Top 10 Web Hacking Techniques
2018
The 2018 Top 10 Web Hacking Techniques: all 10 winners and 80 nominated and collected techniques, each with its researcher, summary and preserved source.
80 records · 10 in the top ten · open this year in the interactive archive
The top ten
-
#1
Breaking-Parser-Logic-Take-Your-Path-Normalization-Off-And-Pop-0days-Out
Orange Tsai
Servers, frameworks and reverse proxies normalise URL paths differently, so a segment such as /..;/ or an encoded traversal is read one way by the front proxy and another by the Java backend. The mismatch bypasses proxy…
-
#2
Practical Web Cache Poisoning
James Kettle
Unkeyed request inputs such as X-Forwarded-Host or X-Original-URL change a response that a cache then stores under an ordinary key, so every later visitor is served the attacker's version. The work chains this into…
-
#3
Beyond XSS: Edge Side Include Injection
Louis Dion-Marcil
ESI Injection: getting Edge Side Include tags reflected into an HTTP response makes the caching surrogate in front of the application evaluate them, since it cannot tell attacker tags from upstream ones. That yields…
-
#4
GitHub - HoLyVieR/prototype-pollution-nsec18: Content released at NorthSec 2018 for my talk on prototype pollution
HoLyVieR
Release material for the NorthSec 2018 talk that turned prototype pollution from a bad practice into an attack: APIs that recursively merge, clone or assign attacker-controlled key paths can write onto the base object…
-
#5
Attacking "Modern" Web Technologies
Frans Rosén
Three attack families against widely deployed web features: AppCache manifests abused by cookie bombing so a forced 500 makes the FALLBACK page serve a whole directory or origin, weak cloud upload policies that let…
-
#6
It's A PHP Unserialization Vulnerability Jim But Not As We Know It
Sam Thomas
Any PHP file operation on an attacker-controlled path beginning phar:// unserializes the archive's metadata, so file-existence checks, XXE and SSRF bugs become object injection. A Phar can be disguised as a valid JPEG…
-
#7
Exploiting XXE with local DTD files
Arseniy Sharoglazov and @_mohemiv
Blind XXE usually needs an attacker-hosted DTD because the internal subset forbids a parameter entity inside markup. Loading a DTD file that already exists on the target host and redefining one of its parameter entities…
-
#8
Prepare(): Introducing Novel Exploitation Techniques in WordPress
Robin Peraglie
WordPress before 4.8.3 allowed SQL injection when prepare() was applied twice to input containing placeholders. Its fix introduced secret percent-sign tokens: when a WP_Query containing those tokens is serialized for…
-
#9
Data Exfiltration via Formula Injection #Part1
Ajay and Balaji
Spreadsheet formulas planted in imported CSV data run when the sheet is opened, and built-in functions that fetch remote resources carry data out of band. In Google Sheets IMPORTXML and friends exfiltrate other users'…
-
#10
XS-Searching Google's bug tracker to find out vulnerable source code
Luan Herrera and @lbherrera_
Monorail's CSV export lacked CSRF protection and allowed a column to be repeated, so a search that matched a bug returned a hugely inflated file. Timing how long that response takes to enter the Cache API answers…
Also collected
-
#307670 Difference in query string parameter processing between Hacker News and Keybase Chrome extension spawns chat to incorrect user
GitHub
The Keybase browser extension fix for a query-string parsing differential: its parser now rejects duplicate parameter keys instead of silently keeping one, so a crafted link can no longer make the extension open a chat…
-
#309531 Stored XSS in Snapmatic + R★Editor comments
europa
Six months of stored XSS against Rockstar Games Social Club, Snapmatic and Rockstar Editor comments, each round defeating a stricter web application firewall. The bypasses used control characters inside tag names, a…
-
#317476 Account Takeover in Periscope TV
Ron Chan
