Top 10 Web Hacking Techniques

2020

The 2020 Top 10 Web Hacking Techniques: all 10 winners and 70 nominated and collected techniques, each with its researcher, summary and preserved source.

70 records · 10 in the top ten · open this year in the interactive archive

The top ten

1. #1 h2c Smuggling: Request Smuggling Via HTTP/2 Cleartext (h2c) Jake Miller and @theBumbleSec

   A proxy that forwards Upgrade and Connection headers lets a client negotiate HTTP/2 cleartext with the back end, after which the proxy stops inspecting traffic and becomes a blind TCP tunnel. Every multiplexed request…

2. #2 Portable Data exFiltration: XSS for PDFs Gareth Heyes

   PDF libraries such as PDF-Lib and jsPDF do not escape parentheses in annotation URIs, so text placed into a generated PDF can close the string and inject new dictionary keys, actions and JavaScript. That gives script…

3. #3 Attacking Secondary Contexts in Web Applications Sam Curry

   When an application forwards a request to a second internal API, encoded traversal in the user-controlled part of the path rewrites the internal route. The talk shows reading other users' invoices and payment methods…

4. #4 TLS-poison jmdx

   TLS-poison abuses TLS session persistence combined with DNS rebinding so that an https URL fed to a victim client (curl, or a browser image tag) is redirected mid-session to an internal service. This delivers…

5. #5 NAT Slipstreaming Samy Kamkar

   A malicious web page measures the victim's MTU and internal IP, then pads an HTTP POST or a WebRTC TURN username so attacker-chosen bytes begin a fresh TCP segment or IP fragment, which the router's SIP or H.323…

6. #6 Smuggling HTTP headers through reverse proxies Robin Verton

   Reverse proxies and back-end frameworks normalize header names differently, so a header Apache unsets as CLIENT_VERIFIED can be resent with a hyphen and still reach Django, Flask or PHP as the same value. Combined with…

7. #7 Unauthenticated RCE on MobileIron MDM Orange Tsai

   Chains flaws in MobileIron MDM into unauthenticated remote code execution: an Apache rewrite ACL is stepped around with a path-normalisation trick to reach a Hessian deserialization endpoint, and a new Groovy…

8. #8 ImageMagick - Shell injection via PDF password insert-script.blogspot.com

   ImageMagick puts the -authenticate value straight into the Ghostscript command line inside double quotes, so a password containing a quote and a shell metacharacter closes the argument and runs commands. The parameter…

9. #9 Attacking MS Exchange Web Interfaces Arseniy Sharoglazov and @_mohemiv

   Surveys the ways a low-privilege domain account can attack an internet-facing MS Exchange web interface, then adds a new one: reaching the RPC over HTTP v2 proxy by the NetBIOS name leaked in NTLMSSP and abusing…

10. #10 WAF evasion techniques @phaldrzynski and Paweł Hałdrzyński

    Imperva normalises a payload before matching it, so mixing a tab with a space inside an svg onload attribute, obfuscating alert through array constructors, or using the rare union distinct select syntax slips XSS and…

Also collected

• A Security Review of SharePoint Site Pages Soroush Dalili

  SharePoint parses customised site pages with CompilationMode.Never so inline code never runs, but where an administrator allows compilation with server-side script still disabled, the namespace value of an import or…

• A Tale of Two Headers: A Formal Analysis of Inconsistent Click-Jacking Protection on the Web Stefano Calzavara, Sebastian Roth, Alvise Rabitti, Michael Backes and Ben Stock

  Framing control is split between X-Frame-Options and CSP frame-ancestors, which browsers implement differently. A formal model and an automated policy analyser found ten percent of distinct framing policies in the wild…

• Advanced MSSQL Injection Tricks PT SWARM Team and @ptswarm

  A set of MSSQL injection techniques: DNS out-of-band exfiltration through fn_xe_file_target_read_file, fn_get_audit_file and fn_trace_gettable, error-based extraction from type conversion errors in functions such as…

