Top 10 Web Hacking Techniques

2010

The 2010 Top 10 Web Hacking Techniques: all 10 winners and 89 nominated and collected techniques, each with its researcher, summary and preserved source.

89 records · 10 in the top ten · open this year in the interactive archive

The top ten

#1 padding oracle web attack Juliano Rizzo and Thai Duong
Turns Vaudenay's CBC padding oracle into practical web attacks, with manual and automated methods for finding oracles in real sites. It cracks crypto-based CAPTCHAs and decrypts JSF view states, then introduces CBC-R…
#2 Evercookie Samy Kamkar
Evercookie stores one identifier redundantly across every browser persistence mechanism at once, from HTTP cookies and Flash LSOs to RGB values in force-cached PNGs read back through a canvas, visited-link history…
#3 Hacking Auto-Complete Jeremiah Grossman
Index post releasing the materials for the Black Hat USA 2010 talk on abusing browser form autocomplete and autofill. It links the slide deck and the individual writeups: Safari AutoFill disclosure (CVE-2010-1796)…
#4 Attacking HTTPS with Cache Injection Elie Bursztein, Baptiste Gourdin, Gustav Rydstedt and Dan Boneh
Four attacks on where secure protocols put their data. A web page fingerprints, logs into and XSSes home routers across eight brands to steal the WPA key and geolocate it; cached JavaScript injected on open Wi-Fi…
#5 Bypassing CSRF protections with ClickJacking and HTTP Parameter Pollution lava
A form with no action attribute submits to the current URL, so framing it with attacker parameters already in the query string produces a request carrying the value twice. JSP returns the query-string copy from…
#6 Universal XSS in IE8 Eduardo Vela Nava and David Lindsay
IE8's XSS filter neutralises a detected attack by rewriting one character of the response to a hash. The authors show an attacker can trigger that deliberately with a dummy GET parameter carrying a string already on the…
#7 HTTP POST DoS Kelly Jackson Higgins
Reports Wong Onn Chee and Tom Brennan’s planned OWASP demonstration of slow HTTP POST denial of service: a valid Content-Length header followed by a slowly transmitted body occupies server resources. The researchers…
#8 JavaSnoop Arshan Dabirsiaghi
Testing a Java client without source is hard: decompilation is unreliable and the traffic is often a custom protocol, serialized objects or encrypted rather than proxyable HTTP. JavaSnoop attaches to an already-running…
#9 CSS History Hack In Firefox Without JavaScript for Intranet Portscanning ha.ckers.org
The CSS visited-link history hack is combined with forced browsing to portscan an intranet with JavaScript disabled. Because the visited test is instant and needs no reload, styled links to candidate internal hosts…
#10 Java DSN Rebinding + Java Same IP Policy = The Internet Mayhem Stefano Di Paola
Chains two Java applet flaws the author disclosed to Oracle. DNS rebinding lets an attacker point a controlled host at any IP, and Java's same-IP host access then lets the applet read responses from any host on that IP…

Also collected

A Practical Attack to De-Anonymize Social Network Users Gilbert Wondracek, Thorsten Holz, Engin Kirda and Christopher Kruegel
Group membership on a social network is enough to identify a person. The attack crawls group rosters, then a malicious page uses browser history stealing to learn which group URLs the visitor has seen, and intersects…
A Symbolic Execution Framework for JavaScript Prateek Saxena, Devdatta Akhawe, Steve Hanna, Feng Mao, Stephen McCamant and Dawn Song
Kudzu applies dynamic symbolic execution to client-side JavaScript, covering the event space by automatic GUI exploration and the value space by solving constraints on inputs. Its core is Kaluza, a solver for boolean…
A Twitter DomXss, a wrong fix and something more Stefano Di Paola
Twitter's new site assigned the URL fragment after '#!' straight to window.location, giving DOM XSS via twitter.com/#!javascript:alert(document.domain). Two successive patches failed: String.replace with a string…
An Analysis of Private Browsing Modes in Modern Browsers Gaurav Aggarwal, Elie Bursztein, Collin Jackson and Dan Boneh
Defines threat models for private browsing against both a local observer and the visited site, then measures what the four major browsers actually deliver. It finds inconsistent and often weaker protection than claimed…
