Top 10 Web Hacking Techniques

2012

The 2012 Top 10 Web Hacking Techniques: all 10 winners and 80 nominated and collected techniques, each with its researcher, summary and preserved source.

80 records · 10 in the top ten · open this year in the interactive archive

The top ten

#1 CRIME Dennis Fisher
Threatpost's pre-disclosure report on CRIME: Rizzo and Duong found an optional TLS feature that leaks enough about encrypted traffic to recover session cookies, in every TLS version including 1.2 and whatever the cipher…
#2 Pwning via SSRF (memcached, php-fastcgi, etc) Alexander Polyakov, Dmitry Chastukhin and Alexey Tyurin
ERPScan classify SSRF into trusted, simple, partial and full remote variants, then demonstrate XXE tunneling through the gopher URI scheme against SAP systems. Examples cover verb tampering, an ABAP kernel buffer…
#3 Chrome addon hacking blog.kotowicz.net
Cross-scheme loading between http(s) pages and chrome-extension:// URLs is not fully isolated. Pointing a script element at chrome-extension://<id>/manifest.json and watching whether onload or onerror fires reveals…
#4 Bruteforce of PHPSESSID Arseny Reutov, Timur Yunusov and Dmitry Nagibin
Positive Technologies turn Argyros and Kiayias's PHP randomness research into a working attack on PHPSESSID. The session id is an MD5 of client IP, timestamp, microseconds and php_combined_lcg output, and two tricks cut…
#5 Blended Threats and JavaScript superevr
A one-paragraph announcement for the Black Hat USA 2012 talk Blended Threats and JavaScript, pointing at slides carrying three extra slides beyond the conference version, a video, and a ddwrt-install-tool demo on GitHub…
#6 Cross-Site Port Attacks Riyaz Ahemed Walikar
Part one of three naming Cross Site Port Attacks (XSPA): an application that fetches a user-supplied URL can be driven to port-scan intranet and Internet hosts, grab banners, fingerprint internal apps and read local…
#7 Permanent backdooring of HTML5 client-side application Joey Tyson
Caching application JavaScript in HTML5 localStorage turns any reflected XSS on the caching origin into a persistent, self-reloading compromise. The article documents a real case: the Apture widget cached 272KB of code…
#8 CAPTCHA Re-Riding Attack Gursev Singh Kalra
Kalra shows that many CAPTCHA implementations store the solution in the HTTP session but never clear it during verification. Because the CAPTCHA image endpoint is not called again, a single solved CAPTCHA stays valid…
#9 XSS: Gaining access to HttpOnly Cookie in 2012 Aung Khant
Revisits HttpOnly after XST died, testing Silverlight, Flash and Java for a way to read Set-Cookie. Java is the winner: an applet calling URLConnection.getHeaderField reads the HttpOnly Set-Cookie header and hands it…
#10 Attacking OData: HTTP Verb Tunneling, Navigation Properties for Additional Data Access, System Query Options ($select) Gursev Singh Kalra
A penetration tester’s guide to OData service documents, metadata and RESTful operations. It recommends testing X-HTTP-Method verb tunneling, navigation properties and $select=* for inconsistent access controls, and…

Also collected

.Net Cross Site Scripting -- Request Validation Bypassing Zamir Paltiel
ASP.NET Request Validation rejects a tag in a parameter value, but not the same tag written with a leading percent sign, which Internet Explorer still parses as valid markup. Reflecting that value with a style attribute…
"ASPXErrorPath in URL" Technique in Scanning a .Net Web Application Soroush Dalili
When a .NET site redirects every failure to one custom error page, 404 and 500 become indistinguishable to a crawler. Adding ?aspxerrorpath=/ to the request makes ASP.NET surface the real status code, so a scanner can…
AJAX Hammer — Harnessing AJAX for Dynamic CSRF Oren Ofer
An intranet-classified page uses permissive browser zones and user-approved cross-domain XMLHttpRequest to read authenticated responses. It can extract CSRF tokens and ViewState, adapt subsequent requests, and send…