• AST Injection, Prototype Pollution to RCE posix

  Prototype pollution in a Node.js application can insert nodes into the abstract syntax tree that a template engine passes from parser to compiler. Handlebars and Pug then compile attacker-supplied AST fragments without…

• Blind SQL Injection without an "in" terjanq and @terjanq

  A blind MySQL injection worked under a filter banning UNION SELECT, information_schema and any word containing in or or. Table names come from sys.x$schema_flattened_keys and sys.schema_table_statistics, row-vs-row…

• Blind SSRF exploitation @bo0om

  A field guide to exploiting server-side request forgery when no response comes back: brute-forcing basic auth through credentials in the URL, timing anomalies to map internal hosts and ports, multiple DNS A records and…

• Bypass SameSite Cookies Default to Lax and get CSRF Renwa and @RenwaX23

  Chrome's Lax-by-default cookies keep a two-minute Lax+POST exemption, so a session cookie set or changed within the last two minutes is still sent on a cross-site top-level POST. An attacker who forces a fresh session…

• Cache Key Normalization Denial of Service iustin24.github.io

  A cache that normalises part of the key while forwarding the request untouched can be poisoned with one request. Capitalising the Host header, or altering a path segment the cache collapses, makes the origin return a…

• Carnus: Exploring the Privacy Threats of Browser Extension Fingerprinting Soroush Karami, Panagiotis Ilia, Konstantinos Solomos and Jason Polakis

  Carnus automatically builds behavioural fingerprints of browser extensions from DOM changes, outgoing HTTP requests and intra-browser message traffic, not just web accessible resources. Fingerprinting 29,428 extensions…

• CDN Judo: Breaking the CDN DoS Protection with Itself Run Guo, Weizhong Li, Baojun Liu, Shuang Hao, Jia Zhang, Haixin Duan, Kaiwen Sheng, Jianjun Chen and Ying Liu

  Weaknesses in how CDNs forward requests let an attacker turn the CDN's own capacity against the site it shields: HTTP/2 request conversion and pre-POST forwarding exhaust CDN-to-origin bandwidth and origin connection…

• Chaining Exposed Actuators and H2 Database Aliases in Spring Boot 2 spaceraccoon.dev

  An exposed Spring Boot 2 actuator env endpoint lets an attacker set the HikariCP connection test query, which the pool runs as SQL on the next database connection. Against an H2 database that query can CREATE ALIAS a…

• Code injection in Workflows leading to SharePoint RCE Soroush Dalili

  SharePoint compiled XOML workflow files without escaping attribute values such as the InterfaceType of CallExternalMethodActivity, writing them straight into generated C# source. Injecting there escapes the generated…

• Composition Kills: 18 Attacks on Email Sender Authentication Jianjun Chen, Vern Paxson and Jian Jiang

  Inconsistent message parsing between the components of email systems lets attackers bypass SPF, DKIM, and DMARC to impersonate arbitrary senders and forge DKIM-signed mail with a legitimate site's signature. Manual…

• Covert Web Shells in .NET with Read-Only Web Paths Soroush Dalili

  Given a .NET code-execution bug (SharePoint CVE-2020-1147 deserialization) but a non-writable web directory, an attacker can register a VirtualPathProvider ghost web shell that exists only in memory. It serves a web…

• CSS data exfiltration in Firefox via a single injection point mibe

  Firefox parses stylesheets synchronously and caps connections per host, which blocks the single-injection CSS exfiltration trick that works in Chrome. Splitting each @import into its own style element and serving the…

• Deceptive Previews: A Study of the Link Preview Trustworthiness in Social Platforms Giada Stivala and Giancarlo Pellegrino

  Measures how 20 social networks and messengers build link previews from a page's own metadata. Four render previews that hide the real destination even from a careful user, all of them can be given misleading previews…

• DOM Clobbering strikes back Gareth Heyes

  DOM clobbering gives HTML elements id and name attributes so they overwrite globals and object properties that script later trusts. New variants clobber three levels deep with forms and DOM collections, control an…

