Top 10 Web Hacking Techniques

2007

The 2007 Top 10 Web Hacking Techniques: all 10 winners and 96 nominated and collected techniques, each with its researcher, summary and preserved source.

96 records · 10 in the top ten · open this year in the interactive archive

The top ten

#1 XSS Vulnerabilities in Common Shockwave Flash Files Rich Cannings
Web authoring tools stamp the same vulnerable ActionScript into every SWF they generate, so hundreds of thousands of sites inherit XSS. Dreamweaver's skinName, Adobe Connect's baseurl, FusionCharts' dataURL, Camtasia's…
#2 Universal XSS in Adobe's Acrobat Reader Plugin Stefano Di Paola
Adobe's Acrobat Reader browser plugin accepts #FDF, #XML and #XFDF fragments on any PDF URL, so a link to any site's own PDF makes the plugin issue attacker-chosen requests. That yields universal CSRF across Firefox, IE…
#3 Web Mayhem: Firefox's JAR: Protocol issues pdp
Firefox's jar: protocol runs content from inside an archive under the origin of the archive's URL, so any site accepting ZIP-derived uploads (odt, docx, attachments) becomes vulnerable to persistent XSS. pdp also notes…
#4 Cross-Site Printing (Printer Spamming) Aaron Weaver
A web page can print on a network printer inside the visitor's LAN. Printers accept raw jobs on port 9100, and a multipart/form-data POST from a hidden iframe reaches them unencoded, so a form or an image tag aimed at…
#5 Hiding JS in Valid Images RSnake
Matteo Carli's GIF that is also valid JavaScript: an =1 after the GIF header stops the magic bytes parsing as an undefined variable, and a long comment swallows the binary. The file passes as an image on hosts like…
#6 Firefoxurl URI Handler Flaw Billy (BK) Rios
Installing Firefox registers the firefoxurl: handler in the Windows registry, and IE passes unsanitised parameters to it, letting a web page run arbitrary commands. Rios argues the fault belongs to both products and…
#7 Anti-DNS Pinning ( DNS Rebinding ) : Online Demonstration Kanatoko
Kanatoko's live anti-DNS-pinning demo: a browser is made to resolve the attacker's hostname to a private RFC1918 address, read the intranet page and post it back to jumperz.net. Lists eight tested IE/Firefox/Opera…
#8 Google GMail E-mail Hijack Technique pdp
A multipart/form-data CSRF POST to a GMail alternative interface silently adds a filter to the victim's account that forwards every message with an attachment to the attacker. The backdoor survives the underlying bug…
#9 PDF XSS Can Compromise Your Machine ha.ckers.org
Adobe Reader 7.0 ships ENUtxt.pdf at a fixed path, so a file:/// URL to it with #blah=javascript:alert() executes script from the local zone in Firefox and Opera. Turns the remote PDF-XSS class into a local one needing…
#10 Browser Port Scanning without JavaScript Jeremiah Grossman
Intranet port scanning with HTML alone. A link rel=stylesheet pointing at an internal address stalls Firefox's parser until the request resolves; a following img src to the attacker's timing script reports how long that…

Also collected

(Non-Persistent) Untraceable XSS Attacks kuza55
Setting document.domain to the bare TLD ('com') lets a reflected XSS payload hold no attack logic at all: the injected script only calls back into the attacker's frame, and a meta refresh strips the Referer. Server logs…
0DAY: QuickTime pwns Firefox pdp
A QuickTime media-link (QTL) file whose qtnext attribute carries a javascript: URI executes in Firefox, and with the -chrome switch runs with chrome privileges. pdp shows the payload launching calc.exe via nsILocalFile…
A Taxonomy of Attacks against XML Digital Signatures & Encryption Brad Hill
Organizes attacks against XML signatures and encryption by processing stage, including key trust, canonicalization, reference resolution and signature verification. Examples connect wrapping, transforms and execution…
Additional Image Bypass on Windows ha.ckers.org
Michael Schramm's finding, relayed by ha.ckers.org: NTFS alternate data streams let a filename carry "::$DATA", which Windows strips when the file is written. Appending it to "foobar.php" slipped past FCKeditor's…
All Your Google Docs are Belong To US... Billy Rios
A Google Docs session-management flaw: GET /Dialogs/EmailDocument never checked whether the caller owned the requested DocID, and a follow-up POST to /MiscCommands with a swapped docid emailed any user's document to an…