Are You My Type? Breaking .NET Through Serialization James Forshaw
Forshaw analyses .NET's BinaryFormatter and shows that deserialising untrusted data reaches dangerous framework classes such as TempFileCollection, FileSystemInfo and IWbemClassObjectFreeThreaded. He bypasses remoting's…
Attacking CAPTCHAs for Fun and Profit Gursev Singh Kalra
A survey of CAPTCHA implementations on high-traffic sites, sorted into breaches of client-side trust, server-side state flaws and image weaknesses. It names rainbow tables against finite CAPTCHA sets, CAPTCHA fixation…
Browser Event Hijacking Ben Toews
Calling preventDefault on the ctrl+f and cmd+f keydown lets a page suppress the browser's own find bar and draw a pixel-accurate replica instead. Anything the user types into that fake bar is readable by the site. Toews…
Browsers Anti-XSS methods in ASP (classic) have been defeated! Soroush Dalili
Classic ASP accepts request parameters in ways browser XSS filters never modelled: parameter pollution, certain UTF-8 characters folded to ASCII equivalents, case-insensitive names, truncation at null bytes, stray…
Bruteforcing/Abusing search functions with no-rate checks to collect data suriya
A Facebook privacy setting left phone numbers searchable by default, and the mobile endpoint m.facebook.com/search applied no rate limit. The author generated number ranges in a spreadsheet and ran a macro that…
Bypassing CAPTCHAs by Impersonating CAPTCHA Providers Gursev Singh Kalra
CAPTCHA verification APIs, reCAPTCHA included, validated over plain HTTP, so a man in the middle can sniff the private key and impersonate the provider. Because validation answers are a tiny predictable set, the…
Bypassing Flash's local-with-filesystem Sandbox xssniper
Flash's local-with-filesystem sandbox is meant to stop local SWFs talking to the network, but it enforces this with a protocol handler blacklist. A file:// UNC path already reaches hosts on the local network, and getURL…
Bypassing HTTP Basic Authenitcation in PHP Applications Paolo Perego
An assessment of a PHP site whose admin area was protected only by Apache HTTP Basic auth. Because PHP passes unrecognised WebDAV-style verbs through to the script, a request using an invented method such as DAMMI…
Clickjacking Rootkits for Android Matt Shipman
An NC State press release on work by Xuxian Jiang's team. They built a proof-of-concept rootkit attacking the Android application framework rather than the operating system kernel, so an infected app can hide and…
Content Smuggling Billy Rios
The PDF specification lets the header appear anywhere in the first 1024 bytes, so a file can be a valid GIF and a valid PDF at once. Uploading such a polyglot to a site that only accepts benign types, then referencing…
Cracking Ruby on Rails Session joernchen
Rails keeps sessions in a client-side cookie signed with an HMAC whose secret lives in config/initializers/secret_token.rb, a file developers routinely commit to GitHub. With the secret a session can be forged…
Cross Context Scripting from within the Browser Roberto Suggi Liverani
Maxthon's about:history page renders visited-URL text unescaped, so a location.hash payload on any attacker page lands inside the privileged mx://res zone. From there the maxthon.io and maxthon.program DOM objects give…
Cruel Intentions: Violating Browser Security and Privacy Through Web Intents Jenna Kallaher, Amal Krishnan, Paul Makowski, Eric Chen and Collin Jackson
Security analysis of Web Intents, the browser framework for delegating actions such as sharing between sites. Four attacks are found against the prototype implementations: cross-session user tracking, denial of service…
CSRF token disclosure via iFRAME and CAPTCHA trickery Lucian Constantin
A news report on Sergiu Dragos Bogdan's DefCamp talk: the Yahoo Developer Network YQL console can be framed, showing the victim a session-bound "crumb" token. Same-origin rules stop the attacker reading the frame, so he…
CSS :visited may be a bit overrated lcamtuf.blogspot.com
