detectify Go hack yourself or someone else will Frans Rosn - - PowerPoint PPT Presentation

▶
detectify
SMART_READER_LITE
LIVE PREVIEW

detectify Go hack yourself or someone else will Frans Rosn - - PowerPoint PPT Presentation

Jul 26, 2023 350 likes •1.28k views

detectify Go hack yourself or someone else will Frans Rosn @fransrosen Frans Rosn Security Advisor @detectify ( twitter: @fransrosen ) Blog at labs.detectify.com HackerOne #5 @ hackerone.com/thanks "The Swedish Ninja"

slide-1
SLIDE 1

detectify

Go hack yourself … or someone else will Frans Rosén @fransrosen

slide-2
SLIDE 2

detectify

Frans Rosén

Security Advisor @detectify ( twitter: @fransrosen ) Blog at labs.detectify.com HackerOne #5 @ hackerone.com/thanks "The Swedish Ninja"

slide-3
SLIDE 3

detectify

Rundown

  • 1. Background
  • 2. Approaching a target
  • 3. Domain/URL validation
  • 4. Free money + Automation
  • 5. End
slide-4
SLIDE 4

detectify

How it started

slide-5
SLIDE 5

detectify

THEN I FREAKED OUT

  • sv…
slide-6
SLIDE 6

detectify

Thailand

slide-7
SLIDE 7

detectify

Thailand

slide-8
SLIDE 8

detectify

Approaching a target

slide-9
SLIDE 9

detectify

SWFs

slide-10
SLIDE 10

detectify

SWFs

ZeroClipboard.swf flowplayer.swf swfupload.swf clippy.swf Jplayer.swf amline.swf Line.swf column3d.swf video.swf OneClipboard.swf flashmediaelement.swf plupload.swf video-js.swf …

slide-11
SLIDE 11

detectify

By @nirgoldschlager and @homakov
 http://homakov.blogspot.se/2013/02/hacking-facebook-with-oauth2-and-chrome.html
 http://www.breaksec.com/?p=6039

Facebook Connect

slide-12
SLIDE 12

detectify

https://www.facebook.com/v2.2/dialog/oauth ?scope=publish_actions,email &client_id=298315034451
 &response_type=token &redirect_uri=https://www.example.com/login

Facebook Connect

slide-13
SLIDE 13

detectify

https://www.facebook.com/v2.2/dialog/oauth ?scope=publish_actions,email &client_id=298315034451
 &response_type=token &redirect_uri=https://xxx.example.com/yyy

No restrictions!

Facebook Connect

slide-14
SLIDE 14

detectify

URL-validation is hard #1

http://y.com\@x.com

slide-15
SLIDE 15

detectify

URL-validation is hard #1

http://y.com\@x.com java: new URL(d); = x.com php: parse_url(d); = x.com chrome: document.createElement('a').href=d; = y.com

slide-16
SLIDE 16

detectify

RFC 3986 ABNF #RTFM

https://tools.ietf.org/html/rfc3986#page-49

slide-17
SLIDE 17

detectify

PHP FIXED!

https://github.com/php/php-src/commit/ f705063e23183c073837bb76eea6a49d721b37f2#diff-8c81b7e6f1bafce737814315214a5f23R245

slide-18
SLIDE 18

detectify

Open Redirects in real life

https://www.victim.com/logout?redirect_url=https://example.com\@www.victim.com

https://www.linkedin.com/uas/login?session_redirect=https://example.com%252f@www.linkedin.com%2Fsettings

https://vimeo.com/log_in?redirect=/%09/example.com

https://test6473.zendesk.com/access/login ?return_to=//example.com:%252525252f@test6473.zendesk.com/x

https://trello.com/login?returnUrl=/\example.com

slide-19
SLIDE 19

detectify

Firefox…

slide-20
SLIDE 20

detectify

Firefox…

Chrome: Invalid Safari: Domain not found

slide-21
SLIDE 21

detectify

Firefox…

Chrome: Invalid Safari: Domain not found Firefox: example.com !

slide-22
SLIDE 22

detectify

Firefox…

Chrome: Invalid Safari: Domain not found Firefox: example.com !

https://www.mozilla.org/en-US/security/advisories/mfsa2015-129/

CVE-2015-7195

slide-23
SLIDE 23

detectify

Firefox + Prezi…

https://prezi.com/redirect/?url=//example.com%0a%2523.prezi.com

slide-24
SLIDE 24

detectify

Firefox + Prezi…

https://prezi.com/redirect/?url=//example.com%0a%2523.prezi.com HTTP/1.1 301 Location: //example.com%0a%23.prezi.com

slide-25
SLIDE 25

detectify

Firefox + Prezi…

https://prezi.com/redirect/?url=//example.com%0a%2523.prezi.com HTTP/1.1 301 Location: //example.com%0a%23.prezi.com

https://www.facebook.com/v2.2/dialog/oauth?scope=publish_actions,email &response_type=token &redirect_uri=https://prezi.com/redirect/%3furl=https://example.com%25250a%252523.prezi.com &client_id=298315034451

slide-26
SLIDE 26

detectify

Firefox + Prezi…

https://prezi.com/redirect/?url=//example.com%0a%2523.prezi.com HTTP/1.1 301 Location: //example.com%0a%23.prezi.com

https://www.facebook.com/v2.2/dialog/oauth?scope=publish_actions,email &response_type=token &redirect_uri=https://prezi.com/redirect/%3furl=https://example.com%25250a%252523.prezi.com &client_id=298315034451

