Top 10 Web Hacking Techniques

2016–17

The 2016–17 Top 10 Web Hacking Techniques: all 10 winners and 107 nominated and collected techniques, each with its researcher, summary and preserved…

107 records · 10 in the top ten · open this year in the interactive archive

The top ten

1. #1 A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! Orange Tsai

   URL parsers in different languages and libraries disagree about the same string, so a request validated as safe by one component is fetched as a different target by another, defeating SSRF filters. The talk chains these…

2. #2 Web Cache Deception Attack Omer Gil

   Appending a fake static filename to an authenticated dynamic page, such as /home.php/logo.png, makes many servers still return the personal page while the CDN or reverse proxy caches it as a public static file chosen by…

3. #3 How I hacked hundreds of companies through their helpdesk Inti De Ceukelaire

   Slack, Yammer and Workplace admit anyone holding a @company address, and helpdesks and issue trackers hand out exactly that: an address whose incoming mail becomes a ticket you can read. Register for the chat tool as…

4. #4 Friday-The-13th-JSON-Attacks-wp.pdf Alvaro Muñoz and Oleksandr Mirosh

   Shows that switching from Java or .NET binary serialization to JSON does not remove deserialization risk: libraries that embed type discriminators will instantiate attacker-chosen types and call their setters…

5. #5 1139 - cloudflare: Cloudflare Reverse Proxies are Dumping Uninitialized Memory bugs.chromium.org

   A flaw in Cloudflare's HTML-rewriting reverse proxy made it emit pages of uninitialized memory whenever a page behind it carried particular unbalanced tags. Because the proxies are shared between customers, the leaked…

6. #6 Advanced Flash Vulnerabilities OpnSec

   Series on Flash flaws in YouTube's player: an information leak, arbitrary Flash execution on youtube.com through the app loader, cross-site flashing by redefining loaderInfo.url so the main movie loads an…

7. #7 A deep dive into AWS S3 access controls taking full control over your assets Frans Rosén

   Walks every layer of AWS S3 access control, bucket ACL, object ACL and ACP and the AllUsers and AuthenticatedUsers groups, and gives a non-destructive test for each permission. WRITE or WRITE_ACP granted to those groups…

8. #8 Request encoding to bypass web application firewalls Soroush Dalili

   A request body and query string can be sent in an unusual charset such as the EBCDIC code page IBM037, declared in the Content-Type header, which signature-based web application firewalls do not decode. The application…

9. #9 Cure53 Browser Security Whitepaper Mario Heiderich, Alex Inführ, Fabian Fäßler, Nikolai Krein, Masato Kinugawa, Tsang-Chi "Filedescriptor" Hong, Dario Weißer and Paula Pustułka

   A 330-page comparative audit of MSIE11, Edge and Chrome covering memory-safety mitigations, CSP and other security headers, DOM security, extension and plugin models, and UI trust indicators. It documents working…

10. #10 Binary Webshell Through OPcache in PHP 7 Ian Bouchard

    A PHP 7 exploitation technique: OPcache's file cache stores compiled bytecode under a folder writable by the web user. Given an unrestricted file upload and the target's system_id (an md5 fingerprint computable from…

Also collected

• .NET serialiception agix

  Investigates .NET BinaryFormatter deserialization reachable through web inputs and unsigned ViewState. Besides DataSet XXE, it develops a chain through COM unmarshalling, bitmap heap spraying and ROP to execute code in…

• (Cross-)Browser Fingerprinting via OS and Hardware Level Features Yinzhi Cao, Song Li and Erik Wijmans

  By making the browser perform tasks that lean on the graphics card, CPU and installed fonts, the technique derives a fingerprint from operating system and hardware traits rather than browser-specific ones. The same…

• $10k host header Ezequiel Pereira

  Sending a request to Google App Engine's public front end with the Host header set to an internal googleplex.com hostname made it serve that internal application, sidestepping the single sign-on proxy that normally…

• A Comprehensive Formal Security Analysis of OAuth 2.0 Daniel Fett, Ralf Kuesters and Guido Schmitz

  The first formal analysis of the OAuth 2.0 standard in an expressive model of the web, covering all four grant types with malicious relying parties, identity providers and browsers in scope. It uncovers four attacks…

