Top 10 Web Hacking Techniques

2008

The 2008 Top 10 Web Hacking Techniques: all 10 winners and 82 nominated and collected techniques, each with its researcher, summary and preserved source.

82 records · 10 in the top ten · open this year in the interactive archive

The top ten

#1 GIFAR Christopher
A short writeup of the GIFAR, the GIF-plus-JAR polyglot Billy Rios and Nathan McFeters showed at Black Hat 2008. Because GIF headers sit at the front of a file and ZIP central directories at the end, one file passes as…
#2 Breaking Google Gears' Cross-Origin Communication Model Yair Amit
Google Gears' worker loader ignored the Content-Type of the files it loaded, so any user-uploadable file, even one served as innocent.jpg, could be loaded as a cross-origin Gears worker running in the hosting site's…
#3 Safari Carpet Bomb Nitesh Dhanjani
Safari cannot be configured to ask before downloading, so a page of iframes pointed at a CGI returning an unknown content-type such as blah/blah litters the Windows desktop or ~/Downloads with attacker files. Dhanjani…
#4 Clickjacking / Videojacking Jeremiah Grossman
The disclosure that clickjacking plus Adobe Flash turns any machine with a webcam or microphone into a remote surveillance device on one click, and that clickjacking the Flash Global Security Settings panel makes it…
#5 A different Opera Aviv Raff
opera:config is the one Opera local resource that can reach local files and rewrite browser settings, including the external mail handler — set that and any mailto: navigation runs arbitrary code. Opera 9.62 patched a…
#6 Abusing HTML 5 Structured Client-side Storage Alberto Trivero
Session, global, local and Database Storage have no HTTPOnly, no path scoping and no port scoping, so one XSS anywhere on a host reads all of it. Enumerate keys with for(i in sessionStorage), find databases by testing…
#7 Cross-domain leaks of site logins via Authenticated CSS Chris Evans
Detects whether a visitor is logged in to a third-party site by loading that site's stylesheet with <link> and reading a property back with getComputedStyle. MySpace serves margin-bottom:3px to logged-in users and 0px…
#8 Tunneling tcp over http over sql-injection sensepost.com
#9 ActiveX Repurposing dean de beer
JavaScript uses the RDS.DataSpace ActiveX control to instantiate XMLHTTP, ADODB.Stream and Shell.Application, download an executable, save it to disk and run it. The author reports different IE6 and IE7 prompting…
#10 Flash Parameter Injection Yuval Baror, Ayal Yogev and Adi Sharabani
Announces Flash Parameter Injection, presented by Adi Sharabani and Ayal Yogev at OWASP NYC AppSec 2008, and links the presentation and advisory/whitepaper.

Also collected

Abusing PHP Sockets Rodrigo Marcos
PHP's socket_set_option with SO_REUSEADDR binds a listener to a port Apache already holds: Apache listens on 0.0.0.0 and is not built with SO_EXCLUSIVEADDRUSE, and Windows gives the specific local interface precedence…
Arbitrary TCP over uploaded pages sensepost.com
reDuh builds a TCP circuit out of ordinary HTTP requests: upload reDuh.jsp (PHP and ASPX ports exist) to a web server, run reDuhClient locally, and [createTunnel]1234:host:3389 forwards a local port to anything the web…
Automatic Generation of XSS and SQL Injection Attacks with Goal-Directed Model Checking Michael Martin and Monica S. Lam
QED compiles a PQL taint specification into a static analysis that prunes candidate URL sequences, then hands the survivors to the Java PathFinder model checker, which returns a concrete multi-request attack plus an…
Black Ops 2008: It's The End Of The Cache As We Know It Dan Kaminsky
Kaminsky's Black Hat Japan keynote on the 2008 DNS cache-poisoning bug: birthday-race spoofing across sibling names, plus in-bailiwick NS/CNAME referrals that let a won race for 83.foo.com steal www.foo.com. Extends it…
Browser's Ghost Busters sirdarckcat
Reverse-engineers Manuel Caballero's then-undisclosed 'A Resident in My Domain' bug. document.getElementsByTagName is blocked cross-domain but window.frames[] is not, so a window reference from open() or window.opener…
Building Subversive File Sharing With Client Side Applications Robert Hansen
Sketches a file-sharing network built from unwitting visitors: Alice holds an idle browser on her page, feeds it chunks of a file, and JavaScript writes them into iframes that POST cross-site to Bob's and Zack's…
Bypassing URL Authentication and Authorization with HTTP Verb Tampering Arshan Dabirsiaghi