NOO! :(

slide-27
SLIDE 27

detectify

Firefox + Prezi…

slide-28
SLIDE 28

detectify

3rd-party scripts

(get)?(query|url|qs|hash)param location\.(hash|href|search)\.match

slide-29
SLIDE 29

detectify

3rd-party scripts

k.type='text/javascript'; var m,src=(m=location.href.match(/\bkxsrc=([^&]+)\b/)) && decodeURIComponent(m[1]); k.src=src||'https://cdn.krxd.net/controltag?confid=HrUwtkcl';

slide-30
SLIDE 30

detectify

3rd-party scripts

slide-31
SLIDE 31

detectify

Uber XSS

k.src=src||'https://cdn.krxd.net/controltag?confid=HrUwtkcl';

slide-32
SLIDE 32

detectify

Uber XSS

k.src=src||'https://cdn.krxd.net/controltag?confid=HrUwtkcl';

slide-33
SLIDE 33

detectify

CSP bypass

script-src 'self' https://ajax.googleapis.com https://html5sec.org/minichallenges/3

slide-34
SLIDE 34

detectify

CSP bypass

script-src 'self' https://ajax.googleapis.com https://html5sec.org/minichallenges/3 <script src=//ajax.googleapis.com/ajax/libs/angularjs/1.0.8/ angular.js></script>

slide-35
SLIDE 35

detectify

CSP bypass

script-src 'self' https://cdn.mxpnl.com

slide-36
SLIDE 36

detectify

CSP bypass

script-src 'self' https://cdn.mxpnl.com

slide-37
SLIDE 37

detectify script-src 'self' https://www.googleadservices.com

CSP bypass

slide-38
SLIDE 38

detectify script-src 'self' https://www.googleadservices.com

CSP bypass

slide-39
SLIDE 39

detectify

CSP bypass

slide-40
SLIDE 40

detectify

Google’s CSP evaluator

https://csp-evaluator.withgoogle.com

slide-41
SLIDE 41

detectify

Gotta catch’em all!

slide-42
SLIDE 42

detectify

https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/

October 2014

slide-43
SLIDE 43

detectify

Subdomain Takeover

campaign.site.com Campaign!

https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/

slide-44
SLIDE 44

detectify

Subdomain Takeover

campaign.site.com Campaign! Fake site!

https://labs.detectify.com/2014/10/21/hostile-subdomain-takeover-using-herokugithubdesk-more/

slide-45
SLIDE 45

detectify

Customer Responses

slide-46
SLIDE 46

detectify

Subdomains

slide-47
SLIDE 47

detectify

Subdomains

slide-48
SLIDE 48

detectify

Facebook

slide-49
SLIDE 49

detectify

Facebook

slide-50
SLIDE 50

detectify

Facebook

slide-51
SLIDE 51

detectify

Facebook

POST /rest/v1.1/me/transactions?http_envelope=1 HTTP/1.1 Host: public-api.wordpress.com cart[blog_id]=44444444

slide-52
SLIDE 52

detectify

Facebook

slide-53
SLIDE 53

detectify

Facebook

slide-54
SLIDE 54

detectify

Uber

slide-55
SLIDE 55

detectify

Uber

slide-56
SLIDE 56

detectify

Uber

slide-57
SLIDE 57

detectify

Uber

slide-58
SLIDE 58

detectify

September 2016

http://blog.pentestnepal.tech/post/149985438982/reading-ubers-internal-emails-uber-bug-bounty

slide-59
SLIDE 59

detectify

September 2016

http://blog.pentestnepal.tech/post/149985438982/reading-ubers-internal-emails-uber-bug-bounty

slide-60
SLIDE 60

detectify

MX-records

slide-61
SLIDE 61

detectify

Conflict check + Validation

slide-62
SLIDE 62

detectify

Oh, add this!

slide-63
SLIDE 63

detectify

post-host-master-admin

slide-64
SLIDE 64

detectify

Tadaa!

slide-65
SLIDE 65

detectify

We now get postmaster!

slide-66
SLIDE 66

detectify

slide-67
SLIDE 67

detectify

Google XXE

https://blog.detectify.com/2014/04/11/how-we-got-read-access-on-googles-production-servers/

slide-68
SLIDE 68

detectify

Google XXE

slide-69
SLIDE 69

detectify

Google XXE

slide-70
SLIDE 70

detectify

Google XXE

slide-71
SLIDE 71

detectify

Google XXE

slide-72
SLIDE 72

detectify

Google XXE

slide-73
SLIDE 73

detectify

Chrome View Source

slide-74
SLIDE 74

detectify

Chrome…

slide-75
SLIDE 75

detectify

Chrome…

slide-76
SLIDE 76

detectify

Chrome…

slide-77
SLIDE 77

detectify

Chrome…

slide-78
SLIDE 78

detectify

Chrome…

slide-79
SLIDE 79

detectify

Chrome…

slide-80
SLIDE 80

detectify

Chrome…

slide-81
SLIDE 81

detectify

Chrome…

*click something*

slide-82
SLIDE 82

detectify

Chrome…

slide-83
SLIDE 83

detectify

GitHub’s search OMG!

http://www.forbes.com/sites/runasandvik/2014/01/14/attackers-scrape-github-for-cloud-service-credentials-hijack-account-to-mine-virtual-currency/

slide-84
SLIDE 84

detectify

GitHub’s search OMG!

slide-85
SLIDE 85

detectify

GitHub’s search OMG!

slide-86
SLIDE 86

detectify

GitHub’s search OMG!

slide-87
SLIDE 87

detectify

GitHub’s search OMG!

slide-88
SLIDE 88

detectify

The email, 02:35

slide-89
SLIDE 89

detectify

The email, 02:35

slide-90
SLIDE 90

detectify

The response

slide-91
SLIDE 91

detectify

Go hack yourself … or someone else will

Frans Rosén (@fransrosen) – www.detectify.com