Top 10 Web Hacking Techniques

2006

The 2006 Top 10 Web Hacking Techniques: all 10 winners and 77 nominated and collected techniques, each with its researcher, summary and preserved source.

77 records · 10 in the top ten · open this year in the interactive archive

The top ten

#1 JavaScript Port Scanning Jeremiah Grossman and T.C. Niedzialkowski
Grossman and Niedzialkowski's Black Hat USA 2006 deck 'Hacking Intranet Websites from the Outside'. A Java applet leaks the NAT'ed internal IP, <SCRIPT SRC> to an internal host reveals a listener by the JS parse error…
#2 Internet Explorer 7 "mhtml:" Redirection Information Disclosure Secunia
Secunia advisory SA22477 (2006-10-19, Less critical, unpatched at publication) on Internet Explorer 7. Mishandling of redirections for URLs using the mhtml: URI handler lets a remote site read documents served from…
#3 Anti-DNS Pinning Martin Johns
Martin Johns (handle Maddin) on undermining DNS pinning by refusing connections. Three raw_sha256 values disagree and the acquire one is missing from the store; the published file came from a thin 2026 live fetch…
#4 I know where you've been Jeremiah Grossman
Grossman's browser history-stealing proof of concept: write a style block colouring :visited links, create an anchor per candidate site, then read getComputedStyle's colour to learn whether it was visited. Sixty-odd…
#5 Backdooring QuickTime Movies pdp
pdp shows a QuickTime HREF Track can carry a javascript: URL that fires automatically when the movie is previewed in a browser, relying on a feature present since QuickTime 3 rather than on a bug. Step by step: write…
#6 Forging HTTP request headers with Flash Amit Klein
Amit Klein's Bugtraq write-up on Flash's LoadVars.addRequestHeader, which lets a movie set arbitrary HTTP request headers from the browser. Forging an Expect header reaches an Apache flaw that reflects the header value…
#7 Exponential XSS Attacks RSnake
Maluc's idea developed: one XSS foothold is used to exploit XSS on other domains, cascading across every site a user is authenticated to. Grossman's CSS history hack picks which domains to try, and XMLHttpRequest with…
#8 Selecting Encoding Methods For XSS Filter Evasion RSnake
Where an application lets the user pick the response charset, a string that is inert under UTF-8 becomes an injection under US-ASCII. Demonstrated against josefsson.org's IDN converter by flipping only the charset…
#9 Web Worms (AdultSpace, MySpace, Xanga) Jeremiah Grossman
WhiteHat Security whitepaper explaining XSS worm propagation through embedded HTML, DOM objects and XMLHttpRequest. It analyses the Samy/MySpace worm, compares its first-day spread with Code Red, Slammer and Blaster…
#10 Hacking RSS Feeds Robert Auger
SPI Labs whitepaper on Feed Injection: RSS and Atom readers variously render feed markup literally, entity-decode it before display, or strip it, and the first two execute attacker script from title, link and…

Also collected

A story that diggs itself ha.ckers.org
Commentary on Digger's self-digging story, used to explain cross-site request forgery: a third-party page redirects an authenticated user into a site function, which then executes as that user. Argues that requiring…
ABC News (AU) XSS linking the reporter to Al Qaeda Jeremiah Grossman
Grossman recounts a 2005 ABC News (AU) Four Corners interview in which he demonstrated XSS against the broadcaster's own site, fabricating a convincing news story that linked the reporter to Al Qaeda, then another…
Account Hijackings Force LiveJournal Changes Brian Krebs
Not a section index: Krebs's LiveJournal/Bantown article is fully archived. Title is the blog masthead, not the post's own heading. 67 comment bodies (~19,354 chars) were dropped while all 70 'Posted by:' lines were…
Adultspace XSS Worm ha.ckers.org
Report of an XSS worm on Adultspace.com spreading through the site's forums and bulletin boards via XMLHTTPRequest, adding victims as friends so the attacker can view private photos. It uses no filter evasion and is…
Advanced Web Attack Techniques using GMail Jeremiah Grossman