Verb-based access control fails open: rules that list GET and POST permit everything else. A HEAD request reaches the GET handler unauthenticated, and Java EE and PHP also run arbitrary verbs such as JEFF against JSPs…
Code Execution via XSS MustLive
Saved XSS turned into code execution. Inject ?--><script>c=new/**/ActiveXObject('WScript.Shell');c.Run('calc.exe');</script> so it lands in a page the user saves to disk; reopened, the file runs in the Local Machine…
Collecting Lots of Free 'Micro-Deposits' Kevin Poulsen
Threat Level report on Michael Largent, indicted for scripting 58,000 brokerage accounts at E-trade and Schwab under cartoon-character names, then harvesting the two-cent-to-one-dollar micro-deposits both firms send to…
Common localhost dns misconfiguration can lead to "same site" scripting Tavis Ormandy
Dropping the trailing dot from a 'localhost IN A 127.0.0.1' zone record makes localhost.example.com resolve to loopback, so anything listening on a shared machine receives that domain's cookies. Ormandy names it…
Cookie forcing Chris Evans
Explains how an attacker can force cookie values into an HTTPS application despite Secure-cookie confidentiality. The post maps untrusted cookie contents to DOM or JSON-evaluation injection, double-submit CSRF failures…
Cookie Path Traversal kuza55
An encoded backslash in the request path, as in /en/us/test/..%5Cdefault.aspx, is a directory delimiter to IIS but not to the browser, so a cookie scoped to a path it should never reach gets sent anyway. Works in the…
CookieMonster: Fully Automated Active HTTPS Cookie Hijacking Mike Perry
Project page for Cookiemonster, the Python proof-of-concept implementing the automated HTTPS cookie hijack: it tracks the HTTPS domains each local client visits, injects HTML elements for them into later HTTP responses…
Creating a Rogue CA Certificate Alexander Sotirov, Marc Stevens, Jacob Appelbaum, Arjen Lenstra, David Molnar, Dag Arne Osvik and Benne de Weger
Announcement of the 25C3 result in which an MD5 chosen-prefix collision was used against a commercial CA still signing with MD5, producing a rogue intermediate CA certificate trusted by every common browser. It can…
Cross Environment Hopping Yair Amit
An XSS flaw in one localhost web server reaches every other service on the machine, because same-origin policy does not separate ports on localhost for IE's ActiveX XMLHTTP objects. Firefox extends it further through…
Cross-site File Upload Attacks pdp
pdp shows that Flash defeats the assumption that file uploads cannot be forged cross-site. A compiled MXML application builds a URLRequest with a hand-written multipart/form-data body, including the filename sub-field…
CSRF on Novell GroupWise WebAccess Adrian Pastor
Novell GroupWise WebAccess 6.5x through 8.0 tokenises nothing, so any authenticated request can be forged from a page, a link, or the HTML body of a mail the victim merely opens. The advisory's point is persistence…
CSRFing the uTorrent plugin Rob
Chained CSRFs against uTorrent's local Web UI: setsetting points 'move completed downloads to' at the All Users Startup folder, then add-url makes uTorrent fetch an attacker torrent, so the payload lands where Windows…
CUPS Detection Jeremiah Grossman
CUPS listens on localhost:631 over HTTP and is not covered by Firefox port banning, so a remote page can probe for it. Grossman ties the CVE-2008-0047 CGI heap overflow to drive-by reach and gives a detection probe: an…
DHCP Script Injection usefulfor.com
A DHCPREQUEST whose Options Hostname field carries HTML or script is stored by the DHCP server and executed when an administrator opens the active-leases page of a router's web admin interface. The injected iframe loads…
Dialog Spoofing - Firefox Basic Authentication Aviv Raff
Firefox 2.0.0.11 renders the WWW-Authenticate Basic realm value in its authentication dialog and stops at the last double quote, but does not sanitise single quotes or spaces. A crafted realm therefore makes the prompt…
Diminutive Worm, 161 byte Web Worm ha.ckers.org
RSnake wraps up the Diminutive Worm Contest, won jointly by Giorgio Maone and Sirdarckcat with a 161-byte cross-site scripting worm; cross-browser and Apache-interoperability rules narrowed the field. Announces a…
Exploitable Redirects on the Web: Identification, Prevalence, and Defense Craig A. Shue, Andrew J. Kalafut and Minaxi Gupta
A WOOT '08 measurement of open redirects: heuristics identify redirect links, and which of them carry the destination in the URL, without contacting the destination. Across 2.5 million pages the authors found 557,646…
