Top 10 Web Hacking Techniques

2014

The 2014 Top 10 Web Hacking Techniques: all 10 winners and 71 nominated and collected techniques, each with its researcher, summary and preserved source.

71 records · 10 in the top ten · open this year in the interactive archive

The top ten

#1 Heartbleed Codenomicon Ltd. http://www.codenomicon.com/
A missing bounds check in OpenSSL's TLS heartbeat extension lets any peer ask for more bytes than it supplied and receive up to 64KB of adjacent process memory, repeatable without limit. It leaks private keys, user…
#2 ShellShock cve.mitre.org
Shellshock: GNU Bash through 4.3 keeps executing text that trails a function definition stored in an environment variable. Any path that carries attacker-controlled data into the environment across a privilege boundary…
#3 Poodle Bodo Möller, Thai Duong and Krzysztof Kotowicz
POODLE exploits SSL 3.0's unauthenticated CBC padding: an attacker who forces browsers down the version fallback dance can replace a ciphertext block and read the server's accept-or-reject answer as a padding oracle…
#4 Rosetta Flash Michele Spagnuolo
Rosetta Flash converts any SWF into one built only from alphanumeric characters, using ad-hoc Huffman encoders and Adler-32 checksum bruteforcing, so the file can be passed as a JSONP callback and reflected by the…
#5 Residential Gateway "Misfortune Cookie" @mike_mimoso
More than 12 million home routers and residential gateways run the RomPager embedded webserver, where a single crafted HTTP cookie corrupts memory and hands an attacker remote administrative control from the internet…
#6 Hacking PayPal Accounts with 1 Click Yasser Ali
PayPal's anti-CSRF Auth token turned out to be reusable, and a valid one could be picked up before logging in from the send-money page, making it usable against any account. Paired with a security-question setup request…
#7 Google Two-Factor Authentication Bypass Kelsey Campbell-Dollaghan
A developer lost his Instagram account despite Gmail two-factor authentication, because his mobile carrier was talked into forwarding his phone number and the attackers received the reset codes. It shows phone-based…
#8 Apache Struts ClassLoader Manipulation Remote Code Execution Lukasz Lenart
The Struts S2-020 bulletin covers two issues fixed in 2.3.16.1: Commons FileUpload 1.3 allows denial of service, and ParametersInterceptor accepts a class parameter mapped to getClass(), letting a remote attacker…
#9 Facebook hosted DDOS with notes app chr13
Facebook Notes accepts img tags and Facebook's crawler fetches every external URL, with its cache defeated by random query parameters. One note holding 1000 unique URLs makes over 100 Facebook servers hit the target at…
#10 Covert Timing Channels based on HTTP Cache Headers Denis Kolegov, Oleg Broslavsky and Nikita Oleksov
Covert channels built from HTTP cache validation headers: two parties encode bits by whether Last-Modified or ETag changes within a timed window, read back through If-Modified-Since, If-Unmodified-Since, If-Match and…

Also collected

A Web Traffic Analysis Attack Using Only Timing Information Saman Feghhi and Douglas J. Leith
An attack that identifies which web page a user fetched over an encrypted tunnel from uplink packet timing alone, using no packet sizes. Because it ignores size, padding defences do not stop it, and it needs no…
Advanced Exploitation of Mozilla Firefox Use-After-Free Vulnerability (Pwn2Own 2014) CVE-2014-1512 Arno
A JavaScript heap spray drives Firefox into its low-memory state, which frees a BumpChunk object while a stale reference to it survives. Replacing the object with a sprayed ArrayBuffer gives a partially controlled write…
AIR Flash RCE from PWN2OWN Chris Brook
Adobe shipped fixes for four critical Flash Player and AIR flaws, among them the use-after-free Vupen used at Pwn2Own. That bug was chained with a JIT spray and a sandbox escape to execute code through Flash inside…
All Your Screens Are Belong to Us: Attacks Exploiting the HTML5 Screen Sharing API Yuan Tian, Ying-Chuan Liu, Amar Bhosale, Lin-Shung Huang, Patrick Tague and Collin Jackson
The HTML5 screen sharing extension to getUserMedia creates a cross-origin feedback loop: a site the user shares their screen with sees everything rendered, whatever its origin. An attacker opens authenticated…