Periscope's Twitter OAuth login echoed the Host header into its redirect target, so a request carrying Host set to attacker.com/www.periscope.tv sent the OAuth callback to the attacker. A victim who authorises the…
-
#341876 SSRF in Exchange leads to ROOT access in all instances
André Baptista
A store template on Shopify Exchange made the screenshot renderer fetch Google Cloud metadata, and the v1beta1 endpoint returned the instance service-account token without the usual Metadata-Flavor header. The leaked…
-
$36k Google App Engine RCE - Ezequiel Pereira
Ezequiel Pereira
From inside a Google App Engine app the author reached the runtime's internal RPC endpoint and an undocumented gRPC service, then recovered hidden API names from the Java launcher's arguments and leaked proto files. In…
-
A bug that affects million users - Kaspersky VPN
Dhiraj Mishra
Kaspersky VPN for Android up to 1.4.0.216 left DNS queries outside the tunnel, so the user's real DNS resolver still saw every domain requested while connected to a virtual server. The traffic a VPN user expects to hide…
-
A Sense of Time for JavaScript and Node.js: First-Class Timeouts as a Cure for Event Handler Poisoning
James C. Davis, Eric R. Williamson and Dongyoon Lee
Event-driven servers such as Node.js multiplex many clients onto few threads, so a single request that blocks one thread, through an expensive regular expression or a synchronous API call, leaves the whole server…
-
A story of the passive aggressive sysadmin of AEM
Frans Rosén
Adobe Experience Manager's dispatcher filter can be walked past by appending a selector such as ?.css to a blocked path, exposing CRX Explorer, Package Manager, querybuilder and the OSGi console on live sites. The talk…
-
A timing attack with CSS selectors and Javascript
Sigurd Kolltveit
A page that passes location.hash to jQuery lets an attacker choose the CSS selector it evaluates. Deliberately expensive pseudo-class chains plus right-to-left short-circuiting make matching slow only when a guessed…
-
Adventures in Video Conferencing Part 1: The Wild World of WebRTC
projectzero.google
Project Zero fuzzed WebRTC end to end, first by patching Chrome's libsrtp to corrupt outgoing RTP packets, then by extending the video replay tool to replay fuzzed RTP dumps. It found seven memory-safety bugs, including…
-
An analysis of logic flaws in web-of-trust services
EdOverflow and @EdOverflow
Web-of-trust services such as Keybase verify identity by scraping a token from a page the user controls. Three logic flaws break that: a gist the victim forks carries the attacker's token under the victim's name, a site…
-
An untold story of Skype by Microsoft
Dhiraj Mishra
Sharing a file during a Skype for Linux call crashes the client with a glibc malloc() memory corruption abort, reached through the GTK file chooser dialog of the Electron application. The write-up documents a heap…
-
ASP.NET resource files (.RESX) and deserialisation issues
Soroush Dalili
ASP.NET resource files embed serialized objects that System.Resources deserializes with BinaryFormatter, SoapFormatter or TypeConverters without restricting the type, so a supplied .resx or .resources file yields code…
-
Automated Generation of Event-Oriented Exploits in Android Hybrid Apps
Guangliang Yang, Jeff Huang and Guofei Gu
Android hybrid apps let web content inside a WebView trigger event handlers written in native Java, and neither the same-origin policy nor Android permissions check where the event came from. EOEDroid vets apps with…
-
Bamboozling Certificate Authorities with BGP
Henry Birge-Lee, Yixin Sun, Anne Edmundson, Jennifer Rexford and Prateek Mittal
An autonomous system can hijack BGP routes to a victim domain just long enough to answer a certificate authority domain validation check and obtain a valid certificate for a domain it does not control. The authors…
-
Beware of Deserialisation in .NET Methods and Classes + Code Execution via Paste!
