Top 10 Web Hacking Techniques

2019

The 2019 Top 10 Web Hacking Techniques: all 10 winners and 69 nominated and collected techniques, each with its researcher, summary and preserved source.

69 records · 10 in the top ten · open this year in the interactive archive

The top ten

1. #1 Cached and Confused: Web Cache Deception in the Wild Seyed Ali Mirheidari, Sajjad Arshad, Kaan Onarlioglu, Bruno Crispo, Engin Kirda and William Robertson

   Web cache deception exploits path confusion: a URL such as /account.php/nonexistent.jpg looks static to a caching proxy but resolves to a private page at the origin, so the cache stores it for any attacker to fetch. A…

2. #2 Cross-Site Leaks @sirdarckcat

   The browser HTTP cache answers cross-site questions: evict a resource with a POST or an overlong Referer, make the victim load a target page, then re-probe to see whether it got cached. That reveals whether the page…

3. #3 Owning The Clout Through Server Side Request Forgery Ben Sadeghipour and Cody Brocious

   Server-side HTML to PDF generators render attacker markup in the server's own context, so an injected iframe or an escape from a style tag turns the export feature into server-side request forgery that reaches cloud…

4. #4 Hacking Jenkins Part 2 - Abusing Meta Programming for Unauthenticated RCE! Orange Tsai

   Jenkins validated pipeline scripts by handing them to the Groovy parser, but Groovy compile-time meta-programming executes code while parsing. An unauthenticated attacker uses @GrabResolver and @Grab so Grape fetches a…

5. #5 Google Search XSS LiveOverflow

   Explains how a Google Search XSS was found: fuzzing pairs of HTML tags through different parsing paths and diffing what a sandboxed iframe, DOMParser and createHTMLDocument produce, which exposes noscript and noembed…

6. #6 All is XSS that comes to the .NET @phaldrzynski and Paweł Hałdrzyński

   ASP.NET still accepts a cookieless session segment such as (A(...)) anywhere in a URL path, and Control.ResolveUrl copies that attacker-controlled segment into every app-root-relative URL it emits. Injecting a quote and…

7. #7 Exploring Continuous Integration Services as a Bug Bounty Hunter EdOverflow, Justin Gardner and Corben Leo

   Public continuous-integration build logs on Travis CI, Circle CI and GitLab CI expose secrets belonging to bug bounty targets and their organisation members. The authors automated pulling logs through the vendor APIs…

8. #8 Infiltrating Corporate Intranet Like NSA: Pre-Auth RCE On Leading SSL VPNs Orange Tsai and Meh Chang

   Pre-auth remote code execution chains against Fortigate and Pulse Secure SSL VPNs: traversal file reads, a heap overflow in the web proxy, an undocumented password-reset key, and command injection through a flaw in…

9. #9 Microsoft Edge (Chromium) - Elevation of Privilege to Potential RCE @qab

   Chromium Edge's new tab page is a remote MSN page holding privileged chrome APIs, and unsanitised top-site titles gave script execution inside it. Calling the undocumented chrome.qbox.navigate with a null url crashed…

10. #10 Exploiting Null Byte Buffer Overflow for a $40,000 bounty Sam Curry and @samwcyo

    A registration form passed a user string and its length to a back-end C routine; null bytes were stripped in transit but the length was not, so the C side read past the shortened string. Repeating a POST full of %00…

Also collected

• A Tale of Exploitation in Spreadsheet File Conversions Brett Buerhaus, Cody Brocious, Sam Erb and Olivier Beg

  Server-side document conversion with LibreOffice is fingerprinted through spreadsheet INFO functions and PDF metadata, then abused because LibreOffice picks the format from file contents, not the extension. An ODS or…

• Abusing autoresponders and email bounces Inti De Ceukelaire

  Autoresponders and delivery bounces return the attacker's own message together with internal details. Filling a Google Drive owner's mailbox made the access-request mail, sent from the attacker's address, bounce back…

• Abusing HTTP hop-by-hop request headers nathandavison.com

  Naming arbitrary headers in the HTTP Connection header marks them hop-by-hop, and proxies that forward that list instead of consuming it let an attacker delete headers a downstream hop added. Removing X-Forwarded-For…