• Exploiting "Google BigQuery" SQL Injection Vulnerability Duc Nguyen The

  A bug bounty target's parameter was injectable into a Google BigQuery SQL query sitting behind Akamai Kona WAF. By profiling which keywords the WAF blocked and then using BigQuery's LENGTH and STRPOS with a…

• Exploiting dynamic rendering engines to take control of web apps r2c

  Dynamic rendering services such as Rendertron and Prerender run a headless browser server-side for crawlers, and the URL it fetches is attacker-controlled through a spoofed crawler User-Agent or an open redirect. That…

• Exploiting email address parsing with AWS SES nathandavison.com

  AWS SES and many language email parsers disagree on which address a malformed string such as an angle-address followed by a second bare address actually targets. An app that validates or extracts the domain from one…

• Exploiting HSQLDB Mikhail Klyuchnikov and @m1ke_n1

  An Apache and Tomcat path-normalisation difference lets /..;/ in a URL slip past the F5 BIG-IP TMUI proxy rules and reach the hidden hsqldb servlet unauthenticated. Default HSQLDB credentials then allow arbitrary SQL…

• Exploiting POST-based XSSI @1lastBr3ath and Prakash

  A service worker on the attacker's own page intercepts its own script include and reissues it as a credentialed cross-origin POST with a safelisted content type. Any endpoint that answers a POST with valid JavaScript…

• Fastjson: exceptional deserialization vulnerabilities Peter Stöckli

  Fastjson guards its autoType deny list by hash in nine separate places, yet exception classes are still instantiated when autoType is off. A nested @type paired with a $ref reference reaches getters on that exception…

• Forcing Firefox to Execute XSS Payloads during 302 Redirects gremwell.com

  An open redirect that reflects a parameter into the Location header allows CRLF header injection and body injection, but browsers normally ignore the body of a 302 response. Setting the Location to a ws or wss URI…

• FUSE: Finding File Upload Bugs via Penetration Testing Taekjin Lee, Seongil Wi, Suyoung Lee and Sooel Son

  FUSE mutates file upload requests so they pass a web application's content-filtering checks while preserving the uploaded file's execution semantics, exposing unrestricted file upload and unrestricted executable file…

• Hacking AWS Cognito Misconfigurations Sunil Yadav

  A login-only application exposed its AWS Cognito app client and pool identifiers in the client-side JavaScript SDK, and Cognito still permitted self sign-up. The new account's token minted temporary AWS credentials with…

• How Secure Are Your Universally Unique IDentifiers (UUIDs)? Matias Choren

  Explains UUID layouts and the risks of using predictable identifiers as security tokens. A worked UUIDv1 example brackets a hidden password-reset token between two observable tokens and enumerates the timestamp…

• HTTP Request Smuggling in 2020 Amit Klein

  Five new request smuggling variants make a proxy and a web server disagree on where a request ends, using header names like Content-Length abcde, a bare CR in a header name, a text/plain body and HTTP/1.2 to slip past…

• Information Leaks via Safari’s Intelligent Tracking Prevention Artur Janc, Krzysztof Kotowicz, Lukas Weichselbaum and Roberto Clapis

  Safari’s user-specific tracking-prevention list creates global state that websites can alter and probe. Overlong Referer headers and other request side channels reveal domain classification, enabling browsing-history…

• Marginwidth/marginheight - the unexpected cross-origin communication channel @SecurityMB

  The HTML rendering spec lets a framed document take its body margin from the parent frame's marginwidth and marginheight attributes, and browsers honour this across origins. Chromium and Safari reflect the value into…

• Melting Pot of Origins: Compromising the Intermediary Web Services that Rehost Websites Takuya Watanabe, Eitaro Shioji, Mitsuaki Akiyama and Tatsuya Mori

  Web proxies, translators and archives rehost many different sites under one domain name, collapsing them into a single origin. Across 21 such services the authors show persistent man-in-the-middle, cross-site access to…

• Mutation XSS via namespace confusion - DOMPurify < 2.0.17 bypass mibe

  HTML drops a nested form on reparse, and mglyph stays in the MathML namespace when it is a direct child of mtext, so markup DOMPurify judges harmless parses differently the second time. Assigning the sanitized string to…

