Top 10 Web Hacking Techniques

2015

The 2015 Top 10 Web Hacking Techniques: all 10 winners and 70 nominated and collected techniques, each with its researcher, summary and preserved source.

70 records · 10 in the top ten · open this year in the interactive archive

The top ten

#1 FREAK (Factoring Attack on RSA-Export Keys) Zakir Durumeric, David Adrian, Ariana Mirian, Michael Bailey and J. Alex Halderman
FREAK lets a network attacker downgrade a TLS handshake to 512-bit export-grade RSA, factor that key cheaply, then decrypt or modify the HTTPS session. The site reports daily Internet-wide scans of vulnerable servers…
#2 LogJam Schneier on Security
Logjam lets a man-in-the-middle downgrade a TLS handshake to 512-bit export-grade Diffie-Hellman and then solve it, reading and altering the traffic. Because millions of servers reuse the same few primes, one huge…
#3 Web Timing Attacks Made Practical Timothy D. Morgan and Jason W. Morgan
Uses packet-sniffed, paired round-trip-time measurements and Monte Carlo comparisons of box-test and L-estimator classifiers to estimate how many samples a timing attack needs. Nanown packages collection, training and…
#4 Evading All Web Application filters Mazin Ahmed and @mazen160
#5 Abusing CDNs with SSRF Flash and DNS Mike Brooks and Matthew Bryant
Combines DNS reconnaissance, Akamai EdgeSuite’s legacy ARLv1 fetching, and vulnerable FlowPlayer plugin loading. ARLv1 can place a whitelisted FlowPlayer SWF under a trusted CDN subdomain; attacker-loaded plugins then…
#6 illusoryTLS Alfonso De Gregorio
An elliptic-curve asymmetric backdoor of the Young-Yung kind planted in the RSA key generation behind a single CA certificate. The backdoored public key is computationally indistinguishable from a genuine one, yet its…
#7 Exploiting XXE in File Upload Functionality Will Vandevanter
Shows how XXE can reach uploaded OOXML documents and XMP metadata in PDFs and image formats. Covers the oxml_xxe tool, document-part parsing, a Java XMP parser example, and testing for entity expansion, XSS, file access…
#8 Abusing XSLT for Practical Attacks Fernando Arnaboldi
XSLT 1.0 processors in browsers and on servers leak vendor and file path details, mis-handle large integers and real numbers, and seed random values weakly or not at all. Safari lets a stylesheet fetch cross origin URLs…
#9 Magic Hashes WhiteHat Security
PHP's == operator compares two hash strings numerically when both look like 0e followed only by digits, so both become the float zero and match. Submitting a precomputed magic value as a password, token or cookie…
#10 Hunting ASynchronous Vulnerabilities James Kettle
Bugs in background threads and second-order flows produce no output and no measurable delay, so they survive normal scanning. Sending payloads that make the target itself call back out of band, usually over DNS, exposes…

Also collected

A Messy State of the Union: Taming the Composite State Machines of TLS Benjamin Beurdouche, Karthikeyan Bhargavan, Antoine Delignat-Lavaud, Cédric Fournet, Markulf Kohlweiss, Alfredo Pironti, Pierre-Yves Strub and Jean Karim Zinzindohoue
Systematic testing of mainstream TLS stacks shows their composite state machines accept message sequences no valid handshake produces, because per-ciphersuite machines were merged carelessly. A network attacker can skip…
All Your Biases Belong to Us: Breaking RC4 in WPA-TKIP and TLS Mathy Vanhoef and Frank Piessens
Newly found statistical biases in the RC4 keystream make plaintext recovery practical against real protocols. An attacker who can have a secret repeatedly encrypted recovers an HTTPS session cookie with 94 percent…
Attack Surface for Project Spartan's EdgeHTML Rendering Engine Mark Vincent Yason
Maps the reachable attack surface of Microsoft's new EdgeHTML engine by diffing it against MSHTML, covering markup and style parsing, image, audio and video decoding, font rendering, DOM APIs and the Flash and PDF…
Automatically Detecting SSL Error-Handling Vulnerabilities in Hybrid Mobile Web Apps Chaoshun Zuo, Jianliang Wu and Shanqing Guo
Hybrid Android apps show web content in a WebView and frequently override the SSL error handler to call proceed, so the app keeps loading an HTTPS page whose certificate failed validation and can be intercepted. A…