• All Your Clicks Belong to Me: Investigating Click Interception on the Web Mingxue Zhang, Wei Meng, Sangho Lee, Byoungyoung Lee and Xinyu Xing

  A measurement study of how third-party scripts steal user clicks. An instrumented browser framework called Observer analysed the Alexa top 250K sites and identified three interception techniques, finding 437 scripts…

• Apache Solr Injection Research Michael Stepankin

  Apache Solr parameter injection: an application that pastes unencoded user input into its Solr query lets an attacker smuggle extra parameters such as shards, qt and stream.body, or Solr local parameters like an…

• At Home Among Strangers Bo0oM

  Reverse proxies append the real client IP to X-Forwarded-For, so a spoofed value is normally harmless. Placing a bare carriage return in the header makes some back ends stop parsing at the CR and trust the attacker's…

• Backchannel Leaks on Strict Content-Security Policy Mazin Ahmed and @mazen160

  Under a strict default-src 'self' policy the browser still allows outbound requests to unapproved hosts. Chrome does not enforce CSP on link rel=prerender, and Chrome, Firefox and Safari all follow a meta…

• Bypassing CSP with policy injection Gareth Heyes

  A URL parameter reflected into a CSP report-uri directive lets an attacker append directives to the policy. On Edge a semicolon and underscore make the syntax invalid so the whole policy is dropped, and on Chrome an…

• Bypassing SOP Using the Browser Cache Aleksei Tiurin

  The browser cache is keyed only on the absolute URL, with no record of which origin requested it. A JSONP or CORS response cached after a legitimate same-site request is handed back to any site that requests the same…

• Common Security Issues in Financially-Oriented Web Applications Soroush Dalili

  An NCC Group guideline cataloguing business-logic flaws specific to e-commerce and financial web applications: TOCTOU and race conditions on balance checks, parameter and currency manipulation, rounding and numeric…

• CPDoS: Cache Poisoned Denial of Service Hoai Viet Nguyen, Luigi Lo Iacono and Hannes Federrath

  CPDoS poisons a cache with an error page instead of content: a single request carrying an oversized header, a meta character or a method-override header passes the cache but makes the origin fail. The cache stores the…

• Cross-Origin State Inference (COSI) Attacks: Leaking Web Site States through XS-Leaks Avinash Sudhodanan, Soheil Khodayari and Juan Caballero

  A cross-origin state inference attack lures a victim to an attacker page that uses cross-origin browser behaviour, or XS-Leaks, to infer the victim's state at a target site, going well past logged-in detection to…

• Cross-Site Challenge-Response Attacks Nethanel Gelernter and Itamar Peretz

  Brute-forces password and secret-code challenge-response checks across origins by making visitors' browsers submit guesses and reading success from side channels that survive the same-origin policy. One variant turns…

• DOMPurify 2.0.0 bypass using mutation XSS securitum

  A Chrome and Safari parsing quirk re-serializes markup so content nested inside an svg element jumps out of it when innerHTML is assigned to itself. Markup that DOMPurify judges harmless on first parse therefore mutates…

• Don't open that XML: XXE to RCE in XML plugins for VS Code, Eclipse, Theia, ... thezero and zi0black

  The LSP4XML language server parses XML as soon as an editor opens or saves it, so a malicious file triggers an external entity fetch with no further user action. Its DTD cache then writes the downloaded file to a path…

• ESI Injection Part 2: Abusing specific implementations Philippe Arteau

  Three vendor-specific abuses of injected Edge Side Include tags: an inline fragment writes a fetchable poisoned page into the cache, a remote stylesheet on an include reaches a Java XSLT engine and runs commands, and a…

• Exploiting Deserialisation in ASP.NET via ViewState Soroush Dalili

  ASP.NET signs and encrypts the __VIEWSTATE parameter using machineKey values, so when MAC validation is disabled or the validation and decryption keys leak, an attacker forges a ViewState carrying a serialisation gadget…

• Exploiting JNDI Injections in Java Veracode

  Java 8u191 stopped JNDI lookups loading remote classes, but a malicious RMI or LDAP server can still return a reference naming Tomcat's BeanFactory as its object factory. BeanFactory builds any bean and its forceString…