A fixed GMail flaw: a predictable URL returned the victim's contact list as an unreferenced JavaScript array constant, loadable cross-domain with a script tag and the session cookie. Overriding the built-in Array…
Ajax (in)security Billy Hoffman
Billy Hoffman's Black Hat USA 2006 deck. Ajax pushes control logic to the client, exposing the server-side function API as attack surface; XmlHttpRequest traffic is indistinguishable from browser traffic, so requests…
Anonymizing RFI Attacks Through Google Noam Rathaus
Noam Rathaus turns Googlebot into an attack proxy: publish a URL that combines a victim's remote-file-inclusion parameter with an attacker-hosted PHP shell, and Google's crawler fetches it, exploiting the third party on…
AT&T Hack Highlights Web Site Vulnerabilities Larry Greenemeier
News report on the August 2006 breach of an AT&T DSL equipment store that exposed card data for nearly 19,000 customers. Jeremiah Grossman is quoted on the methods behind such attacks: JavaScript malware embedded in…
Backdooring Flash Objects pdp
pdp's narrative walkthrough of backdooring a SWF entirely from the command line: compile an ActionScript class whose main calls getURL("javascript:...") with MTASC, then bind it in front of an untouched movie using…
Backdooring Images pdp
pdp on making image files execute script: IE's content sniffing runs HTML appended after a GIF89 header, and .jpg or .gif files whose bodies are HTML execute on view, so an avatar or a linked image on a forum can take…
Backdooring MP3 Files pdp
pdp shows QuickTime Media Link (.qtl) XML accepts a qtnext attribute holding any URL, javascript: included, and QuickTime honours the file whatever its extension, so a .mp3, .mp4 or .m4a can be XML that runs script…
Backdooring PDF Files David Kierznowski
David Kierznowski backdoors PDFs through Adobe's own JavaScript model, attaching code to the Page Open event. One variant silently launches a URL in the browser with no warning from Reader 6 or 7; the other uses ADBC to…
Breaking AJAX Web Applications: Vulns 2.0 in Web 2.0 Alex Stamos and Zane Lackey
Stamos and Lackey's Black Hat Japan 2006 deck on the AJAX attack surface: enumerating server-side methods from downstream JavaScript, manipulating parameters no browser ever sent, XSS through eval'd JSON responses, and…
Browser Port Scanning without JavaScript Jeremiah Grossman
Intranet port scanning with HTML alone. A link rel=stylesheet pointing at an internal address stalls Firefox's parser until the request resolves; a following img src to the attacker's timing script reports how long that…
Bruteforcing HTTP Auth in Firefox with JavaScript Stefan Esser
Firefox fetches favicons and rel=prefetch targets without prompting for HTTP auth, so a page can silently probe protected resources. Esser turns that into a password oracle: a shortcut-icon link carrying user:pass@URL…
Bypassing Filters With Encoding maluc
maluc's sla.ckers thread collecting UTF-7 and high-bit US-ASCII filter-bypass strings. Best preserved of the four threads: all 8 posts present, every vector fenced and byte-correct, including the…
Bypassing Mozilla Port Blocking Jeremiah Grossman
Mozilla blocks several dozen TCP ports to stop the HTML Form Protocol Attack, but the block is applied only to the http protocol handler. Requesting ftp://host:22/ connects anyway — fast if the port is open, a timeout…
Bypassing of web filters by using ASCII Kurt Huwig
Kurt Huwig's iKu advisory on setting the high bit of ASCII characters. Internet Explorer 7 strips the eighth bit and renders the text as ordinary letters, while virus scanners and content filters read the high-bit bytes…
Circumventing DNS Pinning for XSS ha.ckers.org
Write-up of Martin Johns' finding that a browser drops its pinned DNS entry when the origin server stops answering. Change the record, then firewall or shut the host, and the browser re-resolves, letting script read and…
Cross Domain Leakage With Image Size ha.ckers.org
A remotely hosted image whose dimensions vary with the viewer's login state leaks cross-domain user state, since the embedding page can read the rendered size. Extends the same trick to fingerprinting servers via PHP…
Cross-Site Cooking Michal Zalewski