An Expressive Model for the Web Infrastructure: Definition and Application to the BrowserID SSO System Daniel Fett, Ralf Küsters and Guido Schmitz
A Dolev-Yao style formal model of the web infrastructure covering HTTP, DNS, browsers, cookies, web storage and cross-document messaging, precise enough to analyse real applications. Applied to Mozilla's BrowserID…
Belkin Buffer Overflow via Web Marco Vaz
An unauthenticated POST to the Belkin N750 guest network web interface overflows a strcpy buffer and overwrites two adjacent heap variables, one that forces a CGI to run and one holding the CGI name passed to popen…
Breaking and Fixing Origin-Based Access Control in Hybrid Web/Mobile Application Frameworks Martin Georgiev, Suman Jana and Vitaly Shmatikov
Hybrid app frameworks such as PhoneGap hand web code JavaScript bridges to device resources but never apply the same origin policy to them, so foreign-origin content inside the app, typically ads in iframes, can call…
Bypassing HTTP Strict Transport Security Jose Selvi
An attacker who can intercept a machine's unauthenticated NTP traffic can push its clock far into the future, expiring stored HSTS policies and even preloaded entries, so the browser talks plain HTTP again and SSLStrip…
Bypassing NoCAPTHCA Egor Homakov
Google's No CAPTCHA reCAPTCHA is really a cookie-based whitelist: trusted users get a token, everyone else still solves the old OCR-breakable challenge. The widget can be loaded with another site's sitekey, its referrer…
Canadian Beacon WhiteHat Security
Demonstrates JavaScript port scanning of a visitor's internal network from an ordinary web page, using the Beacon and performance timing APIs against hidden iframes in place of the old iframe onload trick. A hostile…
Comma Separated Vulnerabilities (archived original) James Kettle
Examines the risks of exporting untrusted web application data to spreadsheets, where cells may be interpreted as formulas. The original 2014 article discusses trust boundaries, a disclosed spreadsheet vulnerability…
Covert Redirect Vulnerability Related to OAuth 2.0 and OpenID Wang Jing
OAuth 2.0 and OpenID providers accept loosely validated redirect targets pointing at domains a client has whitelisted but which carry open redirect or XSS flaws. Chaining the two makes the provider hand an access token…
Cryptophp Backdoor Swati Khandelwal
CryptoPHP is a backdoor hidden inside pirated WordPress, Joomla and Drupal plugins and themes that administrators install for free. Once running on the server it gives its operators public-key encrypted command and…
CTA: The weaknesses in client side xss filtering targeting Chrome's XSS Auditor blackhat.com
Capture of the full Black Hat USA 2014 Briefings programme; the cited talk within it, Call To Arms, reports 17 flaws in Chrome's XSS Auditor that let an attacker rewrite an injection so the client-side filter passes it…
Delta Boarding Pass Spoofing Dani Grant
Delta's web boarding passes were addressed by a guessable URL with no ownership check, so editing it returned another passenger's pass, including passengers flying other airlines. That exposed their travel details and…
Detecting Logic Vulnerabilities in E-Commerce Applications Fangqi Sun, Liang Xu and Zhendong Su
A static analysis that combines symbolic execution with taint tracking to find logic flaws in PHP e-commerce checkout code, using the invariant that a secure checkout preserves the integrity and authenticity of order…
Do not trust me: Using malicious IdPs for analyzing and attacking Single Sign-On Christian Mainka, Vladislav Mladenov and Jörg Schwenk
Uses an attacker-controlled identity provider to examine OpenID discovery, association and token verification. OpenID Attacker tests recipient confusion, key confusion, identity spoofing and discovery spoofing against…
Drupal 7 Core SQLi drupal.org
A flaw in Drupal 7's database abstraction API let an anonymous attacker send specially crafted requests that executed arbitrary SQL, leading on to privilege escalation and arbitrary PHP execution. Rated 25 of 25 highly…
Effective Attacks and Provable Defenses for Website Fingerprinting Tao Wang, Xiang Cai, Rishab Nithyanand, Rob Johnson and Ian Goldberg
