Top 10 Web Hacking Techniques

2021

The 2021 Top 10 Web Hacking Techniques: all 10 winners and 57 nominated and collected techniques, each with its researcher, summary and preserved source.

57 records · 10 in the top ten · open this year in the interactive archive

The top ten

1. #1 Dependency Confusion Alex Birsan and @alxbrsn

   Publishing a package to a public registry under the name of a company's private internal dependency. Build tooling that consults both an internal index and the public one picks the highest version number, so the…

2. #2 HTTP/2: The Sequel is Always Worse James Kettle

   HTTP/2 front-ends that downgrade requests to HTTP/1.1 lose the binary length field, so the back-end must trust an attacker-supplied Content-Length or Transfer-Encoding. This gives H2.CL and H2.TE desyncs, plus header…

3. #3 A New Attack Surface on MS Exchange - ProxyLogon Orange Tsai

   Microsoft Exchange splits request handling between a frontend Client Access Service and a backend that trusts frontend-supplied headers, and a static-resource handler took its backend target straight from a client…

4. #4 Prototype Pollution Sergey Bobrov, Mohan Sri Rama Krishna P, Terjanq, Beomjin Lee, Masato Kinugawa, Nikita Stupin, Rahul Maini, Harsh Jaiswal, Mikhail Egorov and Melar Dev

   Client-side prototype pollution hunted at scale: query and hash parsers that write attacker-controlled keys onto Object.prototype, plus script gadgets in common libraries that turn a polluted property into JavaScript…

5. #5 Hidden OAuth attack vectors Michael Stepankin

   Three attacks on OAuth2 and OpenID Connect endpoints that a browser never reveals. Dynamic client registration accepts attacker URLs in logo_uri, jwks_uri and request_uris, giving second-order SSRF; keeping redirect_uri…

6. #6 Cache Poisoning at Scale @iustinBB

   A catalogue of reusable web cache poisoning patterns found across bug bounty targets: Apache Traffic Server forwarding URL fragments it leaves out of the cache key, method-override and scheme headers producing cacheable…

7. #7 JSON Interoperability Vulnerabilities @bishopfox

   A survey of 49 JSON parsers shows they disagree on duplicate keys, invalid Unicode, comments and large numbers, so the same document decodes to different values in different microservices. An attacker can craft a…

8. #8 Practical HTTP Header Smuggling Daniel Thatcher

   Obfuscating a header name, for example by appending characters after a space, can make a frontend proxy ignore it while the backend still parses it as the real header. The paper gives an error-comparison method for…

9. #9 HTTP Smuggling via Higher HTTP Versions Emil Lerner

   Request smuggling against front ends that terminate HTTP/2 or HTTP/3 and forward HTTP/1.1. Because HTTP/2 header names and values are binary strings that may contain newlines and colons, and content-length and…

10. #10 Fuzzing for XSS via nested parsers condition Igor Sak-Sakovskiy and @Psych0tr1a

    When two markup parsers run in sequence over the same message, the first parser output becomes the second parser input, letting injected markup escape an attribute value into attribute-name position. Fuzz lists that…

Also collected

• A Scientific Notation Bug in MySQL exposed AWS WAF Marc Olivier Bergeron and @GoSecure_Inc

  MySQL and MariaDB silently discard a malformed scientific-notation token such as 1.e when no digit follows the e, so the query stays valid while looking like nonsense to anything else parsing it. Injecting that token…

• Abusing Hidden Properties to Attack the Node.js Ecosystem Feng Xiao, Jianwei Huang, Yichang Xiong, Guangliang Yang, Hong Hu, Guofei Gu and Wenke Lee

  Hidden property abusing exploits the gap between how client-supplied objects are serialised and how server code reads them, letting a remote attacker inject internal object properties the developer never meant to expose.

• ALPACA: Application Layer Protocol Confusion — Analyzing and Mitigating Cracks in TLS Authentication Marcus Brinkmann, Christian Dresen, Robert Merget, Damian Poddebniak, Jens Müller, Juraj Somorovsky, Jörg Schwenk and Sebastian Schinzel

  TLS authenticates the certificate but not the TCP endpoint, so a man-in-the-middle can redirect an HTTPS connection to a different service that shares a compatible certificate, such as an FTP or mail server. The…

• AppCache's forgotten tales Luan Herrera

  A page's AppCache manifest NETWORK section acts as an allowlist that blocks any request not listed, including requests produced by redirects, and Chrome extended it with non-standard glob pattern matching.