Michal Zalewski's Full Disclosure advisory names three cookie-domain flaws: browsers accept cookies scoped to two-part ccTLDs such as *.com.pl; empty and trailing periods pass the domain check, so ".com." works against…
CSRF with MS Word David Kierznowski
David Kierznowski turns Microsoft Word into a CSRF client by inserting a frame pointing at an attacker-controlled HTML page full of image tags. Word fetches it through Internet Explorer with no warning in Word 2000, so…
CSRF with MS Word Part II ha.ckers.org
Michael Daw's CSRF-from-Word technique extended: instead of a remote image, embed CSS references that Word fetches when the document is opened. That works where images failed, leaves no visible cue to the victim, and…
CSS history hacking with evil marketing cgisecurity.com
An expansion of the CSS visited-link history trick into commercial reconnaissance: probe a visitor for competitor URLs to learn which ads paid off, enumerate which product, contact and confirmation pages they saw, and…
CSS History Stealing Acts As Cookie ha.ckers.org
CSS history stealing repurposed as a persistent cookie substitute. The site forces a visit to a per-user unique URL, then on return iterates candidate URLs to recognise the visitor. Matan Gillon's refinement uses a…
Detecting FireFox Extentions ha.ckers.org
Firefox maps installed extensions' images under chrome:// URLs, so a page can load them and learn which extensions a visitor runs. Naming is per-extension rather than standard, so the post publishes a mapped list and a…
Detecting Privoxy Users and Circumventing It ha.ckers.org
Privoxy replaces a blocked ad with an error page offering a predictable modified URL that bypasses the block. Requesting an image at that reconstructed URL, placed after a keyword Privoxy filters, reveals whether the…
Detecting States of Authentication With Protected Images ha.ckers.org
An IMG tag pointed at a file inside a members-only directory fires onerror when the visitor is not authenticated, so any page can detect a user's login state on a third-party site. A changed image size after login works…
Enumerating Through User Accounts ha.ckers.org
A helpdesk-oriented Google dork surfaced an online retailer's live credential in an indexed QUERY_STRING. User ID and customer ID were separate and unvalidated, so changing the customer ID switched accounts, and the…
Expect Header Injection Via Flash ha.ckers.org
Follow-up on Amit Klein's Expect header injection via Flash, reporting that Secunia's test tool shows a large fraction of major sites affected. Any site echoing the Expect header lets an attacker-supplied movie run…
F5 and Acunetix XSS disclosure Kelly Jackson Higgins
Kelly Jackson Higgins reports that the sla.ckers forum has begun mass-posting live XSS holes with proof-of-concept code, naming Dell, HP, MySpace, Photobucket, F5 and Acunetix. Jeremiah Grossman, watching the thread…
Google Dorks Strike Again ha.ckers.org
Stephen de Vries' Google Code Search dorks for XSS and SQL injection in Java applications, quoted in full: <%=.*getParameter for unescaped output, executeQuery.*getParameter for query construction, and a package filter…
Google Hacks On Your Behalf ha.ckers.org
Commentary on SecuriTeam's finding that search-engine crawlers can be made to attack on the attacker's behalf: links planted on the open web cause Google to fetch PHP remote-include payloads into third-party sites. The…
Google Indexes XSS ha.ckers.org
Proof, found by Ghozt, that Google indexes XSS URLs: a search result contained a reflected cross-site scripting link picked up from blog posts by Nitesh Dhanjani. A working exploit would have been indexed the same way…
Google plugs phishing hole Gadi Evron
Gadi Evron relays Eric Farraro's finding that Google Public Service Search let a site supply its own header and footer markup for the results page, with that markup hosted on Google's own server, so attacker code ran…
Google Search API Worms pdp (Petko D. Petkov)
Explains how a browser script can use callback-delivered search results to discover targets across origins without a separate discovery proxy. The proposed worm architecture combines query diversification, browser…