Browser vendors crippled CSS :visited to stop history theft, and cache timing was treated as a weaker substitute because earlier attacks were destructive, probabilistic and slow. This proof of concept performs reliable…
CSS-Only Clickjacking @gcollazo
A JSFiddle proof of concept for clickjacking with CSS alone: a visible link is positioned over a Facebook Like or Twitter Follow iframe and given pointer-events: none, so the click passes through to the hidden button…
Cursorjacking again blog.kotowicz.net
A revived cursorjacking vector after Niemietz's original custom-cursor trick. Setting cursor:none on the body works across browsers, so a page can hide the real pointer entirely and draw a fake one at an offset with a…
Detecting and Defending Against Third-Party Tracking on the Web Franziska Roesner, Tadayoshi Kohno and David Wetherall
A client-side detector classifies third-party trackers by how they manipulate browser state, finding over 500 distinct trackers in the wild and most commercial pages tracked by several parties at once. Using AOL search…
Enemy of the State: A State-Aware Black-Box Web Vulnerability Scanner Adam Doupé, Ludovico Cavedon, Christopher Kruegel and Giovanni Vigna
Black-box scanners miss vulnerabilities because they ignore server-side state. The authors infer a web application's state machine from the outside by navigating it, comparing output differences and incrementally…
Exploiting XSS in Ajax Web Applications superevr
JSON endpoints that reflect input are exploitable in Internet Explorer despite an application/json content type, because IE content-sniffs on the apparent file extension. Appending .htm, /.html, ;.html or .cgi?a.html to…
File System API with HTML5 -- Juice for XSS shreeraj
Short note on the HTML5 File System API as an XSS target. Because a site can create a persistent mini filesystem readable by any script in the same origin, an XSS payload can enumerate the entries and read files such as…
FlashOver: Automated Discovery of Cross-site Scripting Vulnerabilities in Rich Internet Applications Steven Van Acker, Nick Nikiforakis, Lieven Desmet, Wouter Joosen and Frank Piessens
FlashOver decompiles SWF files, regex-matches ActionScript variables reaching sinks like getURL and loadMovie, then builds attack URLs from ten injection templates and clicks 10,000 random points in a real Firefox to…
Fun with data: URLs blog.kotowicz.net
Notes that data: URLs bypass anti-XSS filters, and in Firefox and Opera a document opened from one keeps access to the opening page, so a single link yields XSS. Fuzzing the data: URI syntax found parsers that accept…
Fuzzing with Code Fragments Christian Holler, Kim Herzig and Andreas Zeller
LangFuzz resolves the tension between inputs valid enough to parse and odd enough to crash by generating programs from a language grammar while splicing in code fragments mined from tests that previously triggered…
Host Fingerprinting and Tracking on the Web: Privacy and Security Implications Ting-Fang Yen, Yinglian Xie, Fang Yu, Roger Peng Yu and Martin Abadi
A month of anonymized Hotmail and Bing logs covering millions of hosts measures how much identifying information browser strings, IP addresses, cookies and login IDs actually carry. It quantifies cookie churn and shows…
How Facebook lacked X-Frame-Options and what I did with it blog.kotowicz.net
Facebook's serverfbml.php plugin endpoint relied on JavaScript frame-busting and sent no X-Frame-Options header. Framing it under view-source: in Firefox and using a double drag-and-drop UI redressing game, an attacker…
How I Hacked StackOverflow Anthony Ferrara
An SSH-tunnelled Squid proxy stamped X-Forwarded-For: 127.0.0.1 on the author's requests, and StackExchange's IIS was configured to rewrite Remote_Addr from that header. The application checked the right variable, so…
How to upload arbitrary file contents cross-domain blog.kotowicz.net