• Attacking the DevTools David Erceg

  Chromium's DevTools is a privileged page an extension can reach, through an unvalidated remoteBase parameter, a javascript: devtools_page entry, or crafted channel messages that overwrite the stored extension origin…

• Breaking GitHub Private Pages for $35k @NotDeGhost

  A CRLF injection in the page_id parameter of GitHub Pages private-page authentication, made exploitable by a null byte that stops integer parsing, yields script execution on the pages domain. Case variation bypasses the…

• Bypassing 2FA using OpenID Misconfiguration youst.in

  An OpenID relying party asks for authentication methods through the acr_values parameter, and the identity provider honours any method the client has enabled. Changing the request from one-time password to SMS let an…

• DNS Cache Poisoning Attack: Resurrections with Side Channels Keyu Man, Xin'an Zhou and Zhiyun Qian

  Novel side channels in the Linux kernel let an off-path attacker use ICMP fragment-needed and redirect messages to scan a DNS resolver's UDP ephemeral port, because the shared next-hop exception cache leaks which port…

• Empirical Study of HTTP Request Smuggling in Servers and Proxies Mattias Grenfeldt and Asta Olofsson

  A systematic test of six open-source proxies and six servers for HTTP request smuggling, sending a corpus of every known desync variant and comparing how each pair interprets message length. It found 17 parsing…

• Exploiting CSP in Webkit to Break Authentication & Authorization Guest

  WebKit set the documentURI of a CSP violation report to the final cross-origin redirect target instead of the original request URL. A page with a crafted policy could fetch an SSO or OAuth authorize endpoint and read…

• Finding 0day to hack Apple Harsh Jaiswal and Rahul Maini

  Examines a Lucee administration flaw where privileged side effects occur before authentication is enforced. The Apple case study combines a restricted file write with search-index processing and describes an alternative…

• Fingerprinting in Style: Detecting Browser Extensions via Injected Style Sheets Pierre Laperdrix, Oleksii Starov, Quan Chen, Alexandros Kapravelos and Nick Nikiforakis

  Browser extensions that inject their own style sheets into every page can be identified by the site being visited. A pipeline extracts each extension's injected CSS rules and builds trigger elements whose computed style…

• Forgot password? Taking over user accounts Kaminsky style Timo Longin

  Registering accounts on 146 real web applications with per-target subdomain e-mail addresses, then proxying the resulting MX lookups, to measure which applications still meet the preconditions for Kaminsky-style cache…

• Gummy Browsers: Targeted Browser Spoofing against State-of-the-Art Fingerprinting Techniques Zengrui Liu, Prakash Shrestha and Nitesh Saxena

  An attacker lures a victim to a page, transparently harvests the victim browser fingerprint, then drives their own browser through script injection, debugging tools or script modification to replay that exact…

• Hacking CloudKit - How I accidentally deleted your Apple Shortcuts Frans Rosén

  Apple's CloudKit datastore exposes public-scope containers whose access controls Apple's own apps misconfigured, and because several CloudKit API endpoints authenticate differently, an ordinary iCloud user could reach…

• HotPics 2021 Emil Lerner

  Server-side image conversion turned into an attack surface: uploading a crafted image makes ImageMagick, Pillow or Ghostscript on the server leak uninitialised memory, read local files, issue requests to internal hosts…

• Improper Spring @Query Usage Allows N1QL Injection pavel

  Compares Spring Data Couchbase queries that bind parameters with annotations that interpolate untrusted input through SpEL. A diagnostic quote reveals the generated N1QL statement, and a Spring test application plus a…

• Integer overflow vulnerability in HAProxy daniellea, @jfrog and Ori Hollander and Or Peles

  HAProxy stored an HTTP header's name length in only 8 bits, so a 270-byte header name overflowed the field and the second processing phase read a different, shorter name than the parsing phase did. A crafted request…

• JAW: Studying Client-side CSRF with Hybrid Property Graphs and Declarative Traversals Soheil Khodayari and Giancarlo Pellegrino