Exploiting CSRF Protected XSS kuza55
CSRF tokens do not make an XSS unexploitable, because nothing forces the victim to use their own session. Make the browser send the attacker's cookie, matching token and payload at once, via Flash addRequestHeader after…
Exploiting Logged Out XSS Vulnerabilities kuza55
Two ways to reach an XSS that only renders when a user is logged out, without waiting for a logout. IE serves uncached responses to XmlHttpRequest from cache, so the flaw can read billing pages. And Flash's…
Exploiting XSS vulnerabilities on cookies sirdarckcat
Exploits an XSS that only reflects a cookie value, where nothing the browser normally sends would carry the attacker's cookie. A Flash movie's LoadVars.addRequestHeader sets a Cookie header on a cross-domain POST…
File Download Injection Jeff Williams
Aspect Security whitepaper on injecting a whole file download through a Content-Disposition header. Two CRLFs in a download script's filename parameter terminate the headers and let the attacker supply arbitrary file…
Firefox 2 and WebKit nightly cross-domain image theft Chris Evans
Firefox 2 before 2.0.0.18 and WebKit nightlies could be fooled about an image's origin by loading it via a same-origin URL that 302-redirects to the remote target. The browser treats the result as local, so canvas…
Firefox cross-domain information theft (simple text strings, some CSV) Chris Evans
Firefox's window.onerror reports JavaScript error text, and some messages quote the content that failed to parse. Sourcing a remote non-script resource and reading 'blah is not defined' steals one word cross-domain…
Firefox XML injection into parse of remote XML Chris Evans
Firefox's E4X support makes inline XML valid JavaScript, so a remote site can pull a victim's private XML feed in via <script src>. An XML injection bug in E4X parsing lets `default xml namespace = '\''` break the parse…
Flash clipboard Hijack David Lenoe
Adobe PSIRT's short notice that Flash Player's clipboard interaction will change to blunt the 2008 clipboard-hijacking attacks, with the mitigation shipping in the final Flash Player 10 release. Points at the Flash…
Flash Internet Explorer security model bug Guy A
Loading a bare .swf in IE makes the browser build a wrapper page via res://mshtml.dll/objectembed_neutral.js, with allowscriptaccess defaulting to samedomain, so the SWF can script that page through ExternalInterface…
ForceHTTPS: Protecting High-Security Web Sites from Network Attacks Collin Jackson and Adam Barth
Jackson and Barth's WWW2008 proposal, the direct ancestor of HSTS. A site sets a ForceHTTPS cookie over clean TLS and the browser then upgrades HTTP to HTTPS, treats certificate errors as fatal, and refuses mixed…
Frame Injection Fun pagvac
pagvac separates frame injection from XSS: an unfiltered URL parameter feeding a frameset or iframe needs no angle brackets, so HTML and script filters never fire, and an absolute URL loads attacker content while the…
Free MacWorld Platinum Pass? Yes in 2008! Kurt Grutzmacher
Kurt Grutzmacher's second year of getting a $1,895 MacWorld Platinum Pass free. IDG validated discount codes client-side by shipping 1,341 MD5 hashes to the browser; harvesting them from the registration page and…
Hacking Intranets Through Web Interfaces Robert Hansen
Uses the web server, not the browser, as the way into an intranet: any feature that fetches a URL server-side (avatar-by-URL, RSS aggregation) will reach RFC1918 space. Default images such as Apache's /icons/ and…
HTML/CSS Injections - Primitive Malicious Code Arshan Dabirsiaghi
Three ways to attack with pure HTML and CSS after all JavaScript is stripped: an absolutely positioned div overlaying the page with a fake login form; div hijacking, where reusing a legitimate id repaints the real…
HTTP Proxies Bypass Firewalls ha.ckers.org
An open HTTP proxy does not have to be pointed at the internet. Aim it inward at RFC1918 space and it becomes a foothold for scanning and exploiting the internal network behind the firewall, including the firewall…
I used to know what you watched, on YouTube (CSRF + Crossdomain.xml) Jeremiah Grossman
YouTube's crossdomain.xml trusted *.google.com, so a SWF hosted anywhere on google.com could act as the victim on YouTube. Grossman mailed a SWF to a Gmail account he controlled, then used the Stanford…
IE "Print Table of Links" Cross-Zone Scripting Vulnerability Aviv Raff