CORS lets a plain XMLHttpRequest POST cross-domain without preflight, so an attacker page can hand-build a multipart/form-data body and upload a file of chosen name and content to another site with no user interaction…
Hyperlink Spoofing and the Modern Web David Ross
Ross surveys how social platforms display hyperlink destinations and finds the indicators are inconsistent and spoofable. Twitter's server-side short-link resolution created a TOCTOU window: change the redirector after…
IE9 Self-XSS Blackbox Protection bypass Soroush Dalili
IE9 strips javascript: and vbscript: from pasted addresses to blunt self-XSS scams. Dalili found the filter is bypassed by wrapping the scheme, for example XfileX: followed by control characters and then the javascript…
Jumping out of Touch Screen Kiosks seckb.yehg.net
Touch-screen kiosks in restaurants and telco shops run Adobe Flash with no keyboard, so keyboard-driven kiosk escapes such as iKat do not apply. A long press raises the Flash context menu; choosing Global Settings opens…
NTLM Relay via HTTP to internet or stealing windows user hashes while using java client Alexey Tyurin
Java's built-in HTTP client performs NTLM authentication automatically to any host, without the Intranet-zone restriction browsers apply. So an SSRF in a Java application on Windows, often running under a user account…
Off-Path Attacking the Web Yossi Gilad and Amir Herzberg
A spoofing-only attacker with a puppet script in the victim's browser can learn both TCP sequence numbers of an existing connection by abusing the global IP-ID counter used by Windows as a side channel. With the…
On Breaking SAML: Be Whoever You Want to Be Juraj Somorovsky, Andreas Mayer, Jörg Schwenk, Marco Kampmann and Meiko Jensen
An analysis of 14 SAML frameworks found 11, including Salesforce, Shibboleth and IBM XS40, open to XML Signature wrapping, letting an attacker re-parent a signed assertion and impersonate any user. The work models the…
Parasitic computing using 'Cloud Browsers' Matt Shipman
An NC State release for the ACSAC 2012 paper "Abusing Cloud-Based Browsers for Fun and Profit". Cloud browsers render pages server-side, so the team built a Browser MapReduce client on a reverse-engineered Puffin and…
Password extraction from Ajax/DOM/HTML5 routine shreeraj
A short note on sloppy Ajax login code: variables such as the crafted request URL are declared without scope and stay global on the DOM for the life of the page. Given a DOM XSS foothold, iterating over window and…
Pixel Perfect: Fingerprinting Canvas in HTML5 Keaton Mowery and Hovav Shacham
Rendering text and WebGL scenes into an HTML5 canvas element and reading back the pixels yields a browser fingerprint, because font rasterisation and GPU output vary with the operating system, drivers and hardware…
Random Number Security in Python blog.ptsecurity.com
A study of Python's pseudorandom generators for web applications. Because a Python web process imports random once and keeps the Mersenne Twister state alive across requests, an attacker who can read random.random()…
RCE through mangled WAR upload into Tomcat App Manager using PUT-in-Gopher-over-XXE George Noseevich and Andrew Petukhov
ZeroNights 2012 deck chaining local file read and SSRF into full compromise of ForgeRock OpenAM on Tomcat. Blind XXE lists directories and reads configs, then gopher carries an HTTP PUT that uploads a store-compressed…
Same Origin Spoofing to Attack Client Certificate Sessions Tom Ritter
Shows SSL client certificates do not stop a server-impersonating attacker. Mallory completes a handshake without validating Alice's certificate, returns a page holding attacker script plus an iframe to the real site…
Scriptless Attacks: Stealing the Pie Without Touching the Sill Mario Heiderich, Marcus Niemietz, Felix Schuster, Thorsten Holz and Jörg Schwenk
A CCS 2012 paper asking what an attacker can still steal once JavaScript is blocked by CSP, NoScript or sandboxed iframes. It builds side channels from CSS, inactive SVG images and crafted attack fonts to measure and…