Soroush Dalili
A survey of .NET Framework methods and classes that deserialise input, whose stand-out case is the clipboard: DataObject runs BinaryFormatter over several clipboard formats on paste. A crafted clipboard object therefore…
-
Blog - RCE due to ShowExceptions
Harsh Jaiswal
A Rails application left Rack ShowExceptions enabled in production, so a carriage return in a filename parameter triggered an exception page that printed the application secret token. With that token an attacker signs…
-
Blog on Gopherus Tool
SpyD3r
Gopherus builds gopher:// payloads that convert a server-side request forgery into remote code execution against back-end services. It covers MySQL, FastCGI, Memcached, Redis, Zabbix and SMTP, writing cron jobs or PHP…
-
Browser history re:visited
Michael Smith, Craig Disselkoen, Shravan Narayan, Fraser Brown and Deian Stefan
Four new history sniffing attacks, two on visited links and two on caches, abuse modern browser features such as the CSS Paint API and the JavaScript bytecode cache, which handle cross-origin URL data without accounting…
-
Bypassing Web Cache Poisoning Countermeasures
James Kettle
Examines why web cache poisoning defenses can fail when intermediaries and backends interpret headers differently. It also shows how cacheable block pages and incomplete validation can turn attempted fixes into…
-
Bypassing Web-Application Firewalls by abusing SSL/TLS
0x09AL Security blog
A web application firewall can only inspect traffic in the cipher suites it is able to decrypt. Comparing the vendor's supported cipher list against an sslscan of the origin server reveals ciphers the backend accepts…
-
cat ~/footstep.ninja/blog.txt
Shuaib Oladigbolu
A help desk product returned the password reset token in the JSON body of the reset request itself, instead of only by email. Requesting a reset for an agent account handed the attacker that token, which could be pasted…
-
Clock Around the Clock: Time-Based Device Fingerprinting
Iskander Sanchez-Rola, Igor Santos and Davide Balzarotti
Timing how long ordinary API functions take to run reveals a device clock crystal variation, giving a hardware fingerprint. The CryptoFP tool measures HTML5 Crypto API calls from JavaScript, letting a site re-identify a…
-
Cloud Strife: Mitigating the Security Risks of Domain-Validated Certificates
Kevin Borgolte, Tobias Fiebig, Shuang Hao, Christopher Kruegel and Giovanni Vigna
Stale DNS records that still point at cloud IP addresses their owner has released let an attacker re-allocate the same address and pass automated domain validation, obtaining a browser-trusted certificate for someone…
-
CRLF Injection Into PHP's cURL Options
TomNomNom
PHP's cURL header options never reject carriage returns and line feeds, so user data reflected into a server-side API request header can inject extra headers. Adding a double CRLF plus a forged Content-Length lets an…
-
CVE-2018-5175: Universal CSP strict-dynamic bypass in Firefox
Masato Kinugawa
Firefox exposed a bundled require.js through a web-accessible resource URI, and browser extension resources are loaded regardless of a page's Content Security Policy. Any site protected by script-src strict-dynamic…
-
Deep Fingerprinting: Undermining Website Fingerprinting Defenses with Deep Learning
Payap Sirinam, Mohsen Imani, Marc Juarez and Matthew Wright
A convolutional neural network classifies encrypted Tor traffic traces by the site that produced them, so a local eavesdropper learns which website a user visited without breaking the encryption. It reaches over 98…
-
DNS Rebinding Headless Browsers
Alexandre Kaskasoli
Analytics backends that fetch back submitted Referer URLs do so with headless Chrome running on AWS. An image served with a Content-Length larger than the file stops the load event firing so the browser stays for…
-
Duo Finds SAML Vulnerabilities Affecting Multiple Implementations
Kelby Ludwig
XML canonicalization strips comments before a SAML signature is verified, while many XML text extraction APIs return only the text before the first comment. Inserting a comment inside a signed NameID therefore leaves…
-
Evading CSP with DOM-based dangling markup
Gareth Heyes
Dangling markup normally dies under a strict CSP because no external resource may load. Injecting an unterminated base target attribute, or a form target, instead captures the following page markup into window.name, so…