  Client-side CSRF is a forged request built by the page's own JavaScript from attacker-controlled inputs such as the URL, so it evades defences aimed at classic CSRF. JAW builds hybrid property graphs of JavaScript…

• LEXSS: Bypassing Lexical Parsing Security Controls @bishopfox

  HTML sanitisers that re-parse markup can be desynchronised from the browser's own parser. Nesting tags that switch tokenizer state, such as an iframe wrapping a textarea, or entering the MathML namespace, makes the…

• Local File Read via Stored XSS in The Opera Browser Renwa

  Opera Pinboards accepted a javascript URI as a saved pin, which then ran inside the privileged opera scheme when the link was middle-clicked. From there the researcher called native APIs to open a local file in a tab…

• Misconfigurations in Java XML Parsers Anibal Irrera

  Partial hardening of Java XML parsers still leaves XXE and SSRF reachable, because disabling entity expansion or external entities does not stop DTD processing and PUBLIC identifiers still fetch remote URLs. The author…

• Ping'ing XMLSec blog.tint0.com

  Apache Santuario dereferences URIs in KeyInfoReference and RetrievalMethod elements before any signature check, and fails to pass its secureValidation flag down, so an unauthenticated attacker can make it read local…

• Play the Opera Please inputzero.io

  Mobile carriers identify subscribers by enriching plain HTTP requests with headers such as MSISDN, and Opera Mini's turbo compression servers relayed client-supplied copies of those headers without filtering them.

• Pop-Ups in a good-world Guilherme Keerok

  Popup windows, popunders and drag or clipboard events are chained to upgrade a self-XSS into an attacker-triggered one. Writing a payload into the victim's clipboard or drag data and then opening the vulnerable page…

• Prime+Probe 1, JavaScript 0: Overcoming Browser-based Side-Channel Defenses Anatoly Shusterman, Ayush Agarwal, Sioli O'Connell, Daniel Genkin, Yossi Oren and Yuval Yarom

  Cache side-channel attacks rebuilt with progressively fewer JavaScript features, ending in one written entirely in CSS and HTML that works with scripting fully disabled. It fingerprints which website a victim is…

• Processing Dangerous Paths: On Security and Privacy of the Portable Document Format Jens Müller, Dominik Noss, Christian Mainka, Vladislav Mladenov and Jörg Schwenk

  A systematic study of dangerous paths through the PDF file structure that abuses standard features rather than implementation bugs. The resulting attacks span denial of service, information disclosure leaking personal…

• RCE in Homebrew by compromising the official Cask repository RyotaK

  Homebrew's cask repository auto-approved pull requests using the git_diff Ruby gem, whose parser treats an added line matching a b/path pattern as file metadata rather than a content change. A pull request could…

• Remote code execution in cdnjs of Cloudflare RyotaK

  The cdnjs library update server extracted npm tarballs and copied files out of Git repositories without sanitizing paths or handling symlinks safely, so a published package could traverse out of its directory or link to…

• Response Smuggling- Pwning HTTP-1.1 Connections Martin Doyhenard

  Instead of desynchronising requests, the attacker desynchronises the response queue: smuggled requests leave orphan responses that can be claimed to steal another user's response and session cookies. A smuggled HEAD…

• Revealer: Detecting and Exploiting Regular Expression Denial-of-Service Vulnerabilities The Chinese University of Hong Kong

  Regular expression denial of service exploits regexes whose matching time blows up on crafted input. Revealer models the vulnerable structures of regexes that use extended features, locates them statically, verifies…

• Securing XML implementations across the web Juho Forsén

  Several XML implementations do not round-trip documents faithfully: parsing and re-serialising a crafted document changes its structure, because mismatched quotes in a notation declaration let a system identifier…

• SerialDetector: Principled and Practical Exploration of Object Injection Vulnerabilities for the Web Mikhail Shcherbakov and Musard Balliu

  Object injection happens when untrusted data chooses the type and properties of a deserialised object, turning existing code into a gadget chain. SerialDetector taints dataflow in .NET assemblies from public entry…

• Spook.js: Attacking Chrome Strict Site Isolation via Speculative Execution Ayush Agarwal, Sioli O'Connell, Jason Kim, Shaked Yehezkel, Daniel Genkin, Eyal Ronen and Yuval Yarom