Governator Hack mike_barton
A short news item: the California Highway Patrol opened a criminal investigation into intrusions on Governor Schwarzenegger's office computers, after a taped conversation stored there leaked to the Los Angeles Times…
HostGator: cPanel Security Hole Exploited in Mass Hack Rich Miller
Netcraft reports HostGator's September 2006 compromise via a then-unknown cPanel flaw giving root from any cPanel account, affecting every version and build. Attackers injected iframes into customer sites redirecting…
How to defeat digg.com 4diggers.blogspot.com
A walkthrough of session riding (CSRF) against digg.com. A zero-size iframe is filled by JavaScript with a POST form, and because IE and Firefox send no Referer for a frame built by script, referer checks fail; only…
How to get linked from Slashdot Jeremiah Grossman
A five-step recipe for making slashdot.org display and link attacker-chosen content: fill in the story submission form, switch its method from POST to GET, click PreviewStory, and keep the resulting preview URL…
HTTP Response Smuggling Amit Klein
Extends HTTP response-splitting attacks by exploiting differences between defensive filters, proxies and browsers. Lone line-ending characters, conflicting Content-Length headers and permissive status-line parsing…
I know what you've got (Firefox Extensions) Jeremiah Grossman
Building on RSnake's chrome: protocol finding, Grossman ships working detection for installed Firefox extensions: create an IMG object per signature pointing at a chrome:// icon unique to that extension, and an onload…
IMAP Vulnerable to XSS Wade Alcorn
Wade Alcorn's Inter-Protocol Communication paper shows two protocols can meaningfully talk when the target tolerates errors and the carrier can encapsulate it. An HTTP multipart POST from a browser delivers valid IMAP3…
JavaScript Portscanning and bypassing HTTP Auth Stefan Esser
Stefan Esser's follow-up to the JavaScript-free HTML portscanning of late 2006: request a URL the server must reject before authentication runs, such as http://192.168.1.1/% or an over-long path, and the HTTP auth…
Malformed URL in Image Tag Fingerprints Internet Explorer ha.ckers.org
IE refuses to fetch an image whose URL contains a malformed percent escape such as %--, while Firefox and Opera fetch it normally. Loading such an image and observing whether the request arrives fingerprints the real…
Metaverse breached: Second Life customer database hacked Contributor and @TechCrunch
Linden Lab disclosed that a Second Life database holding unencrypted names and addresses, plus encrypted passwords and payment data, was breached; every user was forced to change passwords. A source told TechCrunch the…
MX Injection : Capturing and Exploiting Hidden Mail Servers Vicente Aguilera Diaz
Vicente Aguilera Diaz's paper on MX Injection. A webmail application passes user input into IMAP or SMTP commands, so an injected carriage-return and line-feed ends the intended command and starts an attacker's own…
MySpace QuickTime Worm spidynamics.com
SPI Labs brief on the December 2006 MySpace worm, which hid JavaScript in a QuickTime HREF track so playing an embedded movie ran the worm. It reinfected profiles over Ajax, replaced the MySpace navigation menu with a…
Netflix.com XSRF vuln Dave Ferguson
Dave Ferguson's October 2006 disclosure of CSRF on Netflix.com. A single hidden image tag adds a DVD to a logged-in visitor's queue; a little JavaScript moves it to the top so it ships before the victim notices. The…
Network Scanning with HTTP without JavaScript iBlog - Ilia Alshanetsky
Ilia Alshanetsky extends Grossman's JavaScript-free port scan by serving multipart/x-mixed-replace from PHP, so each segment replaces the page with a new <link> probe plus a beacon <img>, giving a 3-second timeout per…
Nikon magazine hit with security breach Dawn Kawamoto
CNET's Dawn Kawamoto reports, via the InfoSec News list, that Nikon World magazine's online registration site exposed 3,235 subscribers' addresses, contact details and credit card data for nine hours. Nine new…
PayPal Security Flaw allows Identity Theft Paul Mutton