Breaking HTTPS with BGP Hijacking Artyom Gavrichenkov
BGP prefix hijacks can be kept local to a few autonomous systems, so the victim sees no latency change and public looking glasses show nothing. An attacker hijacks the victim's prefix near a certificate authority for…
Cache Timing Attacks Revisited: Efficient and Repeatable Browser History, OS and Network Sniffing Chetan Bansal, Sören Preibusch and Natasa Milic-Frayling
Timing how fast a browser fetches a resource shows whether it was already cached, revealing where the victim has been. Driving the probes from Web Workers at roughly 300 requests a second, with timeouts so probing does…
Cashing Out the Great Cannon? On Browser-Based DDoS Attacks and Economics Giancarlo Pellegrino, Christian Rossow, Fabrice J. Ryba, Thomas C. Schmidt and Matthias Wählisch
Ordinary visitors' browsers can be conscripted into a DDoS botnet by JavaScript delivered through malicious ads, typosquatted domains or an in-path injector like the Great Cannon, with three JavaScript techniques each…
CNNINC SSL MitM Mozilla Security Blog
An unconstrained intermediate certificate issued by CNNIC was installed in a customer traffic-inspecting firewall, which then generated certificates for domains that operator did not own; browsers accepted them without…
Cookies Lack Integrity: Real-World Implications Xiaofeng Zheng, Jian Jiang, Jinjin Liang, Haixin Duan, Shuo Chen, Tao Wan and Nicholas Weaver
Cookies carry no indication of how they were set, so a temporary man-in-the-middle on any plain HTTP request, or a web attacker on a related domain, can plant cookies that the browser then sends on later HTTPS…
Counterfeit Object-oriented Programming: On the Difficulty of Preventing Code Reuse Attacks in C++ Applications Felix Schuster, Thomas Tendyck, Christopher Liebchen, Lucas Davi, Ahmad-Reza Sadeghi and Thorsten Holz
Counterfeit object-oriented programming chains a C++ program's own virtual functions, driven through an existing loop over attacker-forged objects, so a code-reuse payload needs no return addresses and no injected…
Critical Vulnerabilities in JSON Web Token Libraries chosenplaintext.ca
JWT lets the token itself name the algorithm used to verify it, so an attacker chooses the verification method. Many libraries accepted alg none as a validly signed token, and when handed an HS256 token treated the…
Cross-Site Framing Attacks Nethanel Gelernter, Yoel Grinstein and Amir Herzberg
Cross-site framing plants false incriminating evidence about a victim without any access to their computer. CSRF against operations treated as benign poisons search and account histories at Google, Bing, Yahoo, YouTube…
Cross-Site Search Attacks Nethanel Gelernter and Amir Herzberg
Cross-site search attacks time the responses to search queries a rogue page sends to a service the victim is logged into, inferring private data without breaking the same-origin policy. Statistical tests, inflating the…
Detecting and Exploiting Second Order Denial-of-Service Vulnerabilities in Web Applications Oswaldo Olivo, Isil Dillig and Calvin Lin
Second-order DoS: the attacker first seeds a database with many cheap junk rows, then sends one request whose cost grows with those rows, exhausting server CPU on very little bandwidth. A static analysis tool, Torpedo…
Dom Flow - Untangling The DOM For More Easy-Juicy Bugs Ahamed Nafeez
Hookish instruments DOM sources and sinks in a live page and tags data as it flows, so tainted values arriving at innerHTML, document.write or eval are flagged automatically. It is applied to XHR responses rendered as…
eDellRoot krebsonsecurity.com
Dell shipped consumer and commercial PCs from August 2015 carrying a root certificate, eDellRoot, whose private key was left on the machine. Anyone can extract that key, sign certificates for any HTTPS site and…
Expansions on FREAK attack Jai Vijayan
News coverage extending the FREAK attack: Microsoft confirmed every supported Windows release was affected through its Secure Channel package, not just Safari and Android as first believed. FREAK lets a man in the…
Exploiting and Protecting Dynamic Code Generation Chengyu Song, Chao Zhang, Tielei Wang, Wenke Lee and David Melski