An Empirical Study of Privacy-Violating Information Flows in JavaScript Web Applications Dongseok Jang, Ranjit Jhala, Sorin Lerner and Hovav Shacham
A rewriting-based JavaScript information-flow engine was built inside Chrome, injecting and propagating taints in rewritten source rather than in the runtime, then run over the Alexa top 50,000. It confirmed 46 sites…
ASP.NET 'Padding Oracle' Crypto Attack Dennis Fisher
News report on Juliano Rizzo and Thai Duong's padding oracle attack on ASP.NET, presented at Ekoparty 2010. Modified ciphertext in a session cookie makes the framework return distinguishable errors, and enough of those…
Busting Frame Busting: a Study of Clickjacking Vulnerabilities on Popular Sites Gustav Rydstedt, Elie Bursztein, Dan Boneh and Collin Jackson
A survey of frame-busting JavaScript across the Alexa top 500 found only 14% deploy any, and every deployment could be circumvented. The attacks include double framing to make parent.location a security violation…
Chrome and Safari users open to stealth HTML5 AppCache attack lava
Chrome and Safari let any site create an HTML5 Application Cache without prompting, and unlike ordinary cache it can hold a site's root resource. On a hostile Wi-Fi an attacker frames http://mail.google.com/mail/ and…
Chronofeit Phishing James Kettle
Chronofeit combines RSnake's popup and focus URL hijacking with Paul Stone's frame-based login detection: the victim checks a genuine login URL, and the page is swapped for a phishing clone in the interval between that…
Converting unimplementable Cookie-based XSS to a persistent attack Jeremiah Grossman
XSS reachable only through a Cookie header is usually written off as unexploitable because no page can make a browser send a modified cookie. Chaining fixes that: a common reflected XSS sets the poisoned cookie value…
Cookie Eviction Jeremiah Grossman
Identities harvested through browser auto-complete bugs can be pinned into a cookie before the bug is patched, then resold through a JSONP-style widget that any site can embed. As a counter, browsers cap total stored…
Cracking hashes in the JavaScript cloud with Ravan lava
HTML5 WebWorkers remove the freezing problem that made JavaScript useless for password cracking, and modern engines reach roughly 100,000 MD5 hashes per second. Since visiting a link is enough to enlist a browser, the…
Cross Site URL Hijacking by using Error Object in Mozilla Firefox Soroush Dalili
Firefox's script error handling reports the exact source URL that caused an error, and that reporting crosses origins. Deliberately triggering a fetch error against another site therefore discloses the destination URL…
DNS Prefetching and Its Privacy Implications: When Good Things Go Bad Fabian Monrose and Srinivas Krishnan
Browsers pre-resolve every link on a result page, stamping a burst of same-age records into the resolver cache. The authors cluster cache entries by age, tokenise the domains and feed them to a suggest engine to…
DNS Rebinding on Java Applets Stefano Di Paola
Java 6 exposed the Packages object to every browser, not just those with LiveConnect, so a JavaScript-instantiated applet runs in the JavaScriptProtectionDomain tied to the calling page's host. Rebinding that host to…
Expanding the Attack Surface xssniper
Switching browsers during an unpatched IE bug does not isolate users. A PDF opened in Firefox is rendered by Adobe Reader, and one line of Reader JavaScript calling app.launchURL() hands a chosen URL to the system…
Fear the EAR: Execution After Redirect bryceboe.com
A walkthrough of an iCTF 2010 challenge built to publicise Execution After Redirect, where server code keeps running past an intended termination point and leaks the response body alongside a 302. Browsers and tools…
Flash Camera and Mic Remember Function and XSS ha.ckers.org
Points out that Flash Player scopes its camera and microphone permissions to the domain rather than the application, so once a user ticks Remember, any XSS on that origin inherits the granted access. Because a failed…
FLAX: Systematic Discovery of Client-side Validation Vulnerabilities in Rich Web Applications Prateek Saxena, Steve Hanna, Pongsin Poosankam and Dawn Song
