom-based-xss-in-avg.html">DOM based XSS i found inside AVG</a>, DOM based XSS is caused due to lack of input filtering inside client side javascripts, since most of the code is moving towards client side, therefore DOM based xss have been very common now a days, It is predicted by the experts that the DOM based xss mostly occurs in the websites that heavily rely upon javascripts.<br /><a name="more"></a><br />I have reported several DOM based XSS inside Microsoft, most of them were due to the lack of input filtering/sanitization inside of the several tracking scripts such as sitecatalyst and riotracking scripts as they often introduce some vulnerable sources and sinks. With that being said, let's take a look at the POC of the attack:<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiozfcs7Nwv2Cs59POcU2WYcnxoWDwLtO0Jo_khQ1aEsYNuT958zP_xGxerces2pGJIajMBUHf7dfoelZ2lPpt1uzT-_viVmf_xVASyuyc3ICXzvDf2FFYZQGS6d9ltQcGNAvP9KmrDo_I/s1600/MS+DOMXSS.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="280" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiozfcs7Nwv2Cs59POcU2WYcnxoWDwLtO0Jo_khQ1aEsYNuT958zP_xGxerces2pGJIajMBUHf7dfoelZ2lPpt1uzT-_viVmf_xVASyuyc3ICXzvDf2FFYZQGS6d9ltQcGNAvP9KmrDo_I/s640/MS+DOMXSS.png" width="577" /></a></div><br />The vulnerability occurs due to lack of filtering being done inside <b>riotracking script </b>(Line 58), There are other microsoft domains that are also using the same tracking script vulnerable to DOM based XSS, see if you can find one?.<br /><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgiwJv6clZ1u9dvYn5rZkb2pOCpUK3JaKEs8u6c5CWW2iZbpMA5xfrB-OnlfWoG_IOnecuw3iOjbLkPOar1aTMnfnleIo4Xz1oLQfGhWaFWSJVTEde263zehKEW2SOTBMzgXHQ5EqD664s/s1600/Untitled.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="182" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgiwJv6clZ1u9dvYn5rZkb2pOCpUK3JaKEs8u6c5CWW2iZbpMA5xfrB-OnlfWoG_IOnecuw3iOjbLkPOar1aTMnfnleIo4Xz1oLQfGhWaFWSJVTEde263zehKEW2SOTBMzgXHQ5EqD664s/s640/Untitled.png" width="577" /></a></div></div>

DOM Based XSS In Microsoft

            Lately, i have been researching on DOM based XSS a bit, In my previous post i talked about the DOM based XSS i found inside AVG ...

+ Read more »

DOM Based XSS In AVG

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><img src="https://twimg0-a.akamaihd.net/profile_images/1272438885/DOMInatrixss.png" /></div><br />Lately, i have been researching on DOM based XSS a bit, Recently i found a DOM based XSS in AVG, DOM based XSS is caused due to lack of input filtering inside client side javascripts, since most of the code is moving towards client side, therefore DOM based xss have been very common now a days, It is predicted by the experts that the DOM based xss mostly occurs in the websites that heavily rely upon javascripts.<br /><a name="more"></a><br />With that being said, let's take a look at the DOM based XSS POC:<br /><br /><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiA6mhfVuxJFwNtoFqhv2jltHkiM9-rqw-98pnbB0sLy7R2_HsHvyNBcp-Dcmt7hiyQG0ZAxkovSPw-YMsKyld7p5f9n-vjNfZkN0dIILt6gYTQNrmrIf8m4yslBgED9kv8S4HLrd2MPIw/s1600/AVG.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="348" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiA6mhfVuxJFwNtoFqhv2jltHkiM9-rqw-98pnbB0sLy7R2_HsHvyNBcp-Dcmt7hiyQG0ZAxkovSPw-YMsKyld7p5f9n-vjNfZkN0dIILt6gYTQNrmrIf8m4yslBgED9kv8S4HLrd2MPIw/s640/AVG.png" width="577" /></a><br /><br /><br />The vulnerability is the result of lack of escaping done in "js_stdfull.js". The following is the screen shot of the vulnerable code causing the DOM based XSS:<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjIabGoCleJQiab9yCez31enmHeMwrntvR5vO0m5GB06X244h0fuiShvMG2wtII5zLLOm-AO_gVD10ZHkPd4NrQTRsSTICP0L9p2Gdks9IpPrfHgYQdjH1hJU9_AZZPrTnbBc27h6wTeBE/s1600/AVG-DOM-XSS.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="77" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjIabGoCleJQiab9yCez31enmHeMwrntvR5vO0m5GB06X244h0fuiShvMG2wtII5zLLOm-AO_gVD10ZHkPd4NrQTRsSTICP0L9p2Gdks9IpPrfHgYQdjH1hJU9_AZZPrTnbBc27h6wTeBE/s640/AVG-DOM-XSS.png" width="640" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><b>Vulnerable code:</b><br /><br /> //display the correct tab based on the url (#name) var pathname = $(location).attr('href');var urlparts = pathname.split("#"); <br /><br />I would like to give full credits to <b>David Vieira-Kurz from Majorsecurity.com (@secalert)</b>, for helping me sort out the vulnerable code.<br /><br />Yet another security researcher, David Sopas also found the same issue but on the English version of the site:<br /><b><br />http://labs.davidsopas.com/2013/01/avg-vulnerable-to-dom-xss.html</b></div>

DOM Based XSS In AVG

Lately, i have been researching on DOM based XSS a bit, Recently i found a DOM based XSS in AVG, DOM based XSS is caused due to lack of inpu...

+ Read more »