Top 10 Web Hacking Techniques

2011

The 2011 Top 10 Web Hacking Techniques: all 10 winners and 69 nominated and collected techniques, each with its researcher, summary and preserved source.

69 records · 10 in the top ten · open this year in the interactive archive

The top ten

1. #1 BEAST Thai Duong

   A first-person account of building BEAST. Rizzo's chosen-boundary attack on SSL/TLS CBC was reversed to suit browsers, which needed two records inside one cookie-bearing request; WebSockets and then a Java applet…

2. #2 Multiple vulnerabilities in Apache Struts2 and property oriented programming with Java Reiners' Weblog

   A blackbox test where ?id=abc'+a+'def returned null exposed OGNL evaluation in Struts2 parameter names. The author shows the character whitelist still permits dynamic names and list indexes, giving constructor calls and…

3. #3 DNS poisoning via Port Exhaustion Roee Hay and Yair Amit

   Announces a whitepaper on poisoning stub resolvers by exhausting the source ports available to a client, collapsing DNS query entropy. Two flaws are disclosed: a remote variant driven by Java applets (CVE-2011-3552…

4. #4 (DOMinator) Finding DOMXSS with dynamic taint propagation Google Code

   The Google Code home of DOMinator, Minded Security's instrumented Firefox build that finds DOM-based XSS by propagating dynamic runtime taint through JavaScript string operations. The 2010 community release targets…

5. #5 Abusing Flash-Proxies for client-side cross-domain HTTP requests Martin Johns and Sebastian Lekies

   A cross-domain Flash applet keeps the origin of its SWF, not of the embedding page, so any page embedding someone else's Flash HTTP proxy can issue requests under that proxy's origin. A survey of five published proxies…

6. #6 Expression Language Injection Stefano Di Paola and Arshan Dabirsiaghi

   Spring MVC JSP tags evaluate attacker input a second time, so user data reaching attributes such as scope or code is run as Expression Language. The paper reads server scopes and beans, bypasses HttpOnly by echoing…

7. #7 Java Applet Same-Origin Policy Bypass via HTTP Redirect Neal Poole

   Java 6 Update 27 and below and Java 7 set an applet's origin from the URL that began the load rather than the URL the redirect ended at. Hosting evil.jar behind a victim site's open redirect therefore let the applet…

8. #8 CAPTCHA Hax With TesserCap Gursev Singh Kalra

   TesserCap is a point-and-shoot CAPTCHA analysis tool pairing a configurable image preprocessing engine with Tesseract-OCR, plus proxy and custom-header support for fetching CAPTCHAs. Tested against 200+ high-traffic…

9. #9 Bypassing Chrome's Anti-XSS filter Nick Nikiforakis

   Chrome's static anti-XSS filter inspected each reflected parameter on its own, so a script tag in one parameter was stripped. Splitting the payload across two reflected parameters and opening a JavaScript multi-line…

10. #10 CSRF: Flash + 307 redirect = Game Over Phillip Purviance

    A Flash file served with a permissive crossdomain.xml can set arbitrary headers and POST body, then follow a 307 redirect to the victim host; Flash keeps the attacker's policy instead of re-checking the target's, so the…

Also collected

• “You Might Also Like:” Privacy Risks of Collaborative Filtering Joseph A. Calandrino, Ann Kilzer, Arvind Narayanan, Edward W. Felten and Vitaly Shmatikov

  Public recommender output - item-similarity lists and item-to-item covariances - shifts measurably when a single user acts. The authors monitor those shifts over time and combine them with a little known auxiliary…

• Abusing HTTP Status Codes to Expose Private Information Mike Cardwell

  A hidden image whose src is a GMail profile photo fires onload when the visitor is signed in and onerror when the request redirects instead, revealing login state silently. The same trick works with script tags against…

• All Your Clouds Are Belong to Us: Security Analysis of Cloud Management Interfaces Juraj Somorovsky, Mario Heiderich, Meiko Jensen, Jörg Schwenk, Nils Gruschka and Luigi Lo Iacono

