Top 10 Web Hacking Techniques
2013
The 2013 Top 10 Web Hacking Techniques: all 10 winners and 53 nominated and collected techniques, each with its researcher, summary and preserved source.
53 records · 10 in the top ten · open this year in the interactive archive
The top ten
-
#1
Mario Heiderich -- Mutation XSS
Mario Heiderich, Jörg Schwenk, Tilman Frosch, Jonas Magazinius and Edward Z. Yang
Reading innerHTML makes browsers rewrite markup, so a string that passes every server- and client-side XSS filter can be mutated into a live vector. Seven mutations are named - backticks as attribute delimiters, XML…
-
#2
Angelo Prado, Neal Harris, Yoel Gluck -- BREACH
Michael Mimoso
Report on BREACH, presented at Black Hat USA 2013 by Angelo Prado, Neal Harris and Yoel Gluck. Where CRIME attacked TLS compression, BREACH attacks HTTP-level gzip: the attacker reflects guessed characters into a…
-
#3
Pixel Perfect Timing Attacks with HTML5
Paul Stone
Paul Stone demonstrates browser timing attacks using SVG filters to recover pixels and distinguish visited links. The OCR proof of concept recognises hexadecimal text by sampling four distinct pixels per character, with…
-
#4
Lucky 13 Attack
Nadhem AlFardan and Kenny Paterson
TLS and DTLS CBC decryption runs measurably faster when a record carries at least two bytes of valid padding, because the 13-byte MAC header aligns hash compression blocks differently. Timing TLS error messages on a LAN…
-
#5
Weaknesses in RC4
Nadhem AlFardan, Dan Bernstein, Kenny Paterson, Bertram Poettering and Jacob Schuldt
Measured the keystream biases of RC4 as used in TLS and turned them into plaintext recovery. A single-byte-bias attack over the first 256 keystream bytes recovers 220 bytes of a repeated plaintext from roughly 2^30…
-
#6
Timur Yunusov and Alexey Osipov -- XML Out of Band Data Retrieval
Timur Yunusov and Alexey Osipov
A Black Hat EU talk on pulling data out of XML parsers that return neither errors nor document output. Nested parameter entities loaded from an attacker-controlled external DTD smuggle file contents into a URL, and…
-
#7
Million Browser Botnet
Jeremiah Grossman and Matt Johansen
Grossman and Johansen show ad networks will run arbitrary attacker JavaScript, so a $0.15 CPM buy rents a million browsers with no exploit or malware. The rented browsers do CSRF, login detection, deanonymisation…
-
#8
Large Scale Detection of DOM based XSS
Sebastian Lekies, Ben Stock and Martin Johns
Chromium's V8 engine and its WebKit DOM were patched to track taint byte by byte, so every character arriving at a sink carried its source and any encoding applied. Knowing the exact syntactic context let the tool build…
-
#9
Tor Hidden-Service Passive De-Cloaking
Robert Hansen
A passive method for locating the real host of a Tor hidden service: bots on Tor poll the service while a feed of Internet outages is watched, and when every bot loses it at the moment of a known network break, the…
-
#10
HTML5 Hard Disk Filler™ API
Feross Aboukhadijeh
The Web Storage spec asks browsers to stop affiliated sites pooling localStorage quota, but Chrome, Safari and IE enforced the limit strictly per origin. Writing from many subdomains of one domain therefore gave a page…
Also collected
-
A Perfect CRIME? Only TIME Will Tell
Tal Be’ery and Amichai Shulman
Extends compression-leak research in two separate demonstrations: browser JavaScript measures a one-byte request-size difference amplified at a TCP acknowledgement boundary, while response-length observations recover a…
-
A View to a Kill: WebView Exploitation
Matthias Neugschwandtner, Martina Lindorfer and Christian Platzer
WebView lets a mobile app expose native functionality and device data to web content it loads, so an attacker who controls that content inherits the app's permissions. The paper sets out the threat scenario, works it…
-
Aaron Patterson -- Serialized YAML Remote Code Execution
Aaron Patterson
Rails security advisory for CVE-2013-0277. Active Record's serialize helper stores objects as YAML in a BLOB column, so any application letting users assign directly to a serialized attribute lets an attacker supply…
-
Analyzing Unique-Bid Auction Sites for Fun and Profit
Ory Samorodnitzky, Eran Tromer and Avishai Wool
Sampled a live highest-unique-bid auction site fast enough to snapshot its redacted position tables at each transaction, then recovered the hidden bids by back-propagating from the final exposed results using…
-
Ashar Javad Attack against Facebook's password reset process.