An Analysis of Browser Domain-Isolation Bugs and a Light-Weight Transparent Defense Mechanism Shuo Chen, David Ross and Yi-Min Wang
Microsoft Research landing page for the CCS 2007 script-accenting paper. Carries the abstract only: browser domain isolation is too complex to audit exhaustively, so give each origin a random 'accent' key that scripts…
Anti-DNS Pinning ( DNS Rebinding ) + Socket in FLASH Kanatoko
Kanatoko shows Flash Player 9's ActionScript 3 Socket class combined with DNS rebinding hands an attacker a raw TCP socket inside the victim's browser: intranet port scanning, shellcode delivery, spam, proxying and…
BK for Mayor of Oak Tree View xssniper
Following a link shown in Google's own Google Docs promo video, Rios opened the 'Article For Oak Tree View' demo document, then clicked Edit this page, entered his own credentials and gained full write access to a…
Bugs in the Browser: Firefox's DATA URL Scheme Vulnerability pdp
Firefox gives a data: URL the origin of the page that opened it, exactly as it does javascript:, so a base64 data:text/html link posted to a site that only blacklists javascript: yields XSS in that site's origin. pdp…
Bursting Performances in Blind SQL Injection - Take 2 (Bandwidth) Stefano Di Paola
Stefano Di Paola and Giorgio Fedon save bandwidth in blind SQL injection by reading response size instead of the body. Apache refuses Content-Length on HEAD but answers Range: bytes=-1 with a Content-Range that reveals…
Bypass port blocking in Firefox, Opera and Konqueror. mark
FTP clients follow the IP address a server returns in its PASV reply, so a malicious FTP server can redirect a browser's data connection to any host and port. This defeats Firefox port banning, extending JavaScript port…
CaffeineMonkey: Automated Collection, Detection and Analysis of Malicious JavaScript Ben Feinstein and Daniel Peck
Detecting malicious JavaScript by executing it rather than matching bytes. Heritrix crawls candidate pages into a central database and an instrumented SpiderMonkey runs each script, logging method calls so obfuscation…
Client-side SQL Injection Attacks pdp
Google Gears puts a SQLite relational store in the browser, so unsanitised input in client-side queries makes SQL injection a client-side problem: attackers can dump, alter or destroy local tables, and echo injected…
Code Execution Through Filenames in Uploads ha.ckers.org
Uploading a file whose NAME is a shell command turns a sloppy reader into code execution. RSnake creates a file called "|ls -al"; Perl's two-argument open treats the leading pipe as a command, so the script runs the…
Content-Disposition Hacking pagvac
A server returning Content-Disposition: attachment turns a reflected HTML injection into cross-context scripting: the victim is prompted to open the injected file, which then runs in the local zone. pagvac gives a full…
Cross Domain Basic Auth Phishing Tactics ha.ckers.org
Basic-auth phishing needs no clicked link: an embedded image on a protected domain pops the credential dialog on the page you want to phish. Alex supplies two dialog-spoofing bugs that hide the real host: Opera…
Cross-Browser Proxy Unmasking ma1
ma1 (Giorgio Maone) answers RSnake's LiveConnect Tor deanonymiser with a plugin-agnostic version: Flash's XMLSocket ignores the browser's proxy settings and connects straight to a Perl server on port 9999 that echoes…
Detecting Default Browser in IE ha.ckers.org
A snippet from the handle unsticky uses IE's mimeType reporting to identify the visitor's DEFAULT browser, not merely the one in use, detecting Firefox and Opera reliably. Netscape in IE mode is a known false positive…
Detecting users via Authenticated Redirects kuza55
Redirects that only fire for logged-in users leak session state without needing an open redirect: append a random token to the login-return URL, then use the CSS :visited history hack to see whether the browser followed…
Effects of DNS Rebinding On IE's Trust Zones ha.ckers.org
An email from natron chaining DNS rebinding into NTLM theft. Windows XP's NBNS transaction IDs start at 0x8000 and step by one to four, so a Java applet can spam predictable spoofed responses; Active Directory DNS also…
Embeding SVG That Contains XSS Using Base64 Encoding in Firefox ha.ckers.org
nEUrOO's vector: JavaScript embedded in an SVG document, the SVG base64-encoded into a data URI, and the whole thing loaded through an embed tag, which Firefox executes with no plugin installed and no user interaction…