  Researchers attacked the cloud control interfaces of Amazon EC2/S3 and Eucalyptus. Four XML Signature wrapping variants let a single eavesdropped SOAP request trigger arbitrary operations, and a signature-exclusion bug…

• An Empirical Analysis of XSS Sanitization in Web Application Frameworks Joel Weinberger, Prateek Saxena, Devdatta Akhawe, Matthew Finifter, Richard Shin and Dawn Song

  Models browser parsers, context transitions and decoding operations to explain why sanitization can fail after data changes context. An evaluation of web frameworks and PHP/Django applications compares automatic…

• Autocomplete..again?! Stefano Di Paola

  A page can still read keydown and keyup events while the browser's form-autocomplete dropdown is open, so a game that lures the victim into typing letters harvests autocomplete values stored for other sites…

• Automated Black-Box Detection of Side-Channel Vulnerabilities in Web Applications Peter Chapman and David Evans

  Encrypted web traffic still leaks application state through packet sizes and timing. The authors build a black-box tool that crawls an application repeatedly, treats the adversary as a multi-dimensional classifier, and…

• Automated Discovery of Parameter Pollution Vulnerabilities in Web Applications Marco Balduzzi, Carmen Torrano Gimenez, Davide Balzarotti and Engin Kirda

  PAPAS, a Firefox-driven black-box scanner, injects an encoded query delimiter into each existing parameter and checks whether it reappears inside the page's links and form actions. A 13-day crawl of 5,016 popular sites…

• Bit-squatting: DNS Hijacking Without Exploitation Artem Dinaburg

  Registering domains one bit away from popular hostnames catches traffic misdirected by random RAM and cache bit-flips in clients, with no exploit involved. Thirty bitsquats of microsoft.com, fbcdn.net, doubleclick.net…

• BLOCK: A Black-Box Approach for Detection of State Violation Attacks Towards Web Applications Xiaowei Li and Yuan Xue

  BLOCK infers a web application's intended behaviour model from attack-free traffic alone, extracting invariants over request/response sequences and their associated session variable values. At runtime any request or…

• Bypassing Flash's local-with-filesystem Sandbox xssniper

  Flash's local-with-filesystem sandbox is meant to stop local SWFs talking to the network, but it enforces this with a protocol handler blacklist. A file:// UNC path already reaches hosts on the local network, and getURL…

• Close encounters of the third kind (client-side JavaScript vulnerabilities) Ory Segal, Omri Weisman, Adi Sharabani, Yair Amit and Lotem Guy

  IBM ran static taint analysis over JavaScript harvested by a deep crawl of 675 sites, the Fortune 500 plus 175 hand-picked ones, analysing fully rendered HTML and the DOM rather than raw source. 98 sites (14%) held…

• Cookiejacking Rosario Valotta

  Valotta chains an IE zero-day that loads a local cookie file into an iframe with Paul Stone's drag-and-drop content extraction, stealing any cookie including HttpOnly and Secure ones without XSS. An SMB UNC image…

• Cross domain content extraction with fake captcha blog.kotowicz.net

  A UI-redressing refinement of Firefox's view-source: framing bug. Rather than make the victim drag a page's HTML source, the attacker frames view-source: so one line of the victim page sits inside a fake CAPTCHA field…

• Crouching Tiger Hidden Payload: Security Risks of Scalable Vector Graphics (The Image That Called Me) Mario Heiderich, Tilman Frosch, Meiko Jensen and Thorsten Holz

  HTML5 requires browsers to render SVG embedded via img tags, CSS or inline, and SVG files are fully functional one-file web applications rather than passive images. The paper shows such images can execute arbitrary…

• Crowd-sourcing mischief on Google Maps leads customers astray Lisa Vaas

  Google Places let any passer-by flag a business as permanently closed with no verification, so spammers or rivals could shutter a shop's listing. The post walks through the New York Times report, a Help forum thread…

• CSRF with JSON -- leveraging XHR and CORS shreeraj.blogspot.com

  Shows CSRF surviving JSON APIs: an XHR-Level 2 request with withCredentials true and Content-Type text/plain adds no custom header, so CORS skips the preflight, the browser replays the victim's cookies, and a server…