• A Journey from JNDI/LDAP Manipulation to Remote Code Execution Dream Land Alvaro Muñoz and Oleksandr Mirosh

  When a Java application performs a JNDI lookup on an attacker-controlled name, the attacker serves a naming reference over RMI, CORBA or LDAP that makes the victim fetch and instantiate a remote factory class, giving…

• A Simple Generic Attack on Text Captchas Haichang Gao, Jeff Yan, Fang Cao, Zhengya Zhang, Lei Lei, Mengyun Tang, Ping Zhang, Xin Zhou, Xuqin Wang and Jiawei Li

  A single pipeline built on Log-Gabor filters segments and recognises the characters of text CAPTCHAs whatever anti-segmentation trick a scheme uses. It broke schemes from Google, Microsoft, Yahoo and Amazon at 5 to 77…

• All Your DNS Records Point to Us: Understanding the Security Threats of Dangling DNS Records Daiping Liu, Shuai Hao and Haining Wang

  A dangling DNS record points at a resource that no longer exists but was never purged. The paper identifies three vectors by which an attacker can claim the abandoned resource and take over the domain or subdomain…

• ASLR on the Line: Practical Cache Attacks on the MMU Ben Gras, Kaveh Razavi, Erik Bosman, Herbert Bos and Cristiano Giuffrida

  Page-table walks by the memory management unit leave the page tables themselves in the shared last-level cache, so an EVICT+TIME attack on those cache lines reveals which entries a victim used and derandomizes its…

• Assorted WordPress DB prepare exploits Making WordPress Secure

  WordPress's prepare function accepted an array of replacements and undocumented placeholders such as %c and numbered ones, so user input shaped like a placeholder, or a string prepared twice, could break out of the…

• Attack Patterns for Black-Box Security Testing of Multi-Party Web Applications Avinash Sudhodanan, Alessandro Armando, Roberto Carbone and Luca Compagna

  Security protocols behind multi-party web applications, such as single sign-on and Cashier-as-a-Service payment flows, share structural features that let an attack on one be generalised to others. The paper distils…

• AUTHSCOPE: Towards Automatic Discovery of Vulnerable Access Control in Online Services acmccs.github.io

  AUTHSCOPE drives mobile apps automatically, learns which fields of their authenticated API requests carry identity, then substitutes another user's identifiers or tokens and compares the responses to spot servers that…

• Autobinding vulns and Spring MVC agrrrdog.blogspot.com

  Spring MVC repopulates an object taken from the model, session or a flash attribute with matching HTTP parameters, so a controller expecting trusted data can be rewritten by extra request parameters. That yields…

• Automated Website Fingerprinting through Deep Learning Vera Rimmer, Davy Preuveneers, Marc Juarez, Tom Van Goethem and Wouter Joosen

  Deep neural networks learn traffic features directly from raw Tor traces, removing the hand-engineered feature sets that earlier website fingerprinting relied on and that network changes easily break. Trained on over…

• Automatic Forgery of Cryptographically Consistent Messages to Identify Security Vulnerabilities in Mobile Services Chaoshun Zuo, Wubing Wang, Rui Wang and Zhiqiang Lin

  Mobile apps sign, hash or encrypt their API requests, so servers assume a client cannot forge a valid message. AUTOFORGE reverse-engineers how a client builds messages and automatically produces cryptographically…

• Back in Black: Towards Formal, Black Box Analysis of Sanitizers and Filters George Argyros, Ioannis Stais, Aggelos Kiayias and Angelos D. Keromytis

  Infers a black-box WAF filter or sanitizer from queries alone, using symbolic finite automata to cut the query count about 15 times. Feeding it a grammar of attack strings turns a failed equivalence check into a real…

• Backslash Powered Scanning: hunting unknown vulnerability classes James Kettle

  Explains how generic input transformations and differential response analysis can identify unfamiliar server-side injection behavior. Backslash Powered Scanner develops observations through iterative checks while…

• Beauty and the Beast: Diverting Modern Web Browsers to Build Unique Browser Fingerprints Pierre Laperdrix, Walter Rudametkin and Benoit Baudry