• Exploiting padding oracles with fixed IVs Teddy Katz’s Blog

  A session token is encrypted with AES-CBC but never signed and uses a fixed IV, so a padding oracle can forge chosen plaintext apart from one uncontrollable random block. Reusing the leading blocks of a freely issued…

• Exploiting prototype pollution - RCE in Kibana @SecurityMB

  Turns prototype pollution into remote code execution in Kibana. A Timelion expression that assigns through an object's prototype pollutes Object.prototype, and Kibana's Canvas then spawns a node child process whose…

• Exploiting Spring Boot Actuators Michael Stepankin

  Spring Boot actuator endpoints left unauthenticated are turned into remote code execution. The jolokia endpoint reloads a Logback config from an attacker URL that performs a JNDI lookup, and the env endpoint rewrites…

• Exploiting SSRF in AWS Elastic Beanstalk Sunil Yadav

  An SSRF in an app hosted on AWS Elastic Beanstalk reaches the instance metadata service and steals the default aws-elasticbeanstalk-ec2-role credentials. The default policy permits listing and writing any…

• Facebook Messenger server random memory exposure through corrupted GIF Dzmitry

  Uploading a GIF whose header declares a canvas size but carries no image data made the Facebook Messenger server-side renderer return a picture filled with uninitialised memory. Repeated uploads of the same file…

• Finding and Exploiting .NET Remoting over HTTP using Deserialisation Soroush Dalili

  Servers exposing .NET Remoting over HTTP with TypeFilterLevel set to Full deserialise attacker-supplied SOAP bodies, so ysoserial.net gadgets reach code execution once the Body tags are stripped or a dummy method tag is…

• Get pwned by scanning QR Code Nikhil Mittal

  Firefox for iOS executed javascript URIs supplied by its built-in QR code scanner, so scanning a crafted code ran script in the context of the page the user was already viewing and could read its contents and cookies…

• Getting Shell with XAMLX Files Soroush Dalili

  Uploading a .XAMLX workflow-service file to an IIS application runs code, either through XAML deserialisation gadgets wrapped in an Array element at compile time or through inline C# and expression activities evaluated…

• HostSplit: Exploitable Antipatterns in Unicode Normalization Jonathan Birch

  Some Unicode characters normalise under NFKC to ASCII with URL syntax meaning, so a hostname validated as a subdomain of a trusted site resolves as a different host plus a path, bypassing allow-lists and stealing OAuth…

• HTTP Desync Attacks: Request Smuggling Reborn James Kettle

  Revives HTTP request smuggling by making front-end and back-end servers disagree about where a request ends, using conflicting Content-Length and Transfer-Encoding headers hidden by parser quirks. Timing-based detection…

• Iframes/Popups Are Dangerous in Mobile WebView: Studying and Mitigating Differential Context Vulnerabilities GuangLiang Yang, Jeff Huang and Guofei Gu

  Android WebView lets an untrusted iframe or popup share context with the host page, a class the authors call differential context vulnerabilities. An embedded frame can forge web messaging, reach app-exposed mobile…

• IIS Application vs. Folder Detection During Blackbox Testing Soroush Dalili

  Requesting a built-in ASP.NET service endpoint such as profile_json_appservice.axd/jsdebug under any path reveals whether that path is an IIS application, which answers with 200 and JavaScript, or merely a folder, which…

• JavaScript Template Attacks: Automatically Inferring Host Information for Targeted Exploits Michael Schwarz, Florian Lackner and Daniel Gruss

  An automated method records every property JavaScript can read in many environments and builds templates from them, so a property stable on one system but different on another leaks the host. Two new side channels also…

• Latex Gloves: Protecting Browser Extensions from Probing and Revelation Attacks Alexander Sjösten, Steven Van Acker, Pablo Picazo-Sanchez and Andrei Sabelfeld

  Browser extensions give themselves away: a page can probe web-accessible resources by URL, and an extension that injects a WAR reference into the page reveals Firefox per-profile random UUID. Combining revelation with…

• Leaky Images: Targeted Privacy Attacks in the Web Cristian-Alexandru Staicu and Michael Pradel