A k-nearest-neighbour classifier over a large weighted feature set lets a passive local eavesdropper tell which of 100 monitored pages a Tor user is loading, at 85 percent true positive and 0.6 percent false positive in…
EL 3.0/Lambda Injection: Hacker Friendly Java Shay Chen
Java EL3 implicitly exposes java.lang classes, allowing injected expressions to access system properties or execute commands without custom imports. Its semicolon operator chains expressions, extending exploitation to…
File Name Enumeration in Rails HackerOne
A path traversal in the way Rails served static assets: a URL of the form //%5C../%5C../etc/passwd, using percent-encoded backslashes, escaped the document root. Existing and non-existing paths produced different…
FlashFlood WhiteHat Security
FlashFlood is a demonstration script that makes a visitor's browser fire large numbers of HTTP requests, varying a parameter value each time so caching layers such as Varnish are bypassed and every request lands on the…
Google User De-Anonymization Michael Mimoso
Andrew Cantino's timing attack de-anonymises a chosen Google user: silently share a Google document with the target's address, then load it as an image and time the onerror callback. Loading averaged 891 ms when the…
HikaShop Object Injection Sucuri Blog
The Joomla HikaShop extension passed base64-decoded user input straight to unserialize, allowing PHP object injection. Sucuri chains JDatabaseDriverMysqli's destructor into PHPMailer's sendmail path and abuses…
History theft with CSS Boolean algebra Michal Zalewski
Explores how color quantization and layered CSS can form Boolean logic and combine visited-link states in an interactive history-disclosure demonstration. Discusses browser restrictions and practical limits. Static…
Hostile Subdomain Takeover using Heroku/Github/Desk + more Detectify
Organisations point subdomains at hosted services such as Heroku, GitHub, Desk, Shopify or Squarespace, then stop using the service without removing the DNS record. Anyone can claim that hostname at the provider and…
How I hacked GitHub again homakov.blogspot.com
Chains five low-severity GitHub OAuth bugs: redirect_uri path traversal with slash-dot-dot, no redirect_uri check at the token endpoint, a Camo proxy bypass that leaks the code through the Referer, Gist exposing the…
How I hacked Instagram to see your private photos Christian Lopez
Instagram's mobile API accepted the set_public and set_private account actions without any CSRF token and without checking that the request came from the mobile app, so a plain HTML form on an attacker page could flip a…
Linskys E420 Authentication Bypass Disclosure phrag
A Linksys E4200 v2 running firmware 2.0.37 serves the same administration interface on TCP port 8083 with HTTP authentication skipped entirely, so anyone who can reach the device gets full admin control. The firmware…
MACE: Detecting Privilege Escalation Vulnerabilities in Web Applications Maliheh Monshizadeh, Prasad Naldurg and V.N. Venkatakrishnan
MACE infers a web application's intended access control from its own source by checking that authorization state is enforced consistently, so missing or incorrect checks stand out even without a written policy. Run over…
Microsoft SChannel Vulnerability us-cert.gov
A US-CERT alert on a critical flaw in Microsoft's Schannel security package, which implements SSL and TLS on Windows. Specially crafted network traffic can execute arbitrary code on both client and server applications…
Misfortune Cookie -- TR-069 ACS Vulnerabilities in residential gateway routers Check Point Software Technologies and @jifa
CVE-2014-9222 in the AllegroSoft RomPager embedded web server: a crafted HTTP cookie corrupts memory in the cookie handling code and makes the device treat the current session as administrative. One packet to a public…
MSIE Flash 0day targeting french aerospace Alex Watson and Victor Chin
Websense traced in-the-wild use of the Internet Explorer 10 use-after-free CVE-2014-0322 to three weeks earlier than previously known, served from a lookalike domain imitating the French aerospace association GIFAS. A…