Enumerate Windows Users In JS ha.ckers.org
Sergey Vzloman's proof of concept enumerates local Windows account names from JavaScript by probing Firefox resource:// URLs; the demo tries four accounts and is deliberately noisy. Dan Veditz notes the resource://…
Exaggerating Timing Attack Results Via GET Flooding ha.ckers.org
Prompted by a forum post from Super-Friez, RSnake proposes flooding GET requests not for bandwidth but to load the server, ideally against a URL that hits the database, so a timing attack's signal grows. A difference…
Exploiting Second Life Independent Security Evaluators
Charlie Miller and Dino Dai Zovi exploit an unpatched QuickTime RTSP flaw through Second Life, which renders embedded media with QuickTime. Walking an avatar onto attacker-owned land with video enabled surrenders the…
Exposing Private Information by Timing Web Applications Andrew Bortz, Dan Boneh and Palash Nandy
Web response times leak private state. Direct timing distinguishes valid from invalid usernames at login pages and counts hidden photo albums behind access control, accurate above 95% from ten samples.
Favorites Gone Wild Yair Amit
Yair Amit finds an IE Favorite stored at the root of the tree can be named as a URL, and typing that URL into the address bar then loads the Favorite's target instead. A single planted Favorite gives persistent phishing…
Firefox File Handling Woes xssniper
MFSA2007-27 patched the demonstrations but not the underlying Windows Shell file-type handling. Rios and McFeters show a common handler can still be driven with a single unexpected URI passed through mailto, nntp, news…
Firefox Header Redirection JavaScript Execution ha.ckers.org
A timed redirect delivered in an HTTP Refresh header can point at a JavaScript function instead of a URL, and Firefox executes it; IE and Opera did not. RSnake rates it useful mainly where response splitting leaves…
Firefox Popup Blocker Allows Reading Arbitrary Local Files Michal Zalewski
Zalewski's chain for reading local files from the web in Firefox 1.5.0.9. Manually unblocking a popup skips the URL permission check, and file:// documents are mutually same-origin, so a planted local HTML file can…
Flash Cookie Object Tracking pdp
pdp reimplements Thom Shannon's cross-browser tracking demo by releasing the ActionScript for a Flash SharedObject cookie manager, compiled with MTASC. Because Flash local shared objects are stored outside the browser…
Google Adsense CSRF hole Gareth Heyes
Google Adsense had no CSRF protection on parts of its account area, so a remote page could act as the logged-in user. The author's proof of concept logs the victim in, browses Adsense as them, and finally posts an…
Google Docs puts Google Users at Risk xssniper
Google Docs let any user upload and publish a crossdomain.xml file served from google.com. A Flash object calling System.security.loadPolicyFile() at that uploaded path then gained cross-domain read access to the…
Google Urchin password theft madness pagvac
Google Urchin 5's session.cgi login page takes an unfiltered parameter, giving reflected XSS on 5.6.00r2 through 5.7.03. pagvac shows it is worth more than an alert box: rewrite the form action, or exploit the browser's…
Hacking Intranets Via Brute Force ha.ckers.org
Scrapes the Alexa 500 for intranet.* and internal.* hostnames and finds 162 live split-horizon DNS entries exposing internal IPs. Because intranet logins are the NT domain names that match public email addresses, the…
Hacking without 0days: Drive-by Java pdp
A cryptographically signed Java applet gets full desktop privileges from the browser once the user clicks through one dialog, with no vulnerability involved. pdp argues the applet name and certificate CN can be forged…
Heap Feng Shui in JavaScript Alexander Sotirov
Alexander Sotirov's method for putting the Windows heap into a chosen state from JavaScript: BSTR string allocation, CollectGarbage(), and a plunger that flushes the OLEAUT32 cache so every alloc and free reaches the…
HScan Redux pdp
A short disclosure of a Firefox browser-history leak distinct from Grossman's CSS visited-link hack: it reveals which URLs were visited during the current browser session. pdp notes it can profile browsing habits…
HTTP Response Splitting and Data: URI scheme in Firefox Stefano Di Paola