Self-Exfiltration: The Dangers of Browser-Enforced Information Flow Control Eric Y. Chen, Sergey Gorbaty, Astha Singhal and Collin Jackson
A W2SP paper arguing that restricting outgoing data by destination is inherently unsound. An attacker who cannot send stolen data to their own domain can instead stash it in a whitelisted site's own database, then fetch…
Signing Me onto Your Accounts through Facebook and Google Rui Wang, Shuo Chen and XiaoFeng Wang
A black-box field study of deployed web SSO: the authors capture browser-relayed messages between relying party and identity provider, label each element's semantics and what an adversary can read or write, then follow…
Steam Browser Protocol Insecurity Luigi Auriemma and Donato Ferrante
ReVuln turns local Steam bugs remote through the steam:// URL handler, which most browsers invoke with no warning or a truncated one, and which Steam's own browser can be made to follow via a YouTube link bounce. The…
Stiltwalker, exploits weaknesses in the audio version of reCAPTCHA dc949.org
Stiltwalker defeats audio CAPTCHAs with machine learning: an amplitude splitter cuts a challenge into single utterances, then a neural network plus MD5 and pHash lookup tables solve them. Successive rounds scored 99.1%…
Stuffing Javascript into DNS names Ron Bowes
DNS responses are almost never filtered, so the dnsxss tool answers CNAME, MX, TXT and NS lookups with JavaScript. Three sites taken from a single Google query all rendered the injected script, and the post argues the…
The "I Know..." series. What websites know about you Jeremiah Grossman
The opening post of a WhiteHat Security series on what any website can learn about its visitors. It revisits earlier tricks such as visited-link history sniffing, autocomplete theft and login detection, notes that most…
The Devil is in the (Implementation) Details: An Empirical Analysis of OAuth SSO Systems San-Tsai Sun and Konstantin Beznosov
A black-box study of three OAuth 2.0 identity providers and 96 Facebook relying parties, tracing SSO credentials through browser HTTP traffic with a Firefox add-on and semi-automatic exploit tools. Access tokens leaked…
The Diviner — Black-box Inference of Server-side Data Flow Shay Chen and Eran Tamari
A ZAP extension varies inputs, request history, authentication and sessions, then follows effects across pages. Repeating a scenario without its input step distinguishes session-scoped from persistent effects. It turns…
The Most Dangerous Code in the World Martin Georgiev, Subodh Iyengar, Suman Jana, Rishita Anubhai, Dan Boneh and Vitaly Shmatikov
Black-box fuzzing with self-signed and mismatched-name certificates, plus source and decompiler review, showed SSL certificate validation is broken across non-browser software: Amazon and PayPal merchant SDKs, EC2 and…
Top-Level Universal XSS superevr
Internet Explorer's PlainHostName rule maps any dotless hostname to the Local Intranet Zone, so sites served at a bare TLD such as http://ac/ load with reduced origin checks and no XSS filter. An XSS on such a host…
Touching from a Distance: Website Fingerprinting Attacks and Defenses Xiang Cai, Xin Cheng Zhang, Brijesh Joshi and Rob Johnson
Shows application-level traffic-analysis defences fail: an SVM using Damerau-Levenshtein distance over packet-direction traces guessed which of 100 pages a Tor or SSH user loaded 83-92% of the time, defeating HTTPOS…
UI Redressing Mayhem: Firefox 0-Day And The LeakedIn Affair Luca De Fulgentis
Mozilla had killed cross-domain drag and drop, so this post revives it by framing both the victim page and the attacker's dropper page as two iframes of one malicious page, a case Firefox 17.0.1 never checked. Applied…
UI Redressing Mayhem: HTTPOnly Bypass PayPwn Style Luca De Fulgentis
CVE-2012-0053 makes Apache echo request headers into a 400 error page, so an overlong cookie forces HttpOnly session cookies into readable HTML. On PayPal a history.paypal.com endpoint set an attacker-controlled monster…
Using HTTP headers pollution for mobile networks attacks Eduard Kovacs