-
Exposing Intranets with reliable Browser-based Port scanning
Gareth Heyes
A browser-based port scanner that is reliable rather than timing-based: a hidden iframe loads a target host and port, then the same URL is clicked again with a hash appended and onload events are counted. A refused port…
-
Firefox uXSS and CSS XSS - Abdulrahman Al-Qabandi
Abdulrahman Al-Qabandi
A Firefox regression let a javascript URI run from a CSS background-image through the View background image context-menu item. Because an open context menu still acts on whatever page the window has navigated to…
-
Freezing the Web: A Study of ReDoS Vulnerabilities in JavaScript-based Web Servers
Cristian-Alexandru Staicu and Michael Pradel
A study of regular expression denial of service in JavaScript web servers, where the single-threaded event loop means one slow match freezes the whole site. The authors found 25 previously unknown vulnerable regexes in…
-
Grand Pwning Unit: Accelerating Microarchitectural Attacks with the GPU
Pietro Frigo, Cristiano Giuffrida, Herbert Bos and Kaveh Razavi
Integrated mobile GPUs, reachable from JavaScript through WebGL, supply the primitives for microarchitectural attacks: precise timers, a side channel over the GPU cache, and control over physical memory. The authors…
-
How I exploited ACME TLS-SNI-01 issuing Let's Encrypt SSL-certs for any domain using shared hosting
Frans Rosén
The ACME TLS-SNI-01 challenge resolved only the target domain to an IP and then looked for a generated name ending in .acme.invalid inside the certificate returned over SNI. On shared hosting such as Heroku and AWS…
-
Hunting for security bugs in AEM webapps
Mikhail Egorov
A survey of attacks on Adobe Experience Manager: dispatcher filter bypasses using extra slashes and appended extensions, exposed Sling servlets that dump JCR nodes and run arbitrary searches, user enumeration and…
-
InsertScript: Adobe Reader PDF - Client Side Request Injection
insert-script.blogspot.com
Adobe Reader's XFA submit element copies its textEncoding charset straight into the POST request the PDF makes, so a newline injected there adds arbitrary headers such as Referer, Host or Origin, or pipelines an…
-
Kicking the Rims - A Guide for Securely Writing and Auditing Chrome Extensions
Matthew Bryant
A guide to how Chrome extensions divide privilege between content scripts, background pages and isolated worlds, and to the anti-patterns that let a hostile web page cross that boundary: weak postMessage origin checks…
-
Large-Scale Analysis of Style Injection by Relative Path Overwrite - www2018rpo_paper.pdf
Sajjad Arshad, Seyed Ali Mirheidari, Tobias Lauinger, Bruno Crispo, Engin Kirda and William Robertson
Relative Path Overwrite makes a page load itself as its own stylesheet by exploiting the different ways browsers and servers resolve relative paths, so a plain text injection becomes CSS injection with no script sink…
-
Logically Bypassing Browser Security Boundaries
Jun Kokatsu
Origin checks fall when what a resource is changes after it is checked: a CSP-sandboxed frame fools the password manager, HTTP redirects and service workers swap sub-resources past the check, and HLS playlists leak…
-
MB blog: Vulnerability in Hangouts Chat: from open redirect to code execution
blog.bentkowski.info
The Hangouts Chat desktop client is an Electron app with no address bar, so redirecting its main window to an attacker domain leaves the user no way to tell. Chaining a chat.google.com/accounts redirect with a known…
-
Mobile Application Web API Reconnaissance: Web-to-Mobile Inconsistencies & Vulnerabilities
Abner Mendoza and Guofei Gu
WARDroid statically analyses Android apps to recover the HTTP templates and input-validation rules they enforce before calling their cloud APIs, then replays deliberately invalid requests to see whether the server…
-
Mystique: Uncovering Information Leakage from Browser Extensions
Quan Chen and Alexandros Kapravelos
A taint-tracking build of Chromium, combined with static data-flow analysis of extension source code, follows privacy-sensitive data from extension APIs out to the network. Run over 178,893 Chrome extensions and 2,790…
-
NAVEX: Precise and Scalable Exploit Generation for Dynamic Web Applications