  A Spectre-style transient execution attack that defeats Chrome Strict Site Isolation. Because Chrome groups pages by eTLD+1, an attacker-controlled subdomain can share a process with a sensitive page, and a type…

• T-Reqs: HTTP Request Smuggling with Differential Fuzzing Bahruz Jabiyev, Steven Sprecher, Kaan Onarlioglu and Engin Kirda

  A grammar-based differential fuzzer generates HTTP requests and mutates the request line, headers and body, then compares how ten servers, proxies and CDNs parse each one to find pairs that disagree on where a message…

• Tales of Favicons and Caches: Persistent Tracking in Modern Browsers Konstantinos Solomos, John Kristoff, Chris Kanich and Jason Polakis

  A tracking identifier is stored as a set of entries in the browser's favicon cache, one per subdomain, and read back by redirecting the visitor through those subdomains and observing which favicon requests occur. The…

• Talking About My Generation: Targeted DOM-based XSS Exploit Generation using Dynamic Data Flow Analysis Souphiane Bensalim, David Klein, Thomas Barber and Martin Johns

  Generates DOM XSS exploits using dynamic taint traces to identify replaceable URL ranges, preserve surrounding URL structure, and choose context-breaking payloads. The evaluation confirms 7,199 flows across 711 domains…

• The Secret Parameter, LFR, and Potential RCE in NodeJS Apps CaptainFreak

  Express passes the whole render options object to the hbs view engine, which reads its layout property as a template path. A request body carrying a layout key therefore makes the server read and render an arbitrary…

• To Err.Is Human: Characterizing the Threat of Unintended URLs in Social Media Beliz Kaleli, Brian Kondracki, Manuel Egele, Nick Nikiforakis and Gianluca Stringhini

  Social platforms linkify text too permissively, so a missing space after a full stop turns the next word into a domain whenever it happens to be a valid top-level domain. Attackers register those domains and serve…

• Towards a Lightweight, Hybrid Approach for Detecting DOM XSS Vulnerabilities with Machine Learning William Melicher, Clement Fung, Lujo Bauer and Limin Jia

  Trains a neural classifier on JavaScript function tokens to select code for DOM XSS taint tracking. Its hybrid design retains 94.5% of unique confirmed vulnerabilities while modeling a 3.43-fold reduction in…

• Turning Blind Error Based MSSQL Injection into Exploitable Boolean One Ozgur Alp and @ozgur_bbh

  Where a Microsoft SQL Server injection point returns no error text, the application differing redirect targets still reveal whether a query succeeded. Wrapping the IIF function inside a convert to char, so a true branch…

• uBlock, I exfiltrate: exploiting ad blockers with CSS Gareth Heyes

  Bypasses of uBlock Origin's cosmetic-filter validation let a malicious or compromised filter list inject arbitrary CSS into every page. A CSS-only exfiltration method then reads text: custom fonts with unicode-range…

• Universal Deserialisation Gadget for Ruby 2.x-3.x devcraft.io

  A gadget chain built only from Ruby's default classes turns an untrusted Marshal.load into arbitrary command execution, running from Gem::Requirement through Gem::Package::TarReader and Net::BufferedIO to…

• Web Cache Deception Escalates! Seyed Ali Mirheidari, Matteo Golinelli, Kaan Onarlioglu, Engin Kirda and Bruno Crispo

  Web cache deception tricks a caching proxy into storing pages that hold another user's secrets by requesting them with a fake static-file suffix. Replacing injected markers with page-identicality and cache-header…

• Weird proxies/2 and a bit of magic GreenDog

  A survey of reverse proxy and API gateway misconfigurations in which the front end and back end disagree about a request. Path normalization gaps, raw bytes and absolute URIs in the request line, header name mangling…

• XSS to RCE in the Opera Browser Renwa

  Opera's My Flow page assigned dropped drag-and-drop HTML data to innerHTML, giving script execution on a page privileged to message a hidden Opera Touch Background extension. Its SEND_FILE and OPEN_FILE calls write an…

• You Talking To Me? Li JianTao

  WebDriver servers such as chromedriver and geckodriver expose local control ports to the browser they automate. DNS rebinding reaches chromedriver's REST API to start a session with an attacker-chosen binary, and a…