IE's "Print Table of Links" appendix copies each link's URL into the generated print HTML without validation, and that generating script runs in the Local Machine Zone. A crafted href planted in a blog comment or wiki —…
Increased DNS Forgery Resistance Through 0x20-Bit Encoding David Dagon, Manos Antonakakis, Paul Vixie, Tatuya Jinmei and Wenke Lee
Randomise the case of each letter in a DNS query name: authority servers copy the question section back bit-for-bit, so the case pattern becomes a free extra token an off-path poisoner must guess alongside the ID and…
JavaScript Code Flow Manipulation Ory Segal and Adi Sharabani
CVE-2008-2640: every Flex 3 build ships history/historyFrame.html, which does document.write on document.location.href. Direct exploitation fails because processUrl first calls parent.BrowserHistory. The fix is…
JavaScript Global Namespace Pollution pdp
pdp sketches detecting JavaScript malware by diffing the global object before and after untrusted input, with a small recursive walker, and then the evasions: wrap the payload in a closure that touches neither window…
Join a Religion Via CSRF ha.ckers.org
A joke turned threat model: a private religion whose only joining requirement is indicating assent could be joined by hundreds of thousands of people through image-triggered cross-site request forgery to a form on…
JSON Hijacking with UTF-7 Yosuke Hasegawa
POC2008 deck surveying attacks that live in character encoding: overlong UTF-8, many-to-one Unicode conversion and post-validation normalisation reopening path traversal, invalid and lead bytes bypassing filters…
Lateral SQL Injection David Litchfield
Shows how Oracle session settings can influence supposedly safe DATE values embedded in dynamic SQL. Changing NLS_DATE_FORMAT introduces SQL through date parameters or SYSDATE, reaching procedures with no direct user…
Local DoS on CUPS to a remote exploit via specially-crafted webpage Adrian Pastor
pagvac uses the browser as a bridge to a localhost-only daemon: cupsd runs as root on default Ubuntu Desktop and listens on 127.0.0.1:631, and a web page writing 101 image tags at its add-rss-subscription endpoint…
Multi-pass filters bypass websecurity.com.ua
Space-hack technique against multi-pass filters that scan for XSS keywords first and strip whitespace afterwards. Writing "e xpression" hides the CSS expression keyword and "o nLoad" hides the handler; the second pass…
MySQL and SQL Column Truncation Vulnerabilities Stefan Esser
MySQL silently truncates an over-long string to the column width and, in its default non-strict mode, compares trailing spaces as equal. Registering a username padded with spaces past the limit therefore creates a…
Navigation Hijacking (Frame/Tab Injection Attacks) pdp
pdp on navigation hijacking: a page opens a window to a trusted site, polls it for login completion using script tags and error-code offsets, then rewrites w.location once the user has authenticated, dropping a…
On Race Vulnerabilities in Web Applications Roberto Paleari, Davide Marrone, Danilo Bruschi and Mattia Monga
DIMVA 2008 paper on race conditions in web applications, arising because programmers treat scripts as sequential while the server runs many instances against one shared database. It gives a dynamic detection method that…
Persistent SQL Injection MustLive
MustLive's advisory on the WordPress CapCC captcha plugin 1.0. CSRF on the plugin's option page drives an SQL injection whose payload persists in the captcha table and re-fires on every page view — self-inflicted DoS —…
Pulling system32 out over blind SQL Injection Shreeraj Shah
A route out of a blind SQL injection where xp_cmdshell also gives no feedback, no outbound traffic is allowed and the webroot path is unknown. Echo a VBS file line by line through xp_cmdshell, run it with cscript, and…
Racing to downgrade users to cookie-less authentication kuza55
Applications that fall back to URL-borne session tokens decide by setting a probe cookie and checking it comes back. Saturating Firefox's per-domain cookie jar from 20 iframed subdomains evicts that probe in about…
Recursive File Include DoS websecurity.com.ua
Recursive File Include: a local file include whose parameter propagates into every included file, so page.php?include=page.php makes the application include itself without bound and exhausts the server. The author's own…
Redirector's hell websecurity.com.ua