Abeer Alhuzali, Rigel Gjomemo, Birhanu Eshete and V.N. Venkatakrishnan
NAVEX locates vulnerable sinks in PHP applications with a sanitization-aware code property graph, then crawls and concolically executes the deployed application to build a navigation graph so a constraint solver can…
-
Neatly bypassing CSP
@bo0om
A page with a strict CSP can still be attacked by framing a same-origin path that returns no CSP header, such as a CSS file, robots.txt or a server error page, because browsers wrap those responses in HTML. Script…
-
O Single Sign-Off, Where Art Thou? An Empirical Analysis of Single Sign-On Account Hijacking and Session Management on the Web
Mohammad Ghasemisharif, Amrutha Ramesh, Stephen Checkoway, Chris Kanich and Jason Polakis
An empirical study of single sign-on account hijacking: a Facebook cookie hijacking attack gives full account takeover, and further attacks retain long-term control of the relying-party accounts it unlocks, measured…
-
Piercing the Veil: Server Side Request Forgery to NIPRNet access
Alyssa Herrera and @Alyssa_Herrera_
Two Department of Defense Jira instances exposed the unauthenticated oauth icon-uri endpoint to server-side request forgery, which was used to read AWS instance metadata and to reach internal services on NIPRNet…
-
Pride and Prejudice in Progressive Web Apps: Abusing Native App-like Features in Web Applications
Jiyeon Lee, Hayeon Kim, Junghwan Park, Insik Shin and Sooel Son
Studies progressive web apps’ push notifications, offline caches and service workers. It demonstrates push-domain spoofing through leaked subscription objects, offline history inference from cross-origin iframe load…
-
RCE by uploading a web.config
003random
Where an IIS upload filter blocks executable extensions such as .asp and .aspx, uploading a web.config instead is allowed. That file registers an ISAPI handler for .config and removes the request-filtering entries that…
-
Read&Write Chrome Extension Same Origin Policy (SOP) Bypass Vulnerability
Matthew Bryant
The Read&Write Chrome extension injected a content script into every page that relayed any postMessage to its privileged background page without checking the sender's origin. Any site could therefore call background…
-
reCAPTCHA bypass via HTTP Parameter Pollution
Andres Riancho
Applications that build the reCAPTCHA siteverify URL by string concatenation let an attacker smuggle a second secret parameter through the response field. Because the API honoured the first secret, supplying Google's…
-
Report Spam, Get Owned
Tim Tomes
Gmail's Report Spam button also offers to unsubscribe, and taking that offer makes Google open the message's unsubscribe URL in the user's browser. An attacker can put a CSRF payload in that link, so the very action…
-
Riding out DOMsday: Towards Detecting and Preventing DOM Cross-Site Scripting
William Melicher, Anupam Das, Mahmood Sharif, Lujo Bauer and Limin Jia
A browser with taint tracking in its JavaScript engine crawled the Alexa top 10,000 to measure DOM XSS, with a better test for whether a source-to-sink flow is truly exploitable, finding 83 percent more bugs than the…
-
Ruby 2.x Universal RCE Deserialization Gadget Chain
Luke Jahnke
A universal deserialization gadget chain built only from the Ruby standard library loaded by default, so Marshal.load on untrusted bytes runs commands with no gems present and no missing-method call needed. It routes…
-
Save Your Cloud: DoS on VMs in OpenNebula 4.6.1
web-in-security.blogspot.com
Renaming an OpenNebula virtual machine to a name holding an unclosed XML tag makes the backend auto-close it in the wrong place, producing a record that no longer matches the expected schema. The core then fails to…
-
Scratching the surface of host headers in Safari
Linus Särud
Safari accepts characters in a hostname that other browsers reject, so on sites with wildcard DNS the subdomain itself becomes the injection, reflected into HTML or passed to jQuery html(). Form-attribute payloads with…
-
Security Analysis of eIDAS — The Cross-Country Authentication Scheme in Europe
USENIX
A security analysis of eIDAS, the cross-border electronic identity scheme European member states must recognise. Testing national eIDAS-Connector and eIDAS-Service implementations found XML attacks reaching them through…
-
Security Risks in Asynchronous Web Servers: When Performance Optimizations Amplify the Impact of Data-Oriented Attacks