FLAX names client-side validation bugs: untrusted data reaching JavaScript sinks such as eval, innerHTML, document.cookie and XHR URLs without adequate checking. It lowers JavaScript to an intermediate form, JASIL…
Fooling B64_Encode(Payload) on WAFs and filters Stefano Di Paola
WAFs and filters that base64-decode a parameter before pattern matching can be desynchronised from the application that decodes it later. PHP's base64_decode and a Sun Java implementation skip illegal characters, so…
Generic cross-browser cross-domain theft Chris Evans
Browsers sent cookies on cross-domain CSS loads and let the CSS parser skip any leading junk, so an attacker who controls two injection points in a victim page can wrap its response in a CSS string and exfiltrate it…
Get Internal Network Information with Java Applets Stefano Di Paola
Two Java applet leaks. NetworkInterface.hashCode() is the sum of each bound address's integer value, so reversing it recovers the IP of any local NIC, including VPN interfaces the same-origin policy hides. Asking Java…
Google Chrome HTTP AUTH Dialog Spoofing through Realm Manipulation Aditya K Sood
Chrome through 5.0.375.127 does not scrutinise the realm value of a WWW-Authenticate header, so quotes placed inside it let an attacker control what the HTTP auth dialog displays and spoof which site is asking for…
Hacking Facebook with HTML5 matt
touch.facebook.com read the URL fragment and fetched it by AJAX into a div, and CORS made the request cross-origin instead of an error. Loading a PHP page that returns Access-Control-Allow-Origin: * injects an img…
How to Conceal XSS Injection in HTML5 Samuli Hakoniemi
HTML5's history.pushState() rewrites the address bar path without reloading, so a reflected XSS payload can erase its own query string from the visible URL immediately after running. The proof of concept injects a…
How to Hack Millions of Routers Craig Heffner
Multiple DNS A records and TCP connection failure redirect browser requests from an attacker server to a router’s public IP. Routers using the weak end system model accept this traffic from the LAN, exposing their…
How Unique Is Your Web Browser? Peter Eckersley
Fingerprints from 470,161 browsers visiting panopticlick.eff.org were built from eight passively and actively collected attributes, including plugin lists and Flash/Java font enumeration. The distribution held at least…
IIS5.1 Directory Authentication Bypass by using ":$I30:$Index_Allocation" Soroush Dalili
Appending the NTFS alternate data stream name ':$I30:$INDEX_ALLOCATION' to a directory in an IIS 5.1 URL reaches the same folder while defeating directory-based authentication, because IIS matches only the literal…
IIS6/ASP & file upload for fun and profit Juan Galiana
IIS 6 decides whether ASP.dll should execute a request by scanning URL segments for executable extensions, so a directory named folder.asp makes IIS run any file beneath it - folder.asp/document.pdf executes as ASP…
Improving HTTPS Side Channel Attacks ha.ckers.org
Proposes reducing the noise in HTTPS traffic-analysis attacks by pre-caching. From a man-in-the-middled HTTP page the attacker iframes the target site to force images, CSS, JavaScript and favicons into cache, so later…
Internal Port Scanning via Crystal Reports Joshua Abraham
SAP BusinessObjects Crystal Reports exposes the backend host and port through user-controlled viewrpt.cwr parameters, defaulting to port 6400. Because open and closed ports return distinguishable errors - FWM 01005 for…
Java Applet Same IP Host Access Stefano Di Paola
Java resolves its same-origin policy by IP address rather than hostname, so an applet uploaded to any host sharing a victim's IP can issue credentialed requests to that victim and read the responses. Setting the Host…
Lost in Translation (ASP's HomoXSSuality) ma1
Classic ASP's Request() silently transliterates non-ASCII characters into the ASCII letters they resemble or sound like, an undocumented behaviour dropped in ASP.NET. A VBScript and JavaScript harness enumerated the…
Mapping a web browser to GPS coordinates via router XSS + Google Location Services without prompting the user Samy Kamkar
An XSS in the Verizon FiOS router reads the router's own MAC address over AJAX and sends it to the attacker, who submits it to Google Location Services. That HTTP service maps router MACs to coordinates, so the victim…
MitM DNS Rebinding SSL/TLS Wildcards and XSS ha.ckers.org