NODE.JS CONNECT CSRF BYPASS ABUSING METHODOVERRIDE MIDDLEWARE blog.nibblesec.org
In Node.js Connect and Express, middleware runs in declaration order, so registering csrf before methodOverride lets an attacker send a GET request carrying _method=POST or an x-http-method-override header. The CSRF…
OpenSSL CVE-2014-0224 cve.mitre.org
MITRE's record for CVE-2014-0224, the OpenSSL CCS Injection flaw. A man in the middle sends ChangeCipherSpec messages early in the handshake so both endpoints derive a zero-length master key, letting the attacker…
Password Managers: Attacks and Defenses David Silver, Suman Jana, Dan Boneh, Eric Chen and Collin Jackson
A survey of ten browser and third-party password managers finds their autofill policies differ widely, and several fill credentials into pages a network attacker controls. From a rogue router an attacker can inject…
Paypal Manager Account Hijack Mark Litchfield
A chained attack on PayPal Manager: Burp Intruder enumerates valid vendor accounts by response length, a reused password-reset token bypasses the security question, and removing the Referer header completes the reset…
PXSS on long length videos to DOS Dennis Fisher
Incapsula traced a DDoS to stored XSS on a major video site: script hidden in a commenter's profile image ran for every viewer and opened a hidden iframe to the attacker's control domain, making each browser issue a…
Recursive DNS Resolver (DOS) Garret Wassermann
A malicious authoritative DNS server can answer queries with an endless chain of delegations. Recursive resolvers that follow referrals without a limit, and that issue many simultaneous queries, exhaust memory and CPU…
Reflected File Download Oren Hafif
Reflected File Download turns a trusted site into a malware host without any upload: a URL whose input is reflected into the response, typically a JSON or JSONP API, is given extra permissive path segments so the…
Relative Path Overwrite Gareth Heyes
Relative Path Overwrite adds a trailing slash or fake directory segments to a URL so a page's relative stylesheet reference resolves back to the page itself. The browser then parses the HTML as CSS, and…
Remote File Upload Vulnerability in WordPress MailPoet Plugin (wysija-newsletters) Sucuri Blog
The WordPress MailPoet plugin assumed the admin_init hook only fires for logged-in administrators, but any request to admin-post.php runs it too. That left the theme upload path reachable without authentication, so…
Revisiting SSL/TLS Implementations: New Bleichenbacher Side Channels and Attacks Christopher Meyer, Juraj Somorovsky, Eugen Weiss, Jörg Schwenk, Sebastian Schinzel and Erik Tews
Four new Bleichenbacher oracles in the TLS RSA handshake: a JSSE error-message difference, OpenSSL timing, Java exception-handling timing, and a Cavium NITROX chip that leaks whether decrypted data starts 0x?? 02. Three…
RevSlider @sucurisecurity
The Slider Revolution WordPress plugin exposed an admin-ajax action that returned whatever file path it was handed, so an unauthenticated attacker could download wp-config.php and take the database credentials. It was…
S3: A Symbolic String Solver for Vulnerability Detection in Web Applications Minh-Thai Trinh, Duc-Hiep Chu and Joxan Jaffar
S3 is a symbolic string solver built on Z3-str that covers the main JavaScript string operations plus regular-expression membership and the Kleene star, encoding them as string equations and generating a bounded set of…
Same Origin Bypass in Adobe Reader CVE-2014-8453 insert-script.blogspot.com
Four Adobe Reader flaws presented at HackPra: GoToE and GoToR actions ignore protocol restrictions so a PDF can reach file:// and other local schemes, app.trustPropagatorFunction can be abused to reach privileged…
Same Origin Method Execution (SOME) Ben Hayak
Same Origin Method Execution abuses callback endpoints such as JSONP handlers and Flash applets, whose callback parameter is echoed into executable script. By opening windows and redirecting their documents, an attacker…
setTimeout Clickjacking blog.whitehatsec.com
A clickjacking demo against Flash camera and microphone permissions: opacity still hides the Flash prompt in Chrome, and a user-initiated popup later sent to a data: URL whose declared charset is padded with a fake…