• My hacking adventures with Safari reader mode Nikhil Mittal

  Safari Reader mode strips scripts but renders an SVG anchor pointing at a javascript: URI, giving script execution, and a title/child-frame quirk lets a cross-origin child frame read the top frame's content, breaking…

• PMForce: Systematically Analyzing PostMessage Handlers at Scale Steffens, Marius

  PMForce runs in the browser and pairs selective force execution with lightweight dynamic taint tracking to explore postMessage handlers, then solves the collected path constraints with Z3 and exploit templates into a…

• Prototype Pollution and bypassing client-side HTML sanitizers Michał Bentkowski

  Client-side HTML sanitizers read their allow-lists from configuration objects, so a prototype pollution primitive can add tags and attributes back in. DOMPurify, sanitize-html, js-xss and Google Closure are each…

• Real-life OIDC Security (II): Login Confusion Lauritz Holtmann

  Describes Login Confusion: where a service provider honours a post-login redirect parameter and also exposes an unprotected login-initiation endpoint, the victim can be pushed into a silent OpenID Connect flow…

• Redefining Impossible: XSS without arbitrary JavaScript Luan Herrera

  An injection restricted to letters, digits, quote, plus, dot and backticks can still call methods through tagged templates, building an oracle that reveals whether a character of document.cookie matches a guess…

• Researching Polymorphic Images for XSS on Google Scholar Lorenzo Stella

  Polymorphic images carry a valid XSS or JavaScript payload while surviving server-side reprocessing by placing it in EXIF metadata, after the image trailer, in PNG iDAT, or in a JPG entropy-coded segment tuned to…

• Revisiting ReDoS: A Rough Idea of Data Exfiltration by ReDoS and Side-channel Techniques Takashi Yoneuchi

  Shows that timing out a runaway regular expression turns denial of service into a leak oracle: an injected regexp that backtracks catastrophically only when a proposition about a secret holds encodes one bit into…

• Room for Escape: Scribbling Outside the Lines of Template Security Oleksandr Mirosh and Alvaro Muñoz

  Templates that untrusted users may edit break out of their sandboxes: SharePoint's safe-mode page parser is fooled by delayed data binding into parsing a user site page as a trusted application page, and Java engines…

• Salesforce Lightning - An in-depth look at exploitation vectors for the everyday community Aaron Costello

  Guest (unauthenticated) users of Salesforce Lightning communities can call built-in Aura controller methods and @AuraEnabled Apex methods that skip object-, field-, and record-level authorization. This lets an attacker…

• SD-PWN Part 2 --- Citrix SD-WAN Center Ariel Tempelhof

  Citrix SD-WAN Center runs CakePHP2, whose URL parser drops everything before a scheme separator that precedes a question mark, so Apache and the framework disagree about the path and the client-certificate restriction…

• Secret fragments: Remote code execution on Symfony based websites blog.lexfo.fr

  When a Symfony app exposes the ESI /_fragment endpoint and its secret key is default, guessable, leaked, or brute-forceable, an attacker can forge the HMAC that signs a /_fragment URL. A signed request can call any…

• Security and Privacy of Social Logins Louis Christopher Jannett

  A master's thesis that reverse-engineers the Sign in with Apple, Google Sign-In and Facebook Login protocols, then audits how their SDKs and 63 real-world sites use postMessage for the popup handoff. Missing origin and…

• Security Study of Service Worker Cross-Site Scripting Phakpoom Chinprutthiwong, Raj Vardhan, Guangliang Yang and Guofei Gu

  Finds service workers that trust configuration in their registration URL and pass it to script-loading or execution sinks. Attackers can obtain persistent worker-level code execution through page URL forwarding or…

• Story of a weird vulnerability I found on Facebook Amine Aboud

  A Facebook legal subdomain answered 403 for a directory until many simultaneous requests were sent, at which point it served a full directory listing holding internal XLSX files. Flooding a protected path with…