JIT compilers and dynamic binary translators hold generated code in a cache that is writable and executable, either at once or in alternation, which revives classic shellcode injection despite W xor X. A multi-threaded…
FileCry - The New Age of XXE Hormazd Billimoria, Xiaoran Wang, Sergey Gorbaty and Jonathan Brossard
Internet Explorer up to version 11 can be pushed back onto the vulnerable MSXML3 parser via a compatibility-mode meta tag, and its XML external entity resolution does not re-check the same-origin policy after a…
Formaction Scriptless attack updates WhiteHat Security
Even with a strict Content Security Policy blocking script, an HTML injection can add an input element that joins an existing form by id and overrides its target with formaction, aiming the submission at the attacker…
Google Drive SSO Phishing Ericka Chickowski
Phishing pages were hosted on Google Drive so the link and its HTTPS certificate look like Google own infrastructure, and the page JavaScript was obfuscated so scanners could not read the HTML or rely on IP blacklists…
How to Break XML Encryption – Automatically Dennis Kupser, Christian Mainka, Jorg Schwenk and Juraj Somorovsky
XML Encryption implementations remain open to adaptive chosen-ciphertext attacks that recover the plaintext of encrypted XML without any key. The authors systematise those attacks and automate them in a WS-Attacker…
HTTPS Bicycle Attack Guido Vranken
Because stream-oriented TLS cipher suites such as GCM leak exact plaintext length, a passive eavesdropper can subtract the known, highly redundant parts of an HTTP request from the observed ciphertext size and deduce…
Hunting Asynchronous Vulnerabilities James Kettle
Vulnerabilities in background threads and second-order flows produce no visible output, so ordinary scanning misses them. The write-up finds them with exploit-induced out-of-band callbacks, giving…
Identifying Cross-origin Resource Status Using Application Cache Sangho Lee, Hyungsub Kim and Jong Kim
HTML5 Application Cache can be made to reveal the status of arbitrary cross-origin URLs, whether they exist, redirect or error, with no client-side script and for many URLs at once. That leak tells an attacker page…
IE11 RCE Mike Lennon and @SecurityWeek
Microsoft shipped the out-of-band bulletin MS15-093 for CVE-2015-2502, a memory-corruption flaw in how Internet Explorer 7 to 11 handles objects in memory. A crafted or compromised web page, ad or HTML email runs…
jÄk: Using Dynamic Analysis to Crawl and Test Modern Web Applications Giancarlo Pellegrino, Constantin Tschurtz, Eric Bodden and Christian Rossow
A crawler that hooks client-side JavaScript APIs at runtime instead of parsing HTML with regular expressions, so registered event handlers, network calls and dynamically built URLs and forms are all discovered. Driving…
Java Deserialization w/ Apache Commons Collections in WebLogic, WebSphere, JBoss, Jenkins, and OpenNMS Stephen Breen
Apache Commons Collections contains a gadget chain whose readObject ends in an arbitrary command execution, so any Java service that deserializes attacker-supplied data is pre-authentication remote code execution. The…
Man-in-the-Browser-Cache: Persisting HTTPS Attacks via Browser Cache Poisoning Yaoqi Jia, Yue Chen, Xinshu Dong, Prateek Saxena, Jian Mao and Zhenkai Liang
Clicking through a single invalid-certificate warning lets a one-time man-in-the-middle replace cached scripts, images or an HTML5 AppCache manifest with long-lived malicious copies. The poisoned resources keep running…
Maneuvering Around Clouds: Bypassing Cloud-based Security Providers Thomas Vissers, Tom Van Goethem, Wouter Joosen and Nick Nikiforakis
Cloud-based DDoS protection that reroutes traffic purely by changing DNS records is circumvented once a site's real origin IP leaks. The paper gathers eight origin-exposing vectors, including historical DNS data…
Multiple Facebook Messenger CSRF's Mazin Ahmed and @mazen160
Two CSRF holes in messenger.com: the send_messages and delete_thread endpoints accepted cross-site POST requests without checking a token, so a page the victim visits could send messages from their account to any user…
New Evasions for Web Application Firewalls Mazin Ahmed
A test of the cross-site scripting rule sets of eight web application firewalls, among them F5 Big-IP, Imperva Incapsula, WebKnight, PHP-IDS, ModSecurity, Sucuri, QuickDefense and Barracuda. Every product was evaded…