A network attacker chains DNS rebinding with a wildcard TLS certificate: after the victim logs into a hardened subdomain, the attacker firewalls its IP and rebinds the name to a sibling subdomain that carries an XSS and…
MySQL Stacked Queries with SQL Injection...sort of Stefano Di Paola
Shows how to get stacked-query effects out of a MySQL SELECT injection, which normally allows only one statement. Using INTO OUTFILE the attacker writes the .TRG and .TRN trigger definition files straight into the…
NAT Pinning: Penetrating routers and firewalls from a web page (forcing router to port forward) Samy Kamkar
A web page can make a victim's router open an inbound port with no XSS or CSRF. A hidden multipart form POSTs to port 6667 on the attacker's host; the router's IRC connection-tracking helper reads the body as a DCC CHAT…
Next Generation Clickjacking Paul Stone
Extends clickjacking past the single click. URL fragment identifiers position the target element reliably, cross-domain drag-and-drop injects attacker text into forms and drags selections back out to steal page content…
No Alnum JavaScript extraexploit.blogspot.com
Deobfuscates a symbols-only JavaScript payload found injected into Italian sites, stepping through it with alert() calls and a textarea to recover the Function() body. The recovered code rewrites every link on the page…
Non-Obvious (Crypto) Bugs by Example Gregor Kopf
Two CMS bugs found by reading code. Typo3 truncated an MD5 MAC to 5 bytes and compared it with PHP's ==, so a hash of the form 0e... equals 0 and grants arbitrary file read in about 5,498 tries. Joomla seeded Mersenne…
NoScript Bypass - "Reflective XSS" through Union SQL Poisoning Trick Rohit Bansal
An advisory reporting that NoScript up to 2.0.5.1 fails to flag reflected XSS when the payload arrives through a SQL UNION injection. Hex-encoding the script in a union SELECT column means the request never carries…
NoTamper: Automatic Blackbox Detection of Parameter Tampering Opportunities in Web Applications Prithvi Bisht, Timothy Hinrichs, Nazari Skrupsky, Radoslaw Bobrowicz and V.N. Venkatakrishnan
NoTamper extracts the constraints a page's HTML and JavaScript impose on form input, using concrete-symbolic evaluation, then solves them to build benign and hostile inputs. It ranks hostile inputs by how closely the…
On the Incoherencies in Web Browser Access Control Policies Kapil Singh, Alexander Moshchuk, Helen J. Wang and Wenke Lee
Browsers label principals differently for DOM, cookies, XHR and display, so their policies conflict wherever those resources interplay, and runtime document.domain changes are ignored by most of them. User-owned…
One vector to rule them all Gareth Heyes
A single XSS payload built to execute wherever it lands: inside double or single quotes, inside an attribute, or in element content. It closes a long run of contexts (script, title, textarea, noscript, style, xmp…
Penetrating Intranets through Adobe Flex Applications Marcin Wielgoszewski
BlazeDS proxy services let a Flex client have the server fetch remote URLs on its behalf, sidestepping crossdomain.xml. Sample configurations ship with a wildcard soap property, so the proxy will reach any host it can…
Performing DDoS attacks with HTML5 Cross Origin Requests & WebWorkers lava
A WebWorker firing cross-origin GET requests pushes more than 10,000 requests a minute from one Chrome or Safari tab, because CORS only restricts reading the response, not sending it. A changing dummy query parameter…
Persistent Cross Interface Attacks secniche.blogspot.com
A posting of the Cross Interface Attacks (CIA) presentation given at the 13th AAVAR symposium in 2010, on persistent attacks that cross between a browser's separate interfaces. NOTE: the archived capture holds no…
phpwn: Attack on PHP sessions and random numbers Samy Kamkar
PHP 5.3.1 and earlier seed their linear congruential generator weakly enough that the 64-bit seed reduces to 35 bits, or under 20 bits given code execution, recoverable in seconds. That makes session IDs and lcg_value()…
Poisoning proxy caches using Java/Flash/Web Sockets Lin-Shung Huang, Eric Y. Chen, Adam Barth, Eric Rescorla and Collin Jackson
Java and Flash socket consent protocols are proxied by transparent intermediaries that never understand them, letting a SWF or applet forge a Host header over a raw socket. Ads served to 174,250 impressions measured…