• Dark Clouds on the Horizon: Using Cloud Storage as Attack Vector and Online Slack Space Martin Mulazzani, Sebastian Schrittwieser, Manuel Leithner, Markus Huber and Edgar Weippl

  The USENIX Security '11 programme record for the SBA Research paper on abusing cloud storage. It carries the title, its five authors and links to the paper, slides, audio and video. The research shows that hash-based…

• Double eval() for DOM based XSS shreeraj

  Where a DOM sink is eval('getProduct('+koko+')'), a payload that needs its own quotes breaks the surrounding string and only raises a syntax error. Wrapping it in a second eval over String.fromCharCode passes digits…

• Drag and Drop XSS in Firefox by HTML5 (Cross Domain in frames) Soroush Dalili

  Dalili bypasses Firefox's block on dragged javascript: URLs by capitalising the scheme (jAvAscript:) or wrapping it in the feed: protocol. Dropping such a string on an HTML5 drop target inside an iframe redirects the…

• Excel formula injection in Google Docs @_chipik and @asintsov

  Google Docs Forms neutralised spreadsheet formulas by prefixing a space, so the researchers submitted %08 (backspace) ahead of the = to delete that space and land a live formula in the results sheet. A Google Function…

• Exploitation of "Self-Only" Cross-Site Scripting in Google Code AMol NAik

  Google Code’s Maps example executed XSS only after a user entered a payload. Amol Naik combined HTML5 drag-and-drop with clickjacking: a game placed an invisible vulnerable frame beneath draggable content, inserting…

• Exploiting the unexploitable XSS with clickjacking blog.kotowicz.net

  A UI-redressing walkthrough: an Alphabet Hero game lures the victim into dragging text across origins, dropping an XSS payload into a field of a vulnerable AJAX app and clicking Search. That fires an XSS otherwise…

• Facebook: Memorializing a User Jeremiah Grossman

  Facebook let any confirmed friend request that an account be memorialized, which restricts the profile and permanently blocks anyone from logging in. Grossman shows the only real check was that a plausible obituary…

• Fast and Precise Sanitizer Analysis with BEK Pieter Hooimeijer, Benjamin Livshits, David Molnar, Prateek Saxena and Margus Veanes

  USENIX Security '11 presentation page carrying only the title, the five authors and links to the paper PDF, audio and video. The work itself introduces BEK, a language for writing string sanitizers that compiles to…

• Filejacking: How to make a file server from your browser (with HTML5 of course) blog.kotowicz.net

  WebKit's directory upload control lets a page read a whole folder, and users get no warning that a folder picker is not a save dialog. Kotowicz hid a transparent directory input over a fake download button, then opened…

• Google Chrome/ChromeOS sandbox side step via owning extensions Kyle Osborn and Matt Johansen

  Chrome OS replaces desktop programs with HTML and JavaScript extensions, so an XSS in an extension inherits whatever chrome.* API permissions its manifest.json declared. The paper shows an injected script calling…

• HashDOS: Effective Denial of Service attacks against web application platforms Alexander Klink and Julian Wälde

  Programme entry for the 28C3 talk by Alexander Klink and Julian Waelde on HashDoS. A common flaw in how PHP, ASP.NET, Java and other platforms hash form-parameter keys lets a single crafted HTTP request pin a web…

• Hidden XSS Attacking the Desktop & Mobile Platforms Kos

  Conference talk arguing that XSS no longer needs a browser tab: injected script inside privileged containers such as browser extensions and mobile app webviews runs with whatever host permissions the container holds…

• How to Break XML Encryption Tibor Jager and Juraj Somorovsky

  XML Encryption's CBC mode combined with the character encoding of the plaintext yields an oracle: a Web Service that rejects a message it cannot parse leaks whether a modified ciphertext decrypts to valid UTF-8. Jager…

• How to get SQL query contents from SQL injection flaw blog.kotowicz.net

  Working a bootcamp challenge, the author uses three injected search criteria to open, capture and close a SQL string, so part of the application's own query is returned as a result row. SQLite double-quoted strings…