• The Cookie Hunter: Automated Black-box Auditing for Web Authentication and Authorization Flaws Kostas Drakonakis, Sotiris Ioannidis and Jason Polakis

  A fully automated black-box framework registers accounts, logs in (including via single sign-on) and then removes cookie subsets to work out which cookies authenticate and whether they are exposed over cleartext HTTP or…

• The Curious Case of Copy & Paste - on risks of pasting arbitrary content in browsers mibe

  Copying from a malicious page and pasting into a rich-text editor can run script, because the clipboard carries HTML and the paste sanitizers in Chromium, Firefox, Safari and Edge can be mutated into producing dangerous…

• The Powerful HTTP Request Smuggling Ricardo Iramar dos Santos

  HTTP request smuggling on a mobile device management provider's front end let the author inject a redirect into other users' responses. Because MDM clients follow redirects without user interaction, enrolled devices…

• The Remote on the Local: Exacerbating Web Attacks Via Service Workers Caches Dolière Francis Somé, Stefano Calzavara, Marco Squarcina and Matteo Maffei

  Existing same-origin malicious JavaScript can rewrite service-worker caches to remove CSP and other security headers, reorder cached scripts, and persist attacks after server fixes. Cached authenticated responses can…

• The unexpected Google wide domain check bypass David Schütz and @xdavidhu

  A URL-parsing regex used across Google products ended the authority only at slash, question mark or hash, while browsers also end it at a backslash. A host written as attacker.tld then a backslash then…

• Timeless Timing Attacks: Exploiting Concurrency to Leak Secrets over Remote Connections Tom Van Goethem, Christina Pöpper, Wouter Joosen and Mathy Vanhoef

  Concurrency-based timing attacks compare the order in which two simultaneous requests return rather than their absolute times, so network jitter cancels out. Sent as multiplexed HTTP/2 requests inside one packet, or…

• TURN server allows TCP and UDP proxying to internal network HackerOne

  Slack's TURN relay accepted ChannelBind and CreatePermission requests for private and special-use addresses, letting anyone with relay credentials proxy TCP connections and UDP packets into the internal network, to…

• Unauthorized Google Maps API Key Usage Cases Ozgur Alp and @ozgur_bbh

  Explains what an unrestricted Google Maps API key left in client-side code allows: anyone can bill the owner's quota through the Maps endpoints, or exhaust a capped budget to deny the service, and careless referrer…

• Uninitialized Memory Disclosures in Web Applications @SilentSignalHU

  Image libraries and similar parsers can pad their output with uninitialised heap memory when fed malformed input, so a picture processed and returned by a web application carries fragments of server memory such as…

• Web Cache Entanglement: Novel Pathways to Poisoning James Kettle

  Cache keys are parsed, normalised and transformed before they are stored, and those transformations let two semantically different requests collide on one key. Cache oracles, unkeyed query strings, parameter cloaking…

• Weird Vulnerabilities Happening on Load Balancers, Shallow Copies and Caches Ozgur Alp and @ozgur_bbh

  Four bug bounty cases where one user's data reached another: a load balancer returning a stranger's email when a cookie was absent, a whitelist of 17 addresses left in a script block, a shallow-copied object cached with…

• Write-up for a Path Traversal on Gravitee.io Maxime Escourbiac and @Fisjkars

  Gravitee.io embedded every img src of an outgoing HTML mail as a CID attachment, reading the path straight from the tag with no validation. HTML injection into the unauthenticated registration form name fields let an…

• XSS fun with animated SVG @phaldrzynski and Paweł Hałdrzyński

  The SVG animate element takes a semicolon separated values list, so a javascript URL hidden after a harmless one escapes WAFs that inspect the attribute as a whole. Setting keyTimes to skip the first frame, or…

• XXE-scape through the front door: circumventing the firewall with HTTP request smuggling honoki.net

  Behind a firewall that blocked outbound HTTP, the researcher used local-DTD XXE tricks to exfiltrate internal data over DNS, then chained the XXE with an HTTP request smuggling desync on a whitelisted host. Smuggling…