Stefano Di Paola chains HTTP response splitting into a data: URI XSS on Firefox. A redirector vulnerable to splitting is made to emit a Refresh header pointing at data:text/html with script in it, and Firefox executes…
IE 7 and Firefox Browsers Digest Authentication Request Splitting Stefano Di Paola
Stefano Di Paola's advisory on Digest authentication request splitting in IE 7, Firefox 2.0.0.3 and Safari. A CRLF or %0d%0a embedded in the username of a URL, an img src, a redirect or an XMLHttpRequest open() call…
IE Sends Local Addresses in Referer Header ha.ckers.org
An IE XML data island fetches a remote URL from a locally saved HTML file and sends the local path as the Referer, leaking the drive location and the Windows username with no JavaScript running. Credited to trev…
IE6.0 Protocol Guessing ha.ckers.org
SirDarckCat's report that IE6 guesses protocols: a four-character prefix before 'script:' resolves to javascript:, three or fewer to vbscript:, so MYscript:msgbox() and somescript:alert() execute. Anti-XSS filters…
IE7.0 Detector ha.ckers.org
Detects IE7 despite a spoofed user agent by loading a res:// image from the anti-phishing filter: it renders in IE7, while Firefox substitutes a broken-image placeholder whose measurable size gives the browser away. A…
Iframe HTTP Ping ha.ckers.org
Firefox fires an iframe's onload only when the load succeeds, while IE fires it always, so chained iframes reveal whether a host and port answer, including behind the firewall. Extends the known JavaScript-include port…
Image Names Gone Bad ha.ckers.org
Uploaded image filenames become XSS vectors where the name is re-emitted into HTML or JavaScript: one breaks out of an img tag with a script element, two more close a quote to land in script context. FreeBSD accepts…
Initiating Probes Against Servers Via Other Servers ha.ckers.org
GRC's port probe scans only the requester's own IP, so RSnake sends the W3C validator to fetch it: the validator becomes the origin and reports the result back. Any GET-driven fetcher can be chained this way, so the…
Injecting the script tag into XML Gareth Heyes
Firefox XML entities can be abused to inject a script tag into XML data. Building on the observation that some Firefox XML entities expose sensitive information readable over XHR, the author shows entities can smuggle a…
Inter Protocol Exploitation ha.ckers.org
RSnake's write-up of Wade Alcorn's Inter Protocol Exploitation paper. A browser can be driven to speak a non-HTTP protocol to an intranet service, and the traffic it carries can be a working buffer overflow…
Internet Archiver Port Scanner ha.ckers.org
WhiteAcid's finding that archive.org fetches any host and port on demand, speaking HTTP at an FTP service and logging the crawler's IP as the source. Response time separates the cases, 6-9s open against 23-25s closed…
ISO-8895-1 Vulnerable in Firefox to Null Injection ha.ckers.org
RSnake reports that ISO-8859-1 pages, which he had recommended after the UTF-8 and US-ASCII issues, also let null bytes through in Firefox and break naive filters. The vector is touchy about what precedes it. The code…
Java Applets and DNS Rebinding xs-sniper.com
Java applets are pinned to DNS name rather than IP, so an XSS-cached applet can be DNS-rebound by reloading or launching a new JVM after the record changes. Unlike Flash sockets the applet may reach ports below 1024 and…
Java JAR Attacks and Features pdp
The Java runtime will load a JAR appended to a JPEG, so a file that passes image header checks is still executable byte code, and an applet runs in the sandbox of its codebase host. pdp chains the two: upload the…
JavaScript Hijacking Brian Chess
Brian Chess's 1 April 2007 Secure Coding post naming JavaScript Hijacking. Ajax frameworks returning JavaScript rather than XML can be loaded cross-origin by a script tag, so a malicious site reads confidential array or…
LocalRodeo Detection ha.ckers.org
RSnake shows Martin Johns's LocalRodeo Firefox extension can be fingerprinted: because it blocks connections to localhost, neither onload nor onerror fires on an image pointed there, while the DOM is left unmodified…
Login Detection without JavaScript Jeremiah Grossman
Announces the Black Hat USA 2007 talk arguing that disabling JavaScript no longer protects a browser: intranet hacking, port scanning, history stealing and login detection all have no-script variants.