Soaksoak WordPress Malware Sucuri Blog
The SoakSoak campaign compromised over a hundred thousand WordPress sites, correlating with the Slider Revolution plugin flaw. Attackers appended a wp_enqueue_script hook to wp-includes/template-loader.php so a trojaned…
SpoofedMe — Intruding Accounts using Social Login Providers Or Peles and Roee Hay
Examines social-login impersonation when providers issue unverified email attributes and relying applications use them to locate or link accounts. The paper compares LinkedIn, Amazon and MYDIGIPASS flows, separating…
SSOScan: Automated Testing of Web Applications for Single Sign-On Vulnerabilities Yuchen Zhou and David Evans
SSOScan automatically signs into a website with Facebook single sign-on, completes registration, then replays and inspects OAuth credentials to test five integration flaws. A scan of 20,000 sites found 345 of the 1,660…
Static Detection of Second-Order Vulnerabilities in Web Applications Johannes Dahse and Thorsten Holz
Web applications often store attacker input in a database, session key or file name and use it in a sensitive sink much later, so taint analysis that stops at one request misses it. This work models those persistent…
The Emperor's New Password Manager: Security Analysis of Web-based Password Managers Zhiwei Li, Warren He, Devdatta Akhawe and Dawn Song
A security analysis of five browser-based password managers, grouping their weaknesses into bookmarklet, web, authorization and user interface flaws. In four of the five, chained mistakes such as CSRF, XSS and broken…
The PayPal 2FA Bypass Jon Oberheide
PayPal's servers issued fully authenticated session tokens once a username and password were accepted, before the second factor was checked, and the mobile app enforced the logout only on the client. Switching the phone…
The Web Never Forgets: Persistent Tracking Mechanisms in the Wild Gunes Acar, Christian Eubank, Steven Englehardt, Marc Juarez, Arvind Narayanan and Claudia Diaz
Instrumented-browser crawls of the top 100,000 sites give the first in-the-wild measurement of canvas fingerprinting, evercookie respawning and cookie syncing. Trackers draw hidden canvas text to derive a stable device…
Toward Black-Box Detection of Logic Flaws in Web Applications Giancarlo Pellegrino and Davide Balzarotti
A black-box method that infers a behavioural model of a web application from recorded HTTP traces, abstracts requests into resources, then generates test cases that replay, reorder or skip steps to break the intended…
Triple Handshakes and Cookie Cutters: Breaking and Fixing Authentication over TLS Karthikeyan Bhargavan, Antoine Delignat-Lavaud, Cédric Fournet, Alfredo Pironti and Pierre-Yves Strub
A man-in-the-middle can synchronise the master secret across two TLS connections by chaining RSA or Diffie-Hellman key exchange, session resumption and renegotiation, so the client's later authentication is redirected…
TweetDeck XSS Michael Mimoso
TweetDeck rendered tweet content as live markup, so a script tag inside a tweet executed in every reader's client. The published payload used the client's own retweet control to repost itself, producing a self-spreading…
Unauthenticated Backup and Password Disclosure In HandsomeWeb SOS Webpages cve-2014-3445 Portcullis
HandsomeWeb SOS Webpages leaves backup.php reachable without authentication, and when the MD5 key parameter is wrong the error message returns the correct key. Replaying that key downloads the site's backup files, which…
Using Frankencerts for Automated Adversarial Testing of Certificate Validation in SSL/TLS Implementations Chad Brubaker, Suman Jana, Baishakhi Ray, Sarfraz Khurshid and Vitaly Shmatikov
Generates frankencerts by randomly mutating parts of millions of real X.509 certificates, then differentially tests eight SSL/TLS libraries against each other so that any disagreement flags a validation bug. Found 208…
Virtual Host Confusion: Weaknesses and Exploits Antoine Delignat-Lavaud and Karthikeyan Bhargavan
HTTPS servers routinely serve many origins behind one certificate and one IP address. Shared TLS session caches, session tickets and SPDY connection reuse let an attacker who controls any single domain on a multi-domain…