Softpedia reports Bogdan Alecu's EUSecWest research on mobile operator portals. Carriers and their content partners identify subscribers by HTTP headers injected at the gateway, so adding or altering those headers lets…
Using POST method to bypass IE-browser protected XSS seckb.yehg.net
A short note testing browser XSS filters against POST-delivered payloads. Chrome and Safari block both GET and POST reflected XSS, but Internet Explorer's XSS Filter only inspects GET, so the same payload posted in a…
Using the HTML5 Fullscreen API for Phishing Attacks Feross Aboukhadijeh
A link whose status bar shows a bank's real URL instead calls preventDefault on click, enters HTML5 fullscreen, and paints screenshot-based OS and browser chrome matched to the visitor's platform, padlock included…
Using WordPress as a intranet and internet port scanner GitHub
A Ruby tool that turns WordPress blogs into port scanners. The Pingback API, exposed over XML-RPC, makes the blog server fetch an attacker-supplied URL, so responses reveal whether a host and port are open behind the…
Visitor Tracking Without Cookies (or How To Abuse HTTP 301s) scatmania.org
Demonstrates visitor tracking that stores no cookie by abusing cached permanent redirects. A script tag requests a fixed URL, the server issues a 301 to a per-user address carrying a fresh identifier, and the browser…
WAFFle: Fingerprinting Filter Rules of Web Application Firewalls Isabell Schmitt and Sebastian Schinzel
WAFFle recovers a web application firewall's filter rules through a timing side channel: blocked and passed requests differ measurably even for transparent WAFs that alter no response. Driving it indirectly through CSRF…
Web-based Attacks on Host-Proof Encrypted Storage Karthikeyan Bhargavan and Antoine Delignat-Lavaud
The WOOT 2012 abstract page for an attack study on host-proof applications such as Wuala and LastPass, which encrypt data in the client and treat the server as a backup store. Ordinary web vulnerabilities in their…
Why Eve and Mallory Love Android: An Analysis of Android SSL (In)Security Sascha Fahl, Marian Harbach, Thomas Muders, Matthew Smith, Lars Baumgärtner and Bernd Freisleben
A static analysis of 13,500 free Google Play apps with the authors' MalloDroid tool found 1,074 containing SSL/TLS code open to man-in-the-middle attack. A manual audit of 100 of them yielded working MITM against 41…
X-Frame-Options (XFO) Detection from Javascript Jeremiah Grossman
Frames blocked by X-Frame-Options never fire their onload handler. Creating a hidden iframe whose onload removes it from the DOM, then checking a few seconds later whether the element still exists, tells a script…
X-Frame-Options gotcha James Kettle
Explains a limitation of SAMEORIGIN framing checks in nested frames and how it can weaken clickjacking defenses when a same-origin framing page exists. The article contrasts this behavior with DENY and discusses the…
XSS-FP: Browser Fingerprinting using HTML Parser Quirks Erwan Abgrall, Yves Le Traon, Martin Monperrus, Sylvain Gombault, Mario Heiderich and Alain Ribault
Proposes fingerprinting a browser by the quirks of its HTML parser, probed through XSS injection points. Feeding malformed markup and observing how each engine repairs it identifies the exact browser type and version…
Yes, you can have fun with downloads lcamtuf.blogspot.com
Any document can navigate a non-same-origin window, and the target need not be HTML. Pointing it at a resource served with Content-Disposition: attachment leaves the victim window's address bar unchanged while a…
You Are What You Include: Large-scale Evaluation of Remote JavaScript Inclusions Nick Nikiforakis, Luca Invernizzi, Alexandros Kapravelos, Steven Van Acker, Wouter Joosen, Christopher Kruegel, Frank Piessens and Giovanni Vigna
A crawl of 3.3 million pages across the Alexa top 10,000 found 8.4 million remote script inclusions drawn from 20,225 hosts, and a quality-of-maintenance metric scored each provider. Four new fault classes appeared…