  An image shared privately with one user is requested by an attacker-controlled page, and the load succeeds only for that logged-in user, revealing that a specific person is visiting the site. It needs neither JavaScript…

• Let's Make Windows Defender Angry: Antivirus can be an oracle! Ryo Ichikawa

  AVOracle turns antivirus into a side channel: when a file holds both attacker-controlled data and a secret, a JScript or HTML payload split around the secret makes Windows Defender flag the file only for the right…

• Measuring and Analyzing Search Engine Poisoning of Linguistic Collisions Matthew Joslin, Neng Li, Shuang Hao, Minhui Xue and Haojin Zhu

  Misspellings that happen to be real words, often in another language, slip past search engines' auto-correction, so attackers can rank malicious pages against those queries. A crawl of 1.77 million misspelled searches…

• PhishFarm: A Scalable Framework for Measuring the Effectiveness of Evasion Techniques against Browser Phishing Blacklists Adam Oest, Yeganeh Safaei, Adam Doupé, Gail-Joon Ahn, Brad Wardman and Kevin Tyers

  PhishFarm deploys 2,380 live PayPal-branded decoy phishing sites on fresh .com domains, each behind one of six request filters taken from real phishing kits, reports them to 10 anti-phishing entities and times browser…

• PHP-FPM RCE(CVE-2019-11043) Orange Tsai

  A newline in the URI makes nginx pass an empty PATH_INFO to PHP-FPM, so a pointer calculation underflows and writes a null byte before the buffer, corrupting the FastCGI environment allocator. A following putenv then…

• Postcards from the Post-HTTP World: Amplification of HTTPS Vulnerabilities in the Web Ecosystem Stefano Calzavara, Riccardo Focardi, Matus Nemec, Alvise Rabitti and Marco Squarcina

  A crawl of the Alexa top 10k plus 90,816 dependency and sub-domain hosts maps still-exploitable TLS flaws such as ROBOT, DROWN, POODLE-TLS and Heartbleed onto attack trees, then measures the web-application damage. 898…

• Practical Decryption exFiltration: Breaking PDF Encryption Jens Müller, Fabian Ising, Vladislav Mladenov, Christian Mainka, Sebastian Schinzel and Jörg Schwenk

  Modified encrypted PDFs exfiltrate plaintext when their recipients decrypt them. Partial encryption permits attacker-controlled forms, links or scripts to reference encrypted objects; unauthenticated CBC and known…

• Provoking browser quirks with behavioural fuzzing Gareth Heyes

  Behavioural fuzzing drives every Unicode code point into a chosen HTML or JavaScript position and diffs the parse result to expose browser quirks. In Firefox it shows a newline closing an HTML comment after an…

• Re-Animating ActivitySurrogateSelector Nick Landers

  Microsoft's .NET 4.8 fix for the ActivitySurrogateSelector deserialization gadget is only a type check that a hidden app setting can disable. A still-working gadget, TextFormattingRunProperties driving XamlReader and…

• Remote Code Execution via Insecure Deserialization in Telerik UI Caleb Gross

  Telerik UI for ASP.NET AJAX takes the object type from its encrypted rauPostData upload parameter and hands it to JavaScriptSerializer. After breaking the hard-coded upload encryption key and uploading a mixed mode…

• Reusing Cookies Ricardo Iramar dos Santos

  SaaS vendors that let customers point a subdomain at them by CNAME often share one session cookie across the vendor domain and every customer domain. An attacker signs up for a trial and retargets his own cookie Domain…

• Reverse proxies & Inconsistency Aleksei "GreenDog" Tiurin

  Reverse proxies, caches and load balancers decode and normalise URLs differently from the origin server, so path parameters, encoded dot-segments and double slashes make the two disagree about which path a request is…

• Scalable Scanning and Automatic Classification of TLS Padding Oracle Vulnerabilities Robert Merget, Juraj Somorovsky, Nimrod Aviram, Craig Young, Janis Fliegenschmidt, Jörg Schwenk and Yuval Shavitt

  First large-scale scan for CBC padding oracle flaws in TLS, using a reduced probe set and automatic classification of server response fingerprints. It found 1.83 percent of the Alexa Top Million vulnerable across nearly…