Ashar Javed
An attacker already on the victim's friend list starts a Facebook password reset, supplies a fresh email address, and has the three Trusted Friends confirmation codes sent to accounts he controls; POST-data manipulation…
-
AUTHSCAN: Automatic Extraction of Web Authentication Protocols from Implementations
Guangdong Bai, Jike Lei, Guozhu Meng, Sai Sathyanarayan Venkatraman, Prateek Saxena, Jun Sun, Yang Liu and Jin Song Dong
AUTHSCAN records browser HTTP traces and JavaScript execution, then infers an authentication protocol spec in an intermediate language (TML) via dynamic symbolic analysis plus blackbox differential fuzzing. The spec…
-
Auto-Complete Hack by Hiding Filled in Input Fields with CSS
Joost de Valk
Chrome's autocompletetype form filling populates fields the page has hidden with CSS, so a signup form that visibly asks only for an email can silently harvest a full postal address and card details. A live test page…
-
Automated Password Extraction Attack on Modern Password Managers
Raul Gonzalez, Eric Y. Chen and Collin Jackson
Lupin makes a browser's own password manager give up saved credentials: a network attacker injects a login form into any non-HTTPS page and the manager autofills it, including passwords for sites the victim is not…
-
Carlos Munoz -- Bypassing Internet Explorer's Anti-XSS Filter
Carlos Munoz
Internet Explorer's reflective XSS filter only inspected data that would execute immediately, and marked anything else trusted for later requests. Injecting a script tag with parts written as HTML decimal or hexadecimal…
-
Cody Collier -- Exposing Verizon Wireless SMS History
The State of Security
Verizon Wireless's customer portal let a user edit the phone number in the text-message-history URL and read another subscriber's SMS records, including the numbers they messaged. Only the target's mobile number was…
-
Compromising an unreachable Solr Serve
Nicolas Grégoire
Gregoire turns an XXE in a Java app into compromise of an unreachable Solr server: the XXE port-scans internally, finds Solr on 8983, then abuses Solr's XSLT response writer with a tr=../../ traversal to load an…
-
Cookieless Monster: Exploring the Ecosystem of Web-Based Device Fingerprinting
Nick Nikiforakis, Alexandros Kapravelos, Wouter Joosen, Christopher Kruegel, Frank Piessens and Giovanni Vigna
A study of commercial web-based device fingerprinting: the scripts then sold by fingerprinting firms were analysed for what they collect beyond documented browser APIs and how widely sites deployed them. It also showed…
-
Cross-Site Scripting Attacks in Social Network APIs
Yuqing Zhang, Xiali Wang, Qihan Luo and Qixu Liu
The authors name Cross-API Scripting: XSS carried through RESTful social-network APIs, where the network and its third-party apps each assume the other escapes user data. A fuzzer injected test vectors into configured…
-
DOM Clobbering
Gareth Heyes
How named DOM access lets markup overwrite script variables. Two elements sharing an id or name become an HTML collection reachable as a global, self-referencing indefinitely and shadowing the element's own properties…
-
Eradicating DNS Rebinding with the Extended Same-Origin Policy
Martin Johns, Sebastian Lekies and Ben Stock
The HTML5 Offline AppCache lets an attacker keep script cached until the browser's DNS pinning lapses, making DNS rebinding reliable in every major browser; a two-domain variant survives cache revalidation and repeats…
-
Explicating SDKs: Uncovering Assumptions Underlying Secure Authentication and Authorization
Rui Wang, Yuchen Zhou, Shuo Chen, Shaz Qadeer, David Evans and Yuri Gurevich
Wang, Zhou and colleagues build semantic models of Facebook and Microsoft authentication SDKs together with the runtime systems beneath them, then use a formal analysis tool to reason over every app buildable on each…
-
Exploiting Innocuous Activity for Correlating Users Across Sites
Oana Goga, Howard Lei, Sree Hari Krishnan Parthasarathi, Gerald Friedland, Robin Sommer and Renata Teixeira