  A study of browser fingerprinting built on 118,934 real fingerprints gathered through AmIUnique, covering 17 attributes reachable from modern web APIs. It shows HTML5 canvas and WebGL rendering differences are highly…

• Beauty and the Burst: Remote Identification of Encrypted Video Streams Roei Schuster, Vitali Shmatikov, Eran Tromer

  Variable bitrate encoding makes an MPEG-DASH stream's pattern of traffic bursts a fingerprint of the video's content, surviving encryption. A convolutional network trained on those patterns identifies which Netflix or…

• Breaking Out HSTS (and HPKP) on Firefox, IE/Edge and (Possibly) Chrome blackhat.com

  Firefox, IE/Edge and Chrome store HSTS and HPKP state in ways an attacker can remotely overwrite, so a site that should be locked to HTTPS can be pushed back to plaintext. A sniffing or man-in-the-middle attacker on the…

• Comparisons and attacks on HTTP2 (Comparaisons et attaques sur HTTP2) Georges Bossert

  Uses active automata learning with L* to compare HTTP/2 server state machines, then guides a fuzzer through valid states before mutating messages and transitions. Tests of Apache, Nginx, H2O and Tomcat expose divergent…

• Cracking the Lens: Targeting HTTP's Hidden Attack-Surface James Kettle

  Malformed Host headers and esoteric request headers make reverse proxies and other transparent intermediaries reveal themselves and misroute requests into internal networks. The same tricks reach intercepting…

• Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization Taoguang Chen

  Shows that malformed PHP serialized objects can be created with attacker-controlled properties before parsing fails and skips __wakeup(). Destructors can then run without the defensive cleanup placed in __wakeup()…

• Crippling HTTPS with Unholy PAC blackhat.com

  An attacker on a shared network forces a victim's browser or OS to load a hostile proxy auto-config file, whose JavaScript is handed the full URL of every request including HTTPS ones, leaking paths and the credentials…

• CrossFire: An Analysis of Firefox Extension-Reuse Vulnerabilities Ahmet Salih Buyukkayhan, Kaan Onarlioglu, William Robertson and Engin Kirda

  Legacy Firefox extensions share one JavaScript namespace, so an add-on can invoke the privileged XPCOM functionality of another. The paper names the resulting extension-reuse vulnerability: a malicious add-on making no…

• CSP Is Dead, Long Live CSP! Lukas Weichselbaum, Michele Spagnuolo, Sebastian Lekies and Artur Janc

  Internet-scale measurement of Content Security Policy across 1.6 million hosts and 26,011 distinct policies finds 94.72 percent of policies bypassable, chiefly because whitelisted script hosts serve endpoints that hand…

• CVE-2018-5175: Universal CSP strict-dynamic bypass in Firefox Masato Kinugawa

  Firefox exposed a bundled require.js through a web-accessible resource URI, and browser extension resources are loaded regardless of a page's Content Security Policy. Any site protected by script-src strict-dynamic…

• Dangerous Contents: Securing .NET Deserialization Jonathan Birch

  Maps unsafe .NET deserialization through direct and indirect formatter calls, type resolution and allowed object graphs. The slides discuss binder pitfalls, generic-object properties, ViewState machine-key exposure and…

• Deemon: Detecting CSRF with Dynamic Analysis and Property Graphs Giancarlo Pellegrino, Martin Johns, Simon Koch, Michael Backes and Christian Rossow

  Deemon records a web application's network traffic, server execution and database queries into a single property graph, then uses graph traversals to find state-changing requests that lack anti-CSRF protection and…

• Domain-Z: 28 Registrations Later Chaz Lever, Robert Walls, Yacin Nadji, David Dagon, Patrick McDaniel and Manos Antonakakis

  Re-registering an expired domain inherits its residual trust. Six years of zone diffs, passive DNS, malware feeds and blacklists show 27,758 domains blacklisted only after expiring and 238,279 expired domains later…

• Dont Trust The DOM: Bypassing XSS Mitigations Via Script Gadgets Sebastian Lekies, Krzysztof Kotowicz, Samuel Groß, Eduardo A. Vela Nava and Martin Johns

