Bonus slides Confused Deputy Problem Original exam ple Norm al - - PowerPoint PPT Presentation

Bonus slides – Confused Deputy Problem

Original exam ple

Client Server Im portant server file Norm al output file

Request:

• 1. Do action
• 2. Write results to

“Im portant server file” Response: OK

Original exam ple ( 2 )

• Possible if the server executes the command using

its own credentials, similarly to a traditional buffer

• verflow
• Used as a prime argument for having capabilities
• First appeared in 1988
• Many other attacks can be seen as confused

deputy attacks – One example is circumventing a firewall by running traffic through a browser

Cross-site Request Forgery

• CDP using a Web browser

Client Web site URL Disguised as <im age>

e.g: http:/ / m ail.com / changepw?newpw=hack

Login Resolve Change PW

CSRF

• Cookies and active sessions to other sites can be

exploited to execute commands on the client by remote code

• Somewhat situational

– Requires active session or cookie between the user and the target site – Requires a suitable target command at the target site – The referer header can be checked to avoid this exploit (but this is not always done) – Hidden fields with tokens can be used to avoid this

• JavaScript can be used to read information from other
• pen tags
• Script languages can be used to send POST

Login CSRF

• Cause the victim to log in at a remote site using

the attackers credentials

• Technically easier that normal CSRF
• Opportunities for novel attacks

Cross-site Scripting

• 80% of all documented vulnerabilities as of 2007

(according to Wikipedia)

• XSS has evolved into meaning injecting e.g. HTML

and JavaScript into Web pages

• Usually used to steal session cookies
• Live example…

XSS

• Three types:

– Non-persistent: What we just did. – Persistent: Online message boards etc.

• Executed more than once

– DOM-based: Targeting already existing scripting elements that parse parameters and generate content

• Similar to Non-persistent, but can also be used

to bypass e.g. client sandboxes

• One known weakness was local Firefox error

pages