New Methods in Automated XSS Detection: Dynamic XSS Testing Without Using Static Payloads Kenneth F. Belva
A scanner method that stops firing static payloads and instead injects a unique slug, parses where it lands in the HTML, JavaScript or DOM, and builds a table of which characters survive the application's filters and…
On Subnormal Floating Point and Abnormal Timing Marc Andrysco, David Kohlbrenner, Keaton Mowery, Ranjit Jhala, Sorin Lerner and Hovav Shacham
Floating point add and multiply on x86 take up to two orders of magnitude longer on subnormal operands, creating a data timing channel with no data-dependent branch. JavaScript that feeds subnormals to Firefox SVG CSS…
On the security of modern Single Sign-On Protocols – OpenID Connect 1.0 Vladislav Mladenov, Christian Mainka, Julian Krautwald, Florian Feldmann and Jörg Schwenk
OpenID Connect discovery metadata can combine an honest provider’s registration and authorization endpoints with an attacker’s token endpoint. Dynamic registration then causes a client to send its new credentials and…
Password mining from AWS/Parse Tokens Jai Vijayan
Developers embed backend-as-a-service secret keys for Facebook Parse and Amazon AWS directly in shipped mobile and web apps instead of configuring access control lists. A scan of about 750,000 Play Store and App Store…
Pawn Storm (CVE-2015-7645) Brooks Li, Feike Hacquebord and Peter Pi
Vendor report that the Pawn Storm espionage group spear phished foreign affairs ministries with news themed links delivering a then unpatched Adobe Flash exploit, later assigned CVE-2015-7645 and affecting Flash…
Perplexed Messengers from the Cloud: Automated Security Analysis of Push-Messaging Integrations ACM Conferences
A study of push-messaging services such as Google Cloud Messaging and Baidu Push and of how apps integrate them. A tool called Seminal derives security checks from vendor sample code and scanned 35,173 apps, finding…
Practical Memory Deduplication Attacks in Sandboxed JavaScript Daniel Gruss, David Bidner and Stefan Mangard
Operating systems and hypervisors merge identical physical memory pages, and the merge is observable as a slow write to a page that was deduplicated. Timing writes from ordinary sandboxed JavaScript in a visited web…
Protocol State Fuzzing of TLS Implementations Joeri de Ruiter and Erik Poll
State machine learning infers a protocol state machine from a TLS implementation using black-box testing alone, exposing message sequences the code accepts but the standard does not. Inspecting the inferred machines…
Relative Path Overwrite Gareth Heyes
Relative Path Overwrite adds a trailing slash or fake directory segments to a URL so a page's relative stylesheet reference resolves back to the page itself. The browser then parses the HTML as CSS, and…
Rowhammer.js: A Remote Software-Induced Fault Attack in JavaScript Daniel Gruss, Clémentine Maurice and Stefan Mangard
Rowhammer.js triggers DRAM bit flips from ordinary JavaScript in a browser, replacing the usual cache flush instruction with eviction sets built from an inferred memory mapping. A page the victim merely visits can…
Server-Side Template Injection: RCE for the Modern Web App James Kettle
User input concatenated into a server-side template is executed by the template engine, not just reflected, so it looks like XSS while actually running code on the server. The paper gives a detect-identify-exploit…
Serverside Template Injection James Kettle
Unsafely embedding user input in a server-side template engine lets an attacker run template syntax on the server, usually escalating to arbitrary file read and write and remote code execution. The paper gives a detect…
Service Workers: New APIs = New Vulns = Fun++ sirdarckcat
Shows how page JavaScript can poison service-worker caches, turning reflected XSS into persistent client-side execution. Caching redirected cross-origin responses under the original URL can also turn an open redirect…
SMTP Injection via Recipient Email Address Takeshi Terada
A recipient address carrying CRLF, or the RFC 5322 folding white space and obsolete quoted pair line breaks, smuggles extra SMTP commands into the RCPT TO line, which pipelining mail servers then execute. Attackers can…