  Script gadgets are legitimate JavaScript fragments inside popular frameworks that pick up injected, script-free HTML and turn it into executing code. Because the injected markup carries no script tag or event handler…

• DROWN: Breaking TLS Using SSLv2 Nimrod Aviram, Sebastian Schinzel, Juraj Somorovsky, Nadia Heninger, Maik Dankel, Jens Steube, Luke Valenta, David Adrian, J. Alex Halderman, Viktor Dukhovni, Emilia Käsper, Shaanan Cohney, Susanne Engels, Christof Paar and Yuval Shavitt

  DROWN uses any server still speaking SSLv2 with the same RSA key as a Bleichenbacher padding oracle, letting a passive attacker decrypt recorded modern TLS sessions. An OpenSSL flaw present from 1998 to 2015 makes the…

• Exploiting CORS Misconfigurations for Bitcoins and Bounties James Kettle

  Servers that reflect the Origin header into Access-Control-Allow-Origin while sending Allow-Credentials true let any website read a victim's authenticated cross-domain responses. The post covers sloppy origin matching…

• Exploiting the unexploitable with lesser known browser tricks filedescriptor

  Browser quirks that defeat defences assumed sound. X-Frame-Options SAMEORIGIN can be framed through a same-origin intermediate such as Google AMP or a Twitter player card; AppCache fallback plus a cookie bomb…

• Extension Breakdown: Security Analysis of Browsers Extension Resources Control Policies Iskander Sanchez-Rola, Igor Santos and Davide Balzarotti

  Browsers restrict which extension resources a web page may load, but two attacks defeat those controls in every major browser family and enumerate the extensions a user has installed: a timing side channel against the…

• Fake Co-visitation Injection Attacks to Recommender Systems Guolei Yang, Neil Zhenqiang Gong and Ying Cai

  Recommenders that infer relatedness from users viewing two items together can be steered by injecting fabricated co-visitation records. Framing the choice of target items and injection counts as a constrained…

• Fantastic Timers and Where to Find Them: High-Resolution Microarchitectural Attacks in JavaScript Michael Schwarz, Clémentine Maurice, Daniel Gruss and Stefan Mangard

  Browsers coarsened performance.now to stop JavaScript cache attacks; this work recovers nanosecond resolution anyway from implicit clocks such as postMessage, MessageChannel, Broadcast Channel, CSS animations and a…

• Finding and Preventing Bugs in JavaScript Bindings Fraser Brown, Shravan Narayan, Riad S. Wahby, Dawson Engler, Ranjit Jhala and Deian Stefan

  JavaScript runtimes reach native code through C++ binding layers that must translate types, state and failure between the two languages. Static checkers for crash-, type- and memory-safety violations in Node.js, Blink…

• Fingerprinting Firefox users with cached intermediate CA certificates (#fiprinca) Alexander Klink

  Fingerprints Firefox through its cache of intermediate CA certificates. Image loads from servers with incomplete certificate chains succeed only when the missing intermediate is cached. Probes covering over 300…

• Forwarding-Loop Attacks in Content Delivery Networks Jianjun Chen, Jian Jiang, Xiaofeng Zheng, Haixin Duan, Jinjin Liang, Kang Li, Tao Wan and Vern Paxson

  A malicious CDN customer can point its origin back into the CDN so that one request loops inside a single CDN or between several, being processed over and over and consuming edge and origin resources. Header-filtering…

• FP-STALKER: Tracking Browser Fingerprint Evolutions Antoine Vastel, Pierre Laperdrix, Walter Rudametkin and Romain Rouvoy

  FP-STALKER links successive browser fingerprints from the same browser as they drift, using a rule-based matcher and a random-forest hybrid to decide whether two fingerprints share an origin. Over 98,598 fingerprints…

• From Markdown to RCE in Atom statuscode.ch

  The Atom editor's Markdown preview rendered arbitrary HTML behind a weak attribute-stripping sanitiser, so an iframe could load a bundled local HTML file that passed the URL query string to eval. Because Electron runs…

• Game of Registrars: An Empirical Analysis of Post-Expiration Domain Name Takeovers Tobias Lauinger, Abdelberi Chaabane, Ahmet Salih Buyukkayhan, Kaan Onarlioglu and William Robertson