Looped DoS built from two URL shorteners aimed at each other: a TinyURL custom alias resolves to an ElfURL link that resolves back, so any client following either address redirects forever. Demonstrated with live…
Res Timing File Enumeration Without JavaScript in IE7.0 ha.ckers.org
Combines David Byrne's res:// timing trick with Jeremiah Grossman's META-refresh blocking via link tags to enumerate local files in Internet Explorer 7 with no JavaScript at all. Present and absent files differ by five…
Robust Defenses for Cross-Site Request Forgery (Login CSRF & the Origin header) Adam Barth, Collin Jackson and John C. Mitchell
CCS 2008 paper introducing login CSRF, where a forged request to the login form signs the victim in as the attacker so their activity accrues to the attacker's account. It dissects secret-token, Referer and…
Safari pwns Internet Explorer Aviv Raff
Chains Nitesh Dhanjani's Safari-for-Windows Carpet Bomb — silent drive-by download of arbitrary files to the desktop, which Apple declined to treat as a bug — with an older unpatched IE file-loading flaw to reach code…
Same Origin Bypassing Using Image Dimensions Arshan Dabirsiaghi
A covert channel built entirely from image tags, for a future browser sandbox that blocks dynamically inserted script, link and iframe elements. The evil server encodes payload bytes as the height and width of returned…
Securing Frame Communication in Browsers (postMessage target-origin security) Adam Barth, Collin Jackson and John C. Mitchell
Shows permissive and window frame-navigation policies allow cross-window and gadget-hijacking attacks (Google AdSense login, iGoogle), and gets the descendant policy shipped in Firefox 3 and Safari. Then breaks both…
Session Extending MustLive
A stolen cookie is only useful while its session lives. The MustLive Session Extending Method keeps a hijacked session alive indefinitely by replaying periodic requests carrying the stolen cookie at an interval shorter…
Skype cross-zone scripting vulnerability Aviv Raff
Skype renders its internal HTML dialogs — "Send money via PayPal", "Add video to chat" — in an embedded IE web control running in an unlocked Local Zone, so any script injected into one of those pages executes code on…
Smuggling SMTP through open HTTP proxies Mike Zusman
An open HTTP proxy in a web app can be aimed at port 25, where the SMTP server reads each CRLF-terminated HTTP header as a command. IIS SMTP and sendmail logs show an injected QUIT executing. Full hijack is blocked only…
SNMP XSS Attack Adrian Pastor
ProCheckUp's ZyXEL Prestige gateway research. SNMP write is on by default with community string 'public', so snmpset into system.sysName.0 stores a 32-character persistent XSS that fires in the admin web interface. Also…
Social Networks Evil Twin Attacks pdp
An evil twin attack moved from rogue WiFi access points to professional social networks. Registering as a plausible security expert at a known employer, the example being John Dawson of HSBC, lets an impostor work the…
SQL Smuggling Avi Douglen
Defines SQL Smuggling: injection that survives validation because the database reinterprets input after the check. The new vector is Unicode homoglyph best-fit folding — U+02BC (%CA%BC) passes a quote filter or WAF…
SSID Script Injection usefulfor.com
A rogue access point beaconing a malicious SSID gets its payload rendered and executed in the neighbouring-networks scan page of another AP's web admin interface. Two fake APs beat the 32-character SSID limit by joining…
Stealing Basic Auth with Persistent XSS Mike Zusman
Steals HTTP Basic credentials without cross-site tracing: many PHP installs leave a phpinfo() page that prints PHP_AUTH_USER and PHP_AUTH_PW. An XSS on the same host fetches that page with XMLHTTP, splits out the…
Total surveillance made easy with VoIP phone .mario
.mario takes apart the Snom 32x VoIP phone's web interface: CSRF places calls, a persistent XSS in the address book (the number field is unencoded) runs a worm through XHR, call logs are stealable, and the killer step…
UPnP Hacking via Flash Adrian Pastor and pdp
pdp and Adrian Pastor drop the XSS requirement from UPnP router attacks. Flash's URLRequest can set POST content type application/xml and add a SOAPAction header, so a plain malicious SWF sends a UPnP SOAP control…
Using your browser URL history to estimate gender Mike
An ad technologist adapts the CSS :visited history-sniffing trick to profile visitors rather than to show share buttons. The script tests the Quantcast top 10,000 sites for visited styling, then multiplies each hit…