• How To Own Every User On A Social Networking Site Matt Johansen

  Matt Johansen chains a DOM-based persistent XSS in a social network's profile tag field with missing authorization on the id parameter of the AddTag request. Because every user's id is public in their profile URL, a…

• How to Shop for Free Online: Security Analysis of Cashier-as-a-Service Based Web Stores Rui Wang, Shuo Chen, XiaoFeng Wang and Shaz Qadeer

  Researchers broke real cashier-as-a-service checkouts (PayPal, Amazon Payments, Google Checkout) as integrated by NopCommerce, Interspire, Buy.com and JR.com: a shopper calling merchant and cashier web APIs out of order…

• How to upload arbitrary file contents cross-domain blog.kotowicz.net

  CORS lets a plain XMLHttpRequest POST cross-domain without preflight, so an attacker page can hand-build a multipart/form-data body and upload a file of chosen name and content to another site with no user interaction…

• HOW TO: Spy on the Webcams of Your Website Visitors Feross Aboukhadijeh

  Adobe had added framebusting JavaScript to the Flash Settings Manager page, so instead of framing the page the author framed the settings SWF file directly, which the framebuster never guarded. Overlaying the…

• I Still Know What You Visited Last Summer: Leaking Browsing History via User Interaction and Side Channel Attacks Zachary Weinberg, Eric Y. Chen, Pavithra Ramesh Jayaraman and Collin Jackson

  Browsers blocked automated CSS history sniffing in 2010, so this paper shows what survives. Four fake CAPTCHA and puzzle tasks trick users into typing or clicking what they see, leaking visited links at up to 1000…

• JSON-based XSS exploitation Adi Cohen

  Internet Explorer falls back to the URL's file extension when a response's declared content-type is missing from the registry MIME database, and application/json is not listed there. Appending path-info such as /.html…

• Kindle Touch (5.0) Jailbreak/Root and SSH @yifanlu

  Much of the Kindle Touch interface is HTML and JavaScript backed by a native bridge, and one exposed function, nativeBridge.dbgCmd(), runs any shell command as root. Injecting HTML and script through an MP3's ID3 tags…

• Launch any file path from web page Aaron Sigel

  A web page could hand any file: URL to Mac OS X LaunchServices through document.location, which then runs the binary, opens the application, or opens the file in its default handler. Only the quarantine bit stops a…

• Lotus Notes Formula Injection aboulton.blogspot.com

  A code review of IBM's Domino Blog application found HTTP request data reaching LotusScript's Evaluate function without encoding, letting an attacker inject Lotus Notes Formula statements. The sample payload wraps…

• NULLs in entities in Firefox Gareth Heyes

  Firefox accepted NULL bytes inside HTML5 named entities, so an entity can be written with a NULL before the ampersand or before the semicolon and still resolve. That yields malformed-looking spellings of an…

• Postcards from the post-XSS world Michal Zalewski

  Examines risks that remain when injected HTML cannot execute scripts, including markup-based data leaks, CSS behavior, and interference with application logic. Explains why script restrictions alone do not make HTML…

• Rapid history extraction through non-destructive cache timing (v8) lcamtuf.coredump.cx
• Server-Side JavaScript Injection: Attacking NoSQL and Node.js Bryan Sullivan

  Bryan Sullivan's Black Hat USA 2011 whitepaper shows that eval of untrusted input in Node.js servers and MongoDB $where queries executes attacker JavaScript on the server. Payloads run from an eight-byte while(1) denial…

• Session Puzzling code.google.com

  The Google Code download index for PuzzleMall, Shay Chen's deliberately vulnerable Java web application for practising session puzzling and temporal session race conditions. It lists the session puzzling whitepaper and…

• Sour Pickles: Shellcoding in Python's Serialisation Format Marco Slaviero

  Python's Pickle format is a stack virtual machine whose GLOBAL and REDUCE opcodes load and call arbitrary callables, so a tampered pickle stream is remote code execution. The paper maps the PVM, gives shellcode…