Popup & Focus URL Hijacking ha.ckers.org
A snippet replaces the page shortly after load, so the address bar a user checked no longer matches what they see. Applied to a download prompt, a page posing as addons.mozilla.org triggers a Firefox add-on install…
Port Scanning with HTML5 and JS-Recon lava
Cross-Origin Requests and WebSockets both expose readyState, and how long a given readyState lasts varies with whether the target port is open, closed or filtered. Timing readyState 1 for CORS and readyState 0 for…
Posting raw XML cross-domain Chris
Sending arbitrary XML to another origin normally needs XHR, which the same-origin policy blocks. A plain form using enctype text/plain does no percent-encoding, and because XML is full of '=' characters a single…
Preventing Capability Leaks in Secure JavaScript Subsets Matthew Finifter, Joel Weinberger and Adam Barth
Project page for the NDSS 2010 paper on capability leaks in statically verified JavaScript subsets. Blacklist-based sandboxes such as ADsafe still let an advertisement reach methods the hosting page adds to built-in…
Protecting Browsers from Cross-Origin CSS Attacks Lin-Shung Huang, Zack Weinberg, Chris Evans and Collin Jackson
CSS error-tolerant parsing lets an attacker bracket secret text in a victim page with an injected style-rule prefix and suffix, import that page cross-origin as a stylesheet, and read the secret back out - with no…
Protecting Browsers from Extension Vulnerabilities Adam Barth, Adrienne Porter Felt, Prateek Saxena and Aaron Boodman
Manual review of 25 popular Firefox extensions found only 3 needed full privileges while 19 used interfaces more powerful than their features required. A Datalog deduction over 613 labelled XPCOM interfaces mapped 147…
Quick Proxy Detection ha.ckers.org
Firefox accepts bracketed IPv6 notation around an IPv4 literal, so http://[123.123.123.123]/img.jpg loads fine in the browser. Apache's proxy does not understand that syntax and will not fetch it, so an embedded image…
Re-visiting JAVA De-serialization: It can't get any simpler than this !! Manish S.
Extends the DSer Burp plugin so a captured Java serialized object is converted to XML with XStream, opened in any text editor, and converted back. A tester can edit nested HashMaps and String arrays without knowing the…
Regular Expressions Considered Harmful in Client-Side XSS Filters Daniel Bates, Adam Barth and Collin Jackson
The authors show that IE8, NoScript and noXSS block reflected XSS by running regular expressions over the raw response, so they are either slow or evadable, and their mangling can disable a victim site's own security…
Residue Objects: A Challenge to Web Browser Security Shuo Chen, Hong Chen and Manuel Caballero
Browser objects that outlive the page switch - residue objects - break visual integrity, document integrity and memory safety when the engine's guards miss a case. The authors analyse Internet Explorer's guarding…
Safari: a tale of betrayal and revenge Michał Zalewski
Explains a Safari same-origin bypass caused by disagreement between WebKit’s KURL parser and CFNetwork. Hostless-looking HTTP URLs receive authenticated content from distinct servers while origin checks treat both as…
SDRF / Hitting Bitrix with a Hammer: FormCalc authenticated response reading oxod
A Bitrix support-ticket PDF, opened on the application’s origin, uses FormCalc GET and POST calls to read an administrator’s CSRF token and invoke the PHP console. The article also chains BBCode attribute injection or…
Side Channel Attacks in SSL ha.ckers.org
A short pointer post flagging the Microsoft Research and Indiana University paper on side-channel leaks in encrypted web traffic, which pre-empted a Black Hat talk. It sketches the author's own angle: HTML loading…
Sidebuster: Automated Detection and Quantification of Side-Channel Leaks in Web Application Development Kehuan Zhang, Zhou Li, Rui Wang, XiaoFeng Wang and Shuo Chen
Sidebuster analyses web application source code to locate places where request and response sizes or timings vary with sensitive state, then reruns the application to measure how much entropy each such side channel…
SQLi filter evasion cheat sheet (MySQL) Reiners' Weblog