Netcraft reports fraudsters actively exploiting XSS on paypal.com itself. The victim reaches a genuine PayPal URL under a valid 256-bit SSL certificate, but injected content claims the account is disabled and redirects…
Poking new holes with Flash Crossdomain Policy Files Stefan Esser
Flash's loadPolicyFile accepts any URL, follows in-domain redirects, and needs no well-formed XML, so a crossdomain policy can be smuggled into any response an attacker influences — an uploaded avatar, a GIF carrying…
Response Splitting Filter Evasion ha.ckers.org
A redirector stripped any injection containing a forward slash, blocking both closing HTML tags and the usual Content-Type: text/html header needed to escalate response splitting into HTML injection. Shortening the…
Self-contained XSS Attacks pdp
A data: URI carries a whole HTML document, so XSS needs no vulnerable echo point: the payload is the URL. pdp shows base64 data: links executing script in Firefox and Opera, bypassing mail filters, XSS filters and…
SQL Injections by Truncation Bala Neerumalla
Bala Neerumalla's Black Hat USA 2006 deck on SQL truncation. Where a column is shorter than the input a form accepts, an over-long value is silently cut to length, so a crafted registration can collide with an existing…
Stealing Search Engine Queries with JavaScript spidynamics.com
SPI Labs research brief describing JavaScript plus CSS that detects which search queries a visitor has previously run on arbitrary search engines, by testing the visited state of constructed result URLs. Any page, or…
Stealing User Information Via Automatic Form Filling ha.ckers.org
Browser and toolbar autofill features populate fields by name without asking the user, so an XSS payload can inject a hidden form carrying common field names and harvest whatever autofill supplies: name, address, card…
Subverting AJAX Stefano Di Paola and Giorgio Fedon
Di Paola and Fedon's 23C3 paper on attacking AJAX applications. Prototype Hijacking overrides the JavaScript prototypes an application relies on, so injected code silently intercepts and rewrites every XMLHttpRequest…
The Attack of the TINY URLs pdp
pdp turns TinyURL into remote storage for a self-contained AJAX worm: split the payload, base64 each segment, shrink every segment and the index with TinyURL, and 26 characters expand back into a large file. Retrieval…
Using CSS to De-Anonymize ha.ckers.org
Applies Grossman's CSS history hack to internal hostnames such as intranet.company.com to identify which organisation a visitor belongs to, defeating network-level anonymisers and referrer stripping. If the history is…
Variable Width Encoding ha.ckers.org
Reports Cheng Peng Su's variable-width encoding filter evasion: a lead byte in the range 192-253 or 255 combines with a following double quote into a single multibyte character, so the quote stops terminating an…
Widespread XSS for Google Search Appliance maluc
maluc's UTF-7 XSS against Google Search Appliance sites, 30 posts all preserved with the eight university and .gov exploit URLs intact. Same live-HTML decode drops <script>alert("XSS")</script> from the opening…
Widespread XSS for Google Search Appliance maluc
A 2007 capture of the same 30-post thread as sla-ckers-org-widespread-xss-google-search-appliance; Phorum renders the whole thread from either URL, so this is a duplicate, not a sibling needing a format word. Title is…
Xanga Hit By Script Worm Matthew Murphy
Matthew Murphy's same-day analysis of the Xanga worm: a DIV whose CSS background url() holds a javascript: URI split across line breaks that IE reassembles, defeating the site's keyword filter, then eval of the DIV's…
XML Intranet Port Scanning sift.com.au
Confirmed pointer page: what is archived is SIFT's publications listing with a 226-word abstract, not the cited XML Intranet Port Scanning paper. The paper is linked only, as a now-broken download icon to…
XSS Fragmentation Attacks kuza55
A sla.ckers forum thread developing XSS fragmentation: placing normally harmless code, such as a bare onload="alert('XSS');" attribute with no tag of its own, where a later unclosed tag adopts it as an attribute, so no…