• SpyTunes: Find out what iTunes music someone else has Andrew McAfee

  McAfee shows that iTunes' gift flow discloses a stranger's library. Assemble a playlist, start gifting it to a target email address, and iTunes names a track the recipient already owns before any sign-in or payment…

• Static Detection of Access Control Vulnerabilities in Web Applications Fangqi Sun, Liang Xu and Zhendong Su

  Access control rules are application-specific, so written specifications to check them against rarely exist. This static analysis infers the accesses implicit in the source instead, building a sitemap per role…

• Stealth Cookie Stealing (new XSS technique) John Strand

  Cookie theft through XSS usually leaves a visible clue that warns the victim to log out. This post instantiates a JavaScript Image object and sets its src to an attacker URL carrying document.cookie, so the browser…

• Stripping Referrer for fun and profit blog.kotowicz.net

  Kotowicz strips the Referer header from cross-origin GET and POST requests using client-side code only, with no server involved. Chrome loses it through a data: URI, IE through window.open, Firefox and WebKit need a…

• SurveyMonkey: IP Spoofing ChrisJohnRiley

  ChrisJohnRiley noticed RFC1918 addresses among SurveyMonkey respondent IPs and traced it to the site trusting the X-Forwarded-For header. Setting that header let him record any IP against a survey response, including…

• Temporal Session Race Conditions Shay Chen

  Shay Chen's deck shows how to exploit session race conditions that have no natural latency. Layer-targeted application DoS - RegEx DoS payloads, connection-pool exhaustion, expensive queries - stretches the window in…

• Text-based CAPTCHA Strengths and Weaknesses Elie Bursztein, Matthieu Martin and John C. Mitchell

  A systematic evaluation of 15 text CAPTCHA schemes from major web sites, using a common methodology against the anti-segmentation defences each one relies on. Thirteen of the fifteen fell to automated attack. The paper…

• The Failure of Noise-Based Non-Continuous Audio Captchas Elie Bursztein, Romain Bauxis, Hristo Paskov, Daniele Perito, Celine Fabry and John C. Mitchell

  An S&P 2011 paper presenting a generic pipeline that breaks audio CAPTCHAs built from non-continuous speech, combining audio processing with machine learning. The authors report success against every popular scheme of…

• Timing Attacks on CSS Shaders Adam Barth

  Barth argues the CSS Shaders proposal repeats WebGL's timing flaw: shader run time depends on pixel values, so a site can read content it may display but not read, such as a Facebook Like button or visited-link styling…

• Tracking users that block cookies with a HTTP redirect Elie Bursztein

  A 301 redirect can carry a per-visitor identifier the way a cookie does: the tracking page redirects a new visitor to a unique URL, and the browser's permanent-redirect cache replays that id on every later visit. It…

• Using Cross-domain images in WebGL and Chrome 13 Eric Bidelman

  After shaders were shown to leak the contents of GPU textures, the WebGL spec was tightened so Chrome 13 and Firefox 5 reject cross-domain media as textures, raising DOM_SECURITY_ERR. A new .crossOrigin attribute lets a…

• WAPTEC: Whitebox Analysis of Web Applications for Parameter Tampering Exploit Construction Prithvi Bisht, Timothy Hinrichs, Nazari Skrupsky and V.N. Venkatakrishnan

  WAPTEC analyses a LAMP application's client form, its PHP execution trace and its MySQL schema together, expressing all three as first-order string constraints. It solves f_client for benign inputs, then negates it…

• XSS in Skype for iOS superevr

  Skype 3.0.1 and earlier for iPhone renders chat in a local HTML file without encoding the sender's Full Name, so a crafted name runs JavaScript when the victim opens the message. Worse, the embedded WebKit view runs…

• XSS-Track as a HTML5 WebSockets traffic sniffer blog.kotowicz.net

  Kotowicz extends XSS-Track so one injected script sniffs HTML5 WebSocket traffic. It wraps window.WebSocket, replacing the constructor and prototype.send and attaching a message listener, so every frame sent and…