  An empirical study of domain ownership change after expiration, covering the drop-catch race to re-register deleted names and registrars selling customers' expired domains pre-release. It finds 10% of com domains…

• GitHubs post-CSP journey Patrick Toomey

  Once CSP stops script execution, attackers steal page secrets with dangling markup: an unclosed img src swallows the CSRF token, and permitted image hosts such as Google Analytics and Gravatar become exfiltration…

• Google Maps XSS (by fiddling with Protobuf) Marin Moulinier

  Google Maps encodes its URL and AJAX parameters in an undocumented text form of Protobuf. Reverse-engineering it with a Chrome debugger script and a Qt request editor exposed a tile format served as Content-Type…

• Hacking Slack using postMessage and WebSocket-reconnect to steal your precious token Frans Rosén

  Slack's web client handled window postMessage events without checking the sender's origin. An attacker page could open slack.com/call/me, send a reconnect_url event repointing the client's WebSocket at the attacker's…

• HaXmas: The True Meaning(s) of Metasploit @todb and Tod Beardsley

  Samsung Internet Browser let JavaScript that opened a new tab rewrite that tab's contents after the destination site had loaded, breaking the same-origin policy. An attacker whose page the victim visits can inject…

• HEIST: HTTP Encrypted Information can be Stolen Through TCP-Windows Mathy Vanhoef and Tom Van Goethem

  Browser timing APIs expose when a response arrives relative to TCP window boundaries, letting a malicious page measure the exact byte length of any cross-origin HTTPS response. Because TLS does not hide length…

• How I used google dorks to find 0-days linkedin.com

  The archived document is not the cited research. It is LinkedIn's article-not-found landing page, opening with a notice that the page cannot be found and continuing into topic and editor's-pick link lists. The cited…

• HTTP/2: In-depth analysis of the top four flaws Imperva Defense Center

  Analyzes HTTP/2 implementation failures across five servers: stream reuse, slow reads, dependency cycles and HPACK decompression bombs. Multiplexing amplifies resource exhaustion, while repeated references to a large…

• HVLearn: Automated Black-box Analysis of Hostname Verification in SSL/TLS Implementations Suphannee Sivakorn, George Argyros, Kexin Pei, Angelos D. Keromytis and Suman Jana

  HVLearn learns a finite automaton of exactly which hostnames each SSL/TLS library accepts for a given certificate common name, then compares those models across implementations and against RFC-derived rules. The…

• I Know What You Saw Last Minute: Encrypted HTTP Adaptive Video Streaming Title Classification Ran Dubin, Amit Dvir, Ofir Pele and Ofer Hadar

  A passive eavesdropper can identify which video a user is watching on an HTTP adaptive streaming site such as YouTube purely from the encrypted traffic pattern, because bitrate adaptation leaves a title-specific…

• JSON hijacking for the modern web Gareth Heyes

  Combines JavaScript Proxy traps with UTF-16BE script decoding to turn cross-origin JSON into undeclared variable names and recover their contents. Browser-specific prototype-chain tricks expose data in Edge, Chrome and…

• Killed by Proxy: Analyzing Client-end TLS Interception Software Xavier de Carné de Carnavalet and Mohammad Mannan

  A framework for testing the TLS proxies that antivirus and parental-control products insert into a host's traffic, covering root-certificate handling, certificate validation, TLS parameters and client transparency. Of…

• Loophole: Timing Attacks on Shared Event Loops in Chrome Pepe Vila and Boris Köpf

  Chrome shares event loops between mutually distrusting pages, so a spy page can enqueue its own events and time how long they wait to infer what another process is doing. The resulting side channel identifies the page a…

• MitM Attack by Name Collision: Cause Analysis and Vulnerability Assessment in the New gTLD Era Qi Alfred Chen, Eric Osterweil, Matthew Thomas and Z. Morley Mao

  Study of WPAD proxy-discovery queries for internal namespaces that leak to the public DNS root, which became exploitable once the same strings were delegated as new gTLDs. Registering one such domain lets an attacker…

• MITM Attacks on HTTPS: Another Perspective GreenD0g

  A TLS certificate authenticates names, not hosts, ports or protocols, so a man in the middle can redirect a victim's connection for one host to another whose certificate covers the same name. Any control over that…