A reference sheet distilled from three years of evading PHPIDS, presented at CONFidence 2.0. It collects MySQL syntax that survives filters: comment and whitespace variants, quoteless strings, backtick aliases…
State of the Art: Automated Black-Box Web Application Vulnerability Testing Jason Bau, Elie Bursztein, Divij Gupta and John Mitchell
Eight commercial black-box web scanners were run against Drupal, phpBB2 and WordPress builds with known bugs and against a purpose-built testbed of ~90 verified vulnerabilities. Reflected XSS was found at over 60%, but…
Stealing entire Auto-Complete data in Google Chrome lava
Chrome's autocomplete dropdown is not in the DOM, so script cannot read it. The trick is to place a 3px-wide input just above the resting mouse pointer so the suggestion list appears under it, camouflaged as a thin…
Stored XSS Vulnerability @ Amazon Dirk Wetter
Amazon's search-inside-this-book feature passed matched book text unfiltered into a tooltipText variable, so script printed in a published book executed when a shopper moused over a search result. Web security books…
Stroke triggered XSS and StrokeJacking lava
On rubyheroes.com a keyup handler passed the input box's contents to jQuery html(), so the XSS could only be injected by the victim typing it character by character. The author pairs this with Zalewski's StrokeJacking…
Strokejacking Michal Zalewski
The original disclosure of strokejacking. Clickjacking was assumed to be limited to single-click actions, but JavaScript focus semantics let a page shift focus between a hidden frame and the document a user is typing…
Tabnabbing: A New Type of Phishing Attack AzarAsk
A generic 2022 article on phishing categories - spear phishing, domain spoofing, whaling, smishing and vishing - published at the URL the list cites for Aza Raskin's 2010 tabnabbing research. It describes each category…
The curse of inverse strokejacking lcamtuf.blogspot.com
Strokejacking reversed: a framed third-party gadget or advertisement grabs focus from the top-level document, which the same-origin policy does not govern. By surrendering focus at timed intervals it keeps the caret…
The Emperor's New APIs: On the (In)Secure Usage of New Client-side Primitives Steve Hanna, Eui Chul Richard Shin, Devdatta Akhawe, Arman Boehm, Prateek Saxena and Dawn Song
Facebook Connect and Google Friend Connect were reverse engineered from their JavaScript and checked with the Kudzu symbolic execution engine. Neither validated postMessage sender origins and both used targetOrigin '*'…
Turning XSS into Clickjacking ha.ckers.org
Clickjacking normally needs attacker-controlled hosting, which is far rarer than XSS. Reflecting <script>eval(location.hash.slice(1))</script> converts any generic reflected XSS into a DOM-based one, since the fragment…
UI Redressing: Attacks and Countermeasures Revisited Marcus Niemietz
A seminar work surveying UI redressing end to end: basic clickjacking, strokejacking and likejacking, then new eventjacking and classjacking variants chaining clickjacking with reflected XSS and jQuery class selectors…
Using Cookies For Selective DoS and State Detection ha.ckers.org
If a site's session cookie changes length between logged-in and logged-out states, an attacker can set an oversized cookie scoped by path to a single image so that the total header just exceeds the server's limit in one…
Will it Blend? xssniper
A post announcing the RuxCon and BayThreat talk Will It Blend, on blended threats. Roughly five individually unremarkable bugs across different browser plug-in vendors are chained into a genuinely useful exploit…
XSHM Mark 2 ha.ckers.org
A popup stays navigable by the script that opened it, so an attacker can repeatedly point it at a URL that reads history.length and steps back. Polling that count reveals how many pages the victim has visited since…
XSS-Track: How to quietly track a whole website through single XSS blog.kotowicz.net
One XSS on one page is turned into site-wide surveillance. The payload hides the page, opens a full-window borderless iframe on the same origin, and survives navigation because only the iframe reloads. Same-origin…
XSSing client-side dynamic HTML includes by hiding HTML inside images and more lava
Argues that sites which fetch a URL fragment by Ajax and drop it into innerHTML are vulnerable even without HTML5 cross-origin requests, because every same-origin file becomes HTML. HTML hidden after a JPEG's…