Researchers matched accounts across Yelp, Flickr and Twitter using only metadata that comes with posting: geotag clusters, post timestamps and word-unigram language models, compared by cosine distance and fused with…
-
Father/Daughter Team Finds Valuable Facebook Bug
Dennis Fisher
Renee Wysopal, interning at Veracode with no security background, was shown a web proxy by her father Chris and went after Facebook's privacy and permission model. She noticed a blocked user's posts still on her…
-
Finding Weak Rails Security Tokens
AverageSecurityGuy
Rails signs session cookies with a secret token, and tokens committed to public GitHub repositories stay usable. Cookies were gathered from roughly 20,000 Shodan-found Rails servers and 40,000 Alexa sites, then matched…
-
FireDrill: Interactive DNS Rebinding
Yunxing Dai and Ryan Resig
DNS rebinding is normally stopped by browser DNS pinning, but flooding the browser's own DNS cache table evicts the pinned entry and lets a hostname be re-pointed at an internal server. FireDrill turns this into an…
-
Fireeye -- Arbitrary reading and writing of the JVM process
Brian Donohue
A Java zero-day found exploited in the wild against Java 6u41 and 7u15. Instead of the usual sandbox-permission tricks it targets the JVM's internal data structures for arbitrary memory read and write, zeroing memory to…
-
Gravatar Email Enumeration in JavaScript
Robert Hansen
Gravatar serves avatars keyed by the MD5 of an email address and can be told to return no image, so a page can load candidate hashes and read back the rendered image size cross-origin. A script builds addresses from a…
-
Hacker scans the internet
Dan Goodin
An anonymous researcher assembled the Carna botnet from 420,000 embedded devices that accepted blank or root/admin logins, then used them to port-scan the entire IPv4 space over nine months. The survey gathered more…
-
I Know the Shortened URLs You Clicked on Twitter
Jonghyuk Song, Sangho Lee and Jong Kim
Public click analytics from goo.gl and bit.ly are correlated with Twitter metadata - the source field of a tweet, the profile location - to tell whether a named user clicked a given link, without touching the victim…
-
Invisibility Purge / .NET Havoc
Shay Chen and Niv Sela
Hidden, disabled or commented ASP.NET and Mono controls can still expose executable server events. The slides map EventValidation and ViewState prerequisites, describe control enumeration and reuse of cached signed…
-
James Bennett -- Django DOS
Chris Brook
Django hashed submitted passwords with no length cap, so repeatedly posting very large passwords tied servers up in PBKDF2 work - about a minute for a one-megabyte password. Releases 1.4.8, 1.5.4 and 1.6 beta 4 reject…
-
Language-based Defenses Against Untrusted Browser Origins
Karthikeyan Bhargavan, Antoine Delignat-Lavaud and Sergio Maffeis
Script components sharing a page's origin, such as SSO buttons and crypto libraries, can be attacked by the host page and by neighbouring scripts, which browser policy alone cannot stop. The authors define Defensive…
-
One Bad Apple: Backwards Compatibility Attacks on State-of-the-Art Cryptography
Tibor Jager, Kenneth G. Paterson and Juraj Somorovsky
A standard that keeps a broken algorithm for backwards compatibility undermines the strong one when both share a key. A CBC decryption oracle is turned into a block-cipher inversion oracle that distinguishes AES-GCM…
-
Phil Purviance -- Don't Use Linksys Routers
Superevr
Five Linksys flaws disclosed after Cisco's patch fixed only an unrelated XSS: the WRT54GL still accepts cross-site firmware upload, and the EA2700 has XSS on apply.cgi, unauthenticated path traversal reading…
-
Practical HTTP Host Header Attacks
James Kettle
Applications build absolute URLs from the attacker-controlled HTTP Host header. Poisoning it redirects password-reset links to the attacker (Gallery, Django, Piwik, Joomla), while duplicate Host headers or an absolute…