• Modern Alchemy: Turning XSS into RCE Luca Carettoni

  Electron's nodeIntegration flag should keep untrusted pages away from Node, but window.open returns a proxy object that bypasses the same-origin policy, and evaluating script inside the privileged chrome-devtools window…

• My Sweet Innocence Exposed - Eleven Reasons why we will all miss you, e Marcus Niemietz (HackPra)

  A talk cataloguing Internet Explorer features that were security disasters by design. Legacy document modes, inherited by any page an attacker iframes, let old injections be replayed against a modern browser…

• NEZHA: Efficient Domain-Independent Differential Testing Theofilos Petsios, Adrian Tang, Salvatore Stolfo, Angelos D. Keromytis and Suman Jana

  NEZHA guides differential testing by delta-diversity, a measure of how differently several programs behave on the same input, instead of code coverage, so mutation heads for inputs that make implementations disagree. It…

• On the Content Security Policy Violations due to the Same-Origin Policy Dolière Francis Somé, Nataliia Bielova and Tamara Rezk

  Examines how scripts in same-origin parent pages and iframes can bypass each other’s differing CSP restrictions. A crawl of over one million pages identifies potentially vulnerable page–iframe pairs, including cases…

• On the Practical (In-)Security of 64-bit Block Ciphers (SWEET32) Karthikeyan Bhargavan and Gaëtan Leurent

  Ciphers with 64-bit blocks such as Triple-DES and Blowfish hit the birthday bound after only about 32 GB under one key, so colliding CBC ciphertext blocks leak the XOR of two plaintexts. An attacker running JavaScript…

• Password Not Provided - Compromising Any Flurry Users Account Jack Cable

  Flurry's signup flow for accounts linked to a Yahoo login submitted the literal string not-provided as the password, and the ordinary login form accepted it. Anyone could sign in to any Yahoo-linked Flurry account using…

• PDF Mirage: Content Masking Attack Against Information-Based Online Services Ian Markwood, Dakun Shen, Yao Liu and Zhuo Lu

  Rigging a PDF's font glyph mapping makes the text a human reads differ completely from the text an extractor recovers. This subverts conference reviewer-assignment systems so authors can steer papers to colluding…

• Pivoting from blind SSRF to RCE with HashiCorp Consul Peter Adkins

  A SOAP feature that fetched a user-supplied URL gave blind SSRF with no response returned. The Ruby HTTP client did not reject CRLF sequences in the URL, letting a second attacker-written request be appended to the…

• Practical New Developments in the BREACH Attack Dimitris Karakostas and Dionysis Zindros

  Extends the BREACH compression side channel to modern deployments: statistical methods defeat the noise introduced by AES block ciphers and dynamic pages, and a command-and-control channel injected into plain HTTP keeps…

• Rare ASP.NET request validation bypass using request encoding Soroush Dalili

  ASP.NET's request validation throws on the first read of Request.QueryString or Request.Form, so an application that swallows the exception with an empty catch or On Error Resume Next gets the payload back unchecked on…

• Remote LD_PRELOAD Exploitation Daniel Hodson

  GoAhead's cgiHandler copies every HTTP request parameter into the forked CGI process's environment, filtering only REMOTE_HOST and HTTP_AUTHORIZATION, so a query string can set LD_PRELOAD. launchCgi dup2s the POST…

• Request and Conquer: Exposing Cross-Origin Resource Size Tom Van Goethem, Mathy Vanhoef, Frank Piessens and Wouter Joosen

  TLS conceals content but not message size. Design flaws in browser storage and quota mechanisms let a cross-origin page measure the exact byte size of any resource fetched with the victim's cookies within seconds, and a…

• Rewriting History: Changing the Archived Web from the Present Ada Lerner, Tadayoshi Kohno and Franziska Roesner

  Three flaws in the Wayback Machine let anyone rewrite the past. URL rewriting misses JavaScript-computed URLs, so snapshots fetch live subresources whose domain owner can serve any script; serving every archived origin…

• ROBOT: Return Of Bleichenbacher's Oracle Threat Hanno Böck, Juraj Somorovsky and Craig Young