St. Louis Federal Reserve DNS Redirect krebsonsecurity.com
News report that attackers altered routing settings at the DNS vendor used by the St. Louis Federal Reserve in April 2015, redirecting research.stlouisfed.org visitors to lookalike pages. Anyone who logged in during the…
Superfish SSL MitM Dan Goodin
Lenovo consumer laptops shipped with Superfish ad-injection software that installs its own root certificate and proxies HTTPS, and the accompanying private key is identical on every machine and protected by the password…
The Clock is Still Ticking: Timing Attacks in the Modern Web Tom Van Goethem, Wouter Joosen and Nick Nikiforakis
Browser features that parse or cache a cross-origin response let an attacker time the work done after the download finishes, so network jitter no longer matters. Video parsing, ApplicationCache, Service Workers and the…
The Devil is in the Constants: Bypassing Defenses in Browser JIT Engines Michalis Athanasakis, Elias Athanasopoulos, Michalis Polychronakis, Georgios Portokalidis and Sotiris Ioannidis
JavaScript integer constants survive into a JIT engine generated code, so an attacker can encode x86 gadget bytes as immediate values and make Firefox or Internet Explorer emit a full ROP chain at run time, defeating…
The old is new, again. CVE20112461 is back! Luca Carettoni and Mauro Gentile
SWF files built with a pre-patch Adobe Flex SDK stay exploitable after the SDK is fixed, because the vulnerable localization code is compiled into the file. A crafted request parameter makes such a SWF run attacker…
The Spy in the Sandbox: Practical Cache Attacks in JavaScript and their Implications Yossef Oren, Vasileios P. Kemerlis, Simha Sethumadhavan and Angelos D. Keromytis
A last-level cache side-channel attack that runs purely in JavaScript on a visited web page, needing no installed software on the victim machine. Timing its own memory accesses lets the page recover activity belonging…
The Unexpected Dangers of Dynamic JavaScript Sebastian Lekies, Ben Stock, Martin Wentzel and Martin Johns
Scripts generated per user session can be pulled in cross origin because script tags escape the same origin policy, so an attacker page can recover the data through global variables, overwritten global functions or…
Too LeJIT to Quit: Extending JIT Spraying to ARM Wilson Lian, Hovav Shacham and Stefan Savage
On ARM, constants a JIT compiler embeds in Thumb code can be entered mid-instruction to produce short unintended instruction sequences. Gadget chaining calls these sequences like functions from ordinary JavaScript…
Understanding and Managing Entropy Usage blackhat.com
Measures how little entropy Linux servers actually accumulate, roughly two to six bits per second, and shows OpenSSL seeds its PRNG only once per process without checking pool quality. Apache mod_ssl reseeds with a PID…
Vetting SSL Usage in Applications with SSLINT Boyuan He, Vaibhav Rastogi, Yinzhi Cao, Yan Chen, V.N. Venkatakrishnan, Runqing Yang and Zhenrui Zhang
SSLINT models correct SSL/TLS API usage as program dependence graph signatures and runs graph queries over C and C++ source, so an application that never validates a certificate or a hostname fails to match and is…
WebRTC IP Address Leaks diafygi.github.io
A live demonstration that any web page can use WebRTC to issue STUN requests from JavaScript and read back the visitor's local, public and IPv6 addresses without permission. The requests never appear in developer tools…
Who Are You? A Statistical Approach to Protecting LinkedIn Logins(CSS UI Redressing Issue) Jovon Itwaru
LinkedIn publishing platform stripped dangerous tags but allowed the class attribute through, so an author could point a link at a site-hosted CSS class that stretches an element across the whole page. The invisible…
Winning the Online Banking War Sean Park
Banking trojans steal money through JavaScript injected into the victim's browser rather than through the malware binary. The paper dissects how these injects hook the DOM to alter transactions and defeat two-factor…
WordPress Core RCE Netanel Rubin
Chained flaws in WordPress core let a read-only Subscriber edit posts: a missing post ID makes the capability check return an empty privilege array, a quick-draft handler hands out a valid CSRF token, and a 16MB list of…