• Security analysis of portal element @SecurityMB

  Security review of Chrome's new portal element, which embeds a page that behaves like a top-level frame. It accepted file, chrome and javascript URLs for cross-origin script execution, ignored X-Frame-Options, allowed…

• SSO Wars: The Token Menace Oleksandr Mirosh and Alvaro Muñoz

  Two flaws in .NET single sign-on. An unvalidated algorithm name from a JWT header or an XML SignatureMethod reaches CryptoConfig, letting an attacker instantiate arbitrary types; Dupe Key Confusion adds a second KeyInfo…

• SSRF Protocol Smuggling in Plaintext Credential Handlers : LDAP Willis Vandevanter

  LDAP client libraries pass CRLF through in the username and password of a plaintext simple bind, so an application letting a user set the LDAP server, port and credentials becomes an SSRF that can speak other plaintext…

• Telerik Revisited Markus Wulftange

  Re-examines CVE-2017-11317 in Telerik UI for ASP.NET and finds it is more than an arbitrary file upload: the rauPostData blob carries an assembly-qualified type name handed to JavaScriptSerializer, giving arbitrary…

• The Betrayal at Cloud City: An Empirical Analysis of Cloud-Based Mobile Backends Omar Alrawi, Chaoshun Zuo, Ruian Duan, Ranjita Pai Kasturi, Zhiqiang Lin and Brendan Saltaformaggio

  An automated pipeline called SkyWalker extracts the backend URLs an Android app contacts and remotely vets those cloud services. Across the top 5,000 free Play Store apps it found 983 N-day and 655 0-day vulnerabilities…

• The Cookie Monster in Your Browsers filedescriptor

  A tour of how browsers and servers disagree about cookies: a subdomain can force a cookie onto its parent (cookie tossing), oversized cookies make a server reject requests (cookie bomb), and servers that still split on…

• The world of Site Isolation and compromised renderer Jun Kokatsu

  Shows what an attacker who has already compromised a Chrome renderer process can still reach despite Site Isolation: spoofed-origin postMessage steals PDF text, registerProtocolHandler and Reader mode enforce their…

• Turbo Intruder: Embracing the billion-request attack James Kettle

  A Burp extension built on a hand-written HTTP stack that sends requests far faster than normal tooling, reaching about 30,000 requests per second and sustaining multi-day attacks at flat memory. Python-scripted attacks…

• Unveiling vulnerabilities in WebSocket APIs Mikhail Egorov

  Surveys weaknesses in WebSocket APIs: cross-site WebSocket hijacking including a null-origin variant delivered from a data URI iframe, missing authentication and object-reference checks on individual messages, and…

• Uploading web.config for Fun and Profit 2 Soroush Dalili

  Uploading a web.config file into an IIS application root or a subfolder to reach code execution. Managed handlers run the file itself as an ASPX page, AspNetCoreModule sets a process path, machineKey and JSON_AppService…

• What Are You Searching For? A Remote Keylogging Attack on Search Engine Autocomplete John V. Monaco

  Search autocomplete fires a request per keystroke, so an eavesdropper on encrypted traffic can combine packet inter-arrival timing, the percent-encoded Space character in the query URL, and HTTP/2 HPACK static Huffman…

• x-up-devcap-post-charset Header in ASP.NET to Bypass WAFs Again Soroush Dalili

  When the User-Agent starts with UP, ASP.NET takes the request body charset from the non-standard x-up-devcap-post-charset header instead of the Content-Type charset directive. An attacker encodes a POST payload in an…

• XSS in GMail's AMP4Email via DOM Clobbering @SecurityMB

  AMP4Email in Gmail allowed the id attribute, so DOM clobbering was possible. Two anchors sharing an id yield an HTMLCollection whose members can be addressed by name, and an anchor stringifies to its href, letting an…

• XSS-Auditor --- the protector of unprotected and the deceiver of protected terjanq and @terjanq

  Chrome's XSS Auditor was reverted from block mode to filter mode, so instead of stopping a page it silently strips the matched script. Reflecting a fake match aimed at a page's own defensive script deletes that script…