-
Ruby on Rails Session Termination Design Flaw
G. S. McNamara
Rails' default CookieStore holds the whole session in the client cookie, so no server-side record exists to delete at logout. Logging out only issues a replacement cookie and the old one stays valid indefinitely…
-
Site Plagiarizes Blog Posts, Then Files DMCA Takedown on Originals
John Timmer
Ars Technica reports a DMCA takedown that ran backwards: an Indian site, NewsBulet.In, copied Retraction Watch's posts about disgraced Duke cancer researcher Anil Potti, then filed a copyright claim that made WordPress…
-
Slideshare
Jeremiah Grossman and Matt Johansen
Grossman and Johansen show that buying ordinary display-ad impressions is enough to run JavaScript in a million browsers at once. The ad-delivered code performs CSRF, login detection, intranet probing, distributed hash…
-
Struts 2 OGNL Double Evaluation RCE
communities.coverity.com
A Coverity write-up of the Struts 2 wildcard-mapping RCE: an action name of the form ${...} or %{...} reaches StrutsResultSupport.conditionalParse and is evaluated a second time as OGNL, so a URL alone reaches…
-
Take This Personally: Pollution Attacks on Personalized Services
Xinyu Xing, Wei Meng, Dan Doozan, Alex C. Snoeren, Nick Feamster and Wenke Lee
Xing and colleagues show the personalization engines behind YouTube, Amazon and Google search can be steered by outsiders. Third-party requests inject entries into a victim's profile without their knowledge, perturbing…
-
The Case of the Unconventional CSRF Attack in Firefox
Kuskos
Firefox 21 and earlier ignored the XHR rule that a HEAD request must have its body set to null, so send(data) after open("HEAD") still transmitted the body cross-origin with cookies attached. Against an application that…
-
The Postman Always Rings Twice: Attacking and Defending postMessage in HTML5 Websites
Sooel Son and Vitaly Shmatikov
A Chrome extension called RVSCOPE hooked addEventListener across the Alexa top 10,000 and harvested 136 distinct postMessage receivers used by 2,245 hosts. 65 did no origin check at all and 14 checked with broken…
-
Timothy Morgan -- What You Didn't Know About XML External Entity Attacks
Timothy D. Morgan
Morgan's AppSec USA 2013 deck pushes XXE past 'unexploitable'. Parameter entities plus a remote DTD wrap unreadable files in CDATA or exfiltrate them out-of-band through a dynamically built URL. He catalogues the URL…
-
Top 3 Proxy Issues That No One Ever Told You
Robert Hansen
Behind an inline caching proxy or cloud WAF the origin only ever sees the proxy's IP, so it trusts X-Forwarded-For. A null byte in that header name makes Apache answer 400 and rpaf log no client IP at all. TRACE sent…
-
Truncating TLS Connections to Violate Beliefs in Web Applications
Ben Smyth and Alfredo Pironti
TLS truncation lets an attacker cut off the tail of a response so browser and server end up disagreeing about what completed. The authors turned that desynchronisation into working attacks: casting votes on behalf of…
-
Unauthorized Origin Crossing on Mobile Platforms: Threats and Mitigation
Rui Wang, Luyi Xing, XiaoFeng Wang and Shuo Chen
Mobile OSes lack the browser's origin checks on cross-app channels, so intents, URL schemes and web-accessing utility classes let one app cross into another's web origin. Surveying those channels on Android and iOS, and…
-
When Tolerance Causes Weakness: The Case of Injection-Friendly Browsers
Yossi Gilad and Amir Herzberg
An off-path attacker running only a sandboxed script recovers the randomised client port by SYN-eliminating candidates and timing the script's connection attempts. Browsers treat a malformed HTTP response as a body with…
-
Zach Cutlip -- Remote Code Execution in Netgear routers
Dennis Fisher
Zach Cutlip found a command injection in the Netgear WNDR3700v4: cmd_ping6() sprintf()s an attacker-supplied host into a shell string passed to system(), so "; evil_command; #" runs as root. Chained with his separate…