Microsoft ASP.NET Request Validation Bypass Vulnerability Richard Brain, Jan Fry and Adrian Pastor
ProCheckUp advisory PR07-03 (CVE-2006-7192): ASP.NET request validation is bypassed by a bogus closing tag carrying a CSS expression, with comments splitting the keyword as e/**/xpression. Four payloads cover alert…
MITM attack to overwrite addons in Firefox Christopher Soghoian
Soghoian's disclosure that Google Toolbar, Browser Sync, Yahoo, Facebook, AOL and other commercial Firefox extensions fetched updates over plain HTTP. Anyone controlling DNS or the network silently installs arbitrary…
More Port Scanning - This Time in Flash David Neu and fukami
CVE-2007-4324. ActionScript 3 raises SecurityErrorEvent immediately for a closed TCP port but waits for a reply to its policy-file request on an open one, so the two-second delay reveals port state. A SWF scans any…
Multiple Browsers Cross Domain Charset Inheritance Stefan Esser
Pages without an explicit charset inherit a cross-origin parent frame’s encoding in affected Firefox, IE7 and Opera9 versions. An attacker can frame a target inside a UTF-7 page so encoded input bypasses XSS filters and…
Multiviews Apache, Accept Requests and free listing Stefano Di Paola
Apache MultiViews turns one request into a directory listing. Requesting /index with an unsatisfiable Accept header makes the server answer 406 and enumerate every same-named variant in its Alternates header, exposing…
Noisy Decloaking Methods ha.ckers.org
Ways to make a browser connect straight out to a monitored host and unmask a user behind a proxy or Tor. ftp:// and gopher:// connect quietly; telnet:// and scp:// launch external clients loudly; file:///\\ hits SMB on…
Non-Alpha-Non-Digit 3 ha.ckers.org
Yair Amit's IE parser quirk: a tag and its attribute can be separated by a slash, so <SCRIPT/SRC="..."> needs no whitespace at all. Unlike the earlier non-alpha-non-digit vectors it requires no space, defeating XSS…
Optimizing the number of requests in blind SQL injection Stefano Di Paola
Stefano Di Paola replaces the bisection search in blind SQL injection with a mapping approach: where an id parameter yields many distinguishable responses, a CASE expression maps each character value onto a known page…
overwriting cookies on other people's domains in Firefox. bugzilla.mozilla.org
Mozilla's fix for CVE-2007-0981, where an embedded NUL in a hostname made same-origin and cookie-domain checks compare truncated strings, letting an attacker set or read another origin's cookies and script it. The…
Paper on Hacking Intranets Using Websites (Not Web Browsers) ha.ckers.org
Pointer post announcing RSnake's SecTheory paper on hacking intranets with websites rather than browsers: the web server, not the victim's browser, is coerced into reaching internal hosts, reusing the browser-based…
Passing Malicious PHP Through getimagesize() ha.ckers.org
Michael Schramm's finding, relayed by RSnake: PHP can be embedded in an 8x8 GIF that still passes getimagesize(). Inserting /* before the header's illegal bytes makes PHP skip them, so the file validates as an image and…
Protecting Browsers from Frame Hijacking Attacks Adam Barth and Collin Jackson
Stanford Web Security project index for frame hijacking: descendant-frame navigation lets any page overwrite an unrelated site's login iframe, which carries no address bar or security indicator. The page frames the…
Pure Java™, Pure Evil™ Popups ma1
ma1 (Giorgio Maone) shows a Java applet can open a full-screen window with no chrome, no close button and no way to move or minimise it - popup blockers cannot stop it, and it can paint a fake browser or whole fake…
Read Firefox Settings (PoC) ha.ckers.org
Sergey Vzloman's proof of concept redefines pref() then loads resource://gre/greprefs/security-prefs.js and all.js as scripts, dumping Firefox preference values into JavaScript for browser recon. RSnake added it to Mr…
Recursive Request DoS ha.ckers.org
A self-inflicted denial of service against a server-side URL fetcher. Chaining url= parameters yields only a few iterations, but where the request key is predictable, a counter or timestamp rather than a hash, you can…
Res Timing Attack ha.ckers.org
David Byrne's twist on Billy Rios's res:// local file enumeration: instead of reading the result, time it. The CPU cost of resolving a res:// resource differs sharply by whether the file exists, over double on RSnake's…
Res:// Protocol Local File Enumeration xssniper