  ROBOT revives Bleichenbacher's 1998 adaptive chosen-ciphertext attack on RSA PKCS #1 v1.5 by using new oracle signals such as timeouts, connection resets and duplicate alerts, and by truncating the TLS handshake. A…

• Same Origin Policy: Evaluation in Modern Browsers Jörg Schwenk, Marcus Niemietz and Christian Mainka

  An empirical evaluation of the same-origin rules governing access between a host document and an embedded one. Running 544 test cases on ten browsers shows access rights depend not only on origin but on the type of the…

• Shopware 5.3.3: PHP Object Instantiation to Blind XXE Karim El Ouerghemmi

  A user-controlled class name reaches a PHP object instantiation in Shopware 5.3.3, and the attacker cannot call methods but can choose which class is constructed. Picking SimpleXMLElement and passing it a remote DTD…

• Side-Channel Attacks on Shared Search Indexes Liang Wang, Paul Grubbs, Jiahui Lu, Vincent Bindschaedler, David Cash and Thomas Ristenpart

  Multi-tenant search indexes leak document frequency through relevance scores, so one tenant learns about other tenants' private documents. The attack maps shards, lands attacker documents beside a victim's, then…

• SoK: Exploiting Network Printers ieee-security.org

  Systematic study of network printer attacks with an open-source exploitation toolkit, finding all 20 tested printer models vulnerable to at least one attack, from denial of service to extracting print jobs and system…

• Stealing Messenger.com Login Nonces stephensclafani.com

  messenger.com signs in a logged-in Facebook user through an iframe endpoint that redirects a one-time login nonce to a redirect_uri. Pointing that parameter at a beta subdomain and exploiting a fragment that survives…

• Stealing PINs via Mobile Sensors: Actual Risk versus User Perception York Research Database

  PINlogger.js reads a phone motion and orientation sensor streams from an ordinary web page, with no permission prompt, and feeds them to a neural network that infers the PIN being typed. It named the right PIN out of…

• Tail Attacks on Web Applications Huasong Shan, Qingyang Wang and Calton Pu

  A low-volume denial of service on n-tier web stacks: short bursts of ordinary HTTP requests trigger millibottlenecks and cross-tier queue overflow, pushing tail response time past a second while CPU and memory stay far…

• Text/Plain Considered Harmful jankopecky.net

  Internet Explorer MIME-sniffs the contents of a message/rfc822 .eml file, so an attacker-hosted .eml can frame a page served as text/plain and have its injected HTML and script rendered anyway. This turns otherwise…

• The .io Error - Taking Control of All .io Domains With a Targeted Registration Matthew Bryant

  Four of the seven authoritative nameserver domains for the .io top-level domain had lapsed and were purchasable for 90 dollars. Registering one made the researcher authoritative for the entire .io zone, so DNS for every…

• The Absurdly Underestimated Dangers of CSV Injection georgemauer.net

  A cell that an ordinary user plants in an application, beginning with an equals, plus, minus or at sign, is evaluated as a formula when an administrator opens the CSV export. Excel DDE payloads run commands on the…

• The Adventures of AV and the Leaky Sandbox blackhat.com

  Malware on an endpoint with no direct internet access hides data in a file that the host's cloud antivirus uploads to its own internet-connected analysis sandbox, where the sample runs and beacons the data out. The AV…

• The Attack of the Alerts and the Zombie Script (IE) Manuel Caballero

  In IE11 an ActiveXObject htmlFile yields a second window object whose alert ignores the user choice to suppress further dialogs, so a page can throw dialogs with no way out. Saving a self-reference on that object and…

• The Cracked Cookie Jar: HTTP Cookie Hijacking and the Exposure of Private Information Suphannee Sivakorn, Iasonas Polakis and Angelos D. Keromytis

  Sites that still serve some pages over HTTP leak their non-session cookies to any network eavesdropper. An audit of 25 major services shows those stolen cookies expose search history, home and work addresses, purchase…

• The Good, The Bad and The Ugly of Safari in Client-Side Attacks @bo0om

  Safari resolves and requests hostnames containing characters no other browser accepts, including quotes, angle brackets and control characters, and then URL-decodes them. With a wildcard DNS record the Host and Referer…