Micah Morton, Jan Werner, Panagiotis Kintis, Kevin Snow, Manos Antonakakis, Michalis Polychronakis and Fabian Monrose
Asynchronous web servers like Nginx serve every client from one long-lived process, so a single memory bug reaches all of them. The paper traces memory to locate configuration structures, beats ASLR with a…
-
Security: HTTP Smuggling, Apsis Pound load balancer
regilero
The Pound load balancer accepts two Content-Length headers, lets whichever framing header came first win over Transfer-Encoding, and treats a NUL byte in a header as a line continuation. Paired with any other HTTP actor…
-
Server-Side Spreadsheet Injection - Formula Injection to Remote Code Execution - Bishop Fox
@bishopfox
Formula injection becomes a server side problem when an application builds or converts spreadsheets itself. A payload in an exported Google Sheet exfiltrates the whole sheet live through IMPORTDATA, and on servers that…
-
SMB hash hijacking & user tracking in MS Outlook
Soroush Dalili
Outlook blocks external content and UNC-prefixed paths in HTML mail, but enforces it over a narrower surface than its renderer resolves. Legacy schemes (its:, mk:@MSITStore:, mhtml:, res:, knownfolder:, cid:) and…
-
Spectre Attacks: Exploiting Speculative Execution
Paul Kocher, Jann Horn, Anders Fogh, Daniel Genkin, Daniel Gruss, Werner Haas, Mike Hamburg, Moritz Lipp, Stefan Mangard, Thomas Prescher, Michael Schwarz and Yuval Yarom
Attackers mistrain a CPU's branch predictors so a victim speculatively executes instruction sequences it never should, then recover the discarded results through cache timing. This reads arbitrary memory across process…
-
Story of my two (but actually three) RCEs in SharePoint in 2018 | Soroush Dalili (@irsdl) -- سروش دلیلی
Soroush Dalili
SharePoint workflow protection mechanisms fell two ways: a logic flaw in the workflow checks, and deserialisation of untrusted data when compiling XOML workflow definitions. Both yield remote code execution on…
-
Study and Mitigation of Origin Stripping Vulnerabilities in Hybrid-postMessage Enabled Mobile Applications
Guangliang Yang, Jeff Huang, Guofei Gu and Abner Mendoza
postMessage extended for hybrid mobile apps treats native code as an extra frame, and a message origin is not respected or is lost outright on delivery. Code injected into a WebView can passively read messages holding…
-
SYNODE: Understanding and Automatically Preventing Injection Attacks on Node.js
Cristian-Alexandru Staicu, Michael Pradel and Benjamin Livshits
A study of 235,850 npm modules shows exec and eval sinks are widespread and almost never sanitised, so attacker-controlled strings reach the shell or the JavaScript engine and run arbitrary commands. Synode statically…
-
Telegram anonymity fails in desktop - CVE-2018-17780
Dhiraj Mishra
Telegram's desktop and Windows Phone clients forced peer-to-peer calls with no setting to refuse them, so placing or answering a call exposed both parties' public and private IP addresses to each other. Anyone able to…
-
Vetting Single Sign-On SDK Implementations via Symbolic Reasoning
Ronghai Yang, Wing Cheong Lau, Jiongyi Chen and Kehuan Zhang
S3KVetter models Single Sign-On SDKs symbolically and tests them for logical correctness rather than for crashes. Applied to ten widely deployed SSO SDKs it found seven classes of logic flaw, four previously unknown…
-
VPN Extensions are not for privacy
filedescriptor
Browser VPN extensions are really proxy extensions driven by a PAC script, and the usual mistakes in those scripts leak the user's real address. Calling dnsResolve hands every hostname to the ISP, while misused helpers…
-
Web Cache Deception Attack
Omer Gil
Appending a non-existent static filename to an authenticated page URL, such as /account.do/logo.png, makes some servers return the page while the cache stores it under the .png key. The attacker then fetches that same…
-
WPSE: Fortifying Web Protocols via Browser-Side Security Monitoring
Stefano Calzavara, Riccardo Focardi, Matteo Maffei, Clara Schneidewind, Marco Squarcina and Mauro Tempesta
WPSE is a browser-side monitor that enforces the intended message flow plus confidentiality and integrity of a web protocol run, formally proved expressive enough to stop a range of implementation bugs and web attacks…