Internet Explorer's built-in res:// protocol reads resources out of local DLLs and executables, so a remote page can probe for a given file and report back whether it exists. That enumerates installed software and often…
Scanning internal Lan with PHP remote file opening. Stefano Di Paola
Stefano Di Paola turns a non-inclusion PHP wrapper sink such as getimagesize($_GET['image']) into an internal network scanner. Open and closed ports are told apart by the wording of the failed-to-open-stream warning, or…
Severe XSS in Google and Others due to the JAR protocol issues pdp
Following the jar: origin disclosure, beford showed Google's many open redirects can point a jar: URL at an attacker-hosted archive while keeping google.com as the origin, giving domain-wide XSS across Google services…
Spoofing Firefox protected objects Gareth Heyes
Two ways to spoof document.domain in Firefox, which was assumed protected. Defining a getter with __defineGetter__ overrides the property, and reassigning document.__proto__ and document.prototype to String.__proto__…
Steal History without JavaScript Jeremiah Grossman
Points at RSnake's rework of CSS history stealing that needs no JavaScript: rather than reading link colour from script, the a:visited rule drives a display: property so the browser itself requests a per-link resource…
Stealing Mouse Clicks for Banner Fraud ha.ckers.org
Answering a sla.ckers question, RSnake shows a click cannot be forced into a cross-domain iframe, but the banner can be moved under the cursor instead so the user's own click lands on it. A cursor-following script…
Stealing Pictures with Picasa Nate McFeters
A short release note pointing at the Picasa exploit write-up and its source code. Google's Picasa registers the picasa:// URI in the Windows registry, and a cross-site scripting exposure can drive that registered…
The Ghost in the Browser: Analysis of Web-based Malware Niels Provos, Dean McNamee, Panayiotis Mavrommatis, Ke Wang and Nagendra Modadugu
Google's HotBots '07 measurement of drive-by downloads across billions of crawled pages, with instrumented browsers in VMs confirming exploitation. It names four injection routes onto reputable sites: web server…
The Little Hybrid Web Worm that Could Billy Hoffman and John Terrill
Examines a hybrid web-worm design spanning browser and server execution. The paper explains adaptive target discovery and JavaScript source mutation, distinguishing reversible changes from terminal transformations and…
The ND2DB Attack: Database Content Extraction Using Timing Attacks on the Indexing Algorithms Ariel Futoransky, Damián Saura and Ariel Waissbein
Ordinary INSERT privileges are enough to read indexed private columns. B-tree node splits take measurably longer than plain inserts, so a divide-and-conquer search over the key space recovers neighbouring values…
There's an OAK TREE in my blog!?!?! Billy Rios
Google Docs' publish-to-your-blog feature POSTs to /MiscCommands with a docID the server never checked against the caller. Swapping in another document's docID made Google send that document to the attacker's own…
Transaction Generators: Root Kits for Web Collin Jackson, Dan Boneh and John Mitchell
Jackson, Boneh and Mitchell define the Transaction Generator: malware that steals no credentials but waits inside the browser for the user to authenticate, then issues transactions on the live session. Stronger…
Turn Any Page Into A Greasemonkey Popup ha.ckers.org
Greasemonkey decides a file is a user script from the URL ending in .user.js alone, so appending a ?x.user.js parameter to any page or image forces the install dialog, even when Greasemonkey is disabled. The file lands…
Username Enumeration Timing Attacks (Sensepost) haroon
SensePost's release post for the BlackHat/DefCon 2007 timing work: the squeeza SQL injection tool, which splits exploit from payload and exfiltrates over error messages, DNS or response timing against MS-SQL. It also…
Username Enumeration Vulnerabilities pagvac
pagvac surveys username enumeration from pentest practice, splitting it into bruteforcable and dumpable, and ranks four probes: login errors, password-recovery errors, signup collisions and existing-URI probing. Signup…
Windows DNS Server Cache Poisoning Amit Klein
Windows DNS Server uses a static UDP source port and a structured transaction ID. CNAME chains advance its counter to a state where the next ID has only eight possible values, enabling cache poisoning after a…