• The Wolf of Name Street: Hijacking Domains Through Their Nameservers Thomas Vissers, Timothy Barron, Tom Van Goethem, Wouter Joosen and Nick Nikiforakis

  Domains can be seized through their nameservers instead of directly. The authors typosquat and bitsquat nameserver hostnames and register nameserver domains left expired or stale in WHOIS, then answer DNS for every…

• Timing Attacks Have Never Been So Practical: Advanced Cross-Site Search Attacks Nethanel Gelernter

  Cross-site search asks a victim's logged-in service a boolean question with a cross-origin request and reads the answer from response time, since the same-origin policy hides the body. Where a reflected parameter…

• Towards Automated Dynamic Analysis for Linux-based Embedded Firmware Daming D. Chen, Manuel Egele, Maverick Woo and David Brumley

  FIRMADYNE emulates Linux-based firmware images from routers, cameras and other network devices so their services can be exercised dynamically at scale rather than only read statically. Run against 23,035 images from 42…

• Tracking Mobile Web Users Through Motion Sensors: Attacks and Defenses Anupam Das, Nikita Borisov and Matthew Caesar

  Manufacturing imperfections make each phone's accelerometer and gyroscope respond slightly differently, and any web page can read those sensors from JavaScript. Combining sensor features, optionally exciting them with…

• Transcript Collision Attacks: Breaking Authentication in TLS, IKE and SSH Karthikeyan Bhargavan and Gaëtan Leurent

  Key exchange protocols hash their handshake transcript with MD5 or SHA-1, so an attacker who computes a chosen-prefix collision between two transcripts can make a client and a server sign the same hash. This yields…

• Trusted Browsers for Uncertain Times David Kohlbrenner and Hovav Shacham

  Degrading clock resolution does not close browser timing channels: the authors recover fine timing by amplifying coarse clocks and by building implicit clocks that measure duration without reading any clock at all. They…

• Unleashing the Walking Dead: Understanding Cross-App Remote Infections on Mobile WebViews Tongxin Li, Xueqiang Wang, Mingming Zha, Kai Chen, XiaoFeng Wang, Luyi Xing, Xiaolong Bai, Nan Zhang and Xinhui Han

  Cross-app URL invocation lets a remote web page navigate another Android app's WebView, so malicious web content spreads between apps and persists there. The authors name this XAWI and chain infected apps' separate…

• Website Fingerprinting at Internet Scale Andriy Panchenko, Fabian Lanze, Andreas Zinnen, Martin Henze, Jan Pennekamp, Klaus Wehrle and Thomas Engel

  A local passive eavesdropper on a Tor connection identifies which page a user is loading purely from packet sizes and directions, using a cumulative trace representation fed to an SVM that beats prior classifiers at a…

• Well, That Escalated Quickly! Michael Cherny and Sagie Dulce

  Chains a browser-triggered Docker build with local name-resolution spoofing against Docker for Windows. An initial build container answers LLMNR queries to rebind a hostname to localhost, bypassing browser origin…

• When security features collide James Kettle

  Shows how Cloudflare's email-obfuscation response rewriting can undermine its WAF and browser XSS filters when a site already has reflected XSS. The article illustrates conflicting parser interpretations and the risks…

• Why CSP Should be carefully crafted: Twitter XSS CSP Bypass Paulos Yibelo - Hacking Research

  Twitter checked an app's Terms of Service URL with a regex that lacked a leading anchor, so data:text/html,<payload>#https:// passed and gave HTML injection. The CSP allowed unsafe-inline and trusted…

• X41 Browser Security Whitepaper Markus Vervier, Michele Orrù, Berend-Jan Wever and Eric Sesterhenn

  A comparative security assessment of Google Chrome, Microsoft Edge and Internet Explorer covering attack surface, sandboxing, process and origin isolation, exploit mitigations, extensions, peripheral APIs and TLS. It…

• XSS without HTML: Client-Side Template Injection with AngularJS Gareth Heyes

  Pages that reflect user input into an AngularJS template can be attacked with double-curly expressions even when the input is HTML-encoded, because Angular evaluates them after encoding. Overwriting a native function…