Carlos Muñoz Application Security Engineer WhiteHat

Size: px

Start display at page:

Download "Carlos Muñoz Application Security Engineer WhiteHat Security @RTWaysea"

Colin Lloyd
10 years ago
Views:

1 Carlos Muñoz Application Security Engineer WhiteHat

2 Bypass: History Explanation: What Is Going On Process: Things To Look For Demos: alert(1) Done Live (hopefully) CSP: Content Security Policy End Notes: (Bonus Bypass?)

3 Late Friday, August 23 rd, 2013 Finishing Webapp Assessment Visiting site in different browsers, looking for browser-specific functionality

4 Previously found reflective XSS vulnerability Page reflects injection JavaScript block further up the page Is page rendered within iframe from specific page? ( self!= parent ) No? Redirect to page with iframe and remove injection

Is page rendered within iframe from specific page? ( self!

5 Page in iframe defined from URL/URI query string parameter Injection from URL/URI parameter value lands in iframe definition which then calls vulnerable page with injection and XSS executes on vulnerable page

6 Vuln initially found with Firefox Looked for browser-specific functionality Tested Internet Explorer last Decided to poke at the XSS vuln in Internet Explorer

7 Standard XSS training Hex entities decoded in attribute space param= value part of html tag Try an injection that doesn t look like <script>alert(1)</script> Encode a few characters, enter injection into Internet Explorer

that doesn t look like <script>alert(1)</script> Encode

9 Weekend: Built Deliberately Vulnerable PHP code to recreate bypass Reported to Microsoft: August 26 th, 2013 Case #15412 Response from Microsoft: October 4 th, 2013

10 Internet Explorer s XSS filter has a Trust model that determines which requests are subject to the filter Some requests are not trusted: subject to filter Some requests are trusted: not subject to filter Abuse that trust: Bypass the filter

requests are not trusted: subject to filter Some requests

11 Primary Request with injection is made Primary Request doesn t cause IMMEDIATE JavaScript code execution Primary Request is subject to the filter Secondary Request within the same domain is induced with data from the Primary Request Secondary Request does cause JavaScript code execution Secondary Request is trusted and not subject to the filter

within the same domain is induced with data from the Primary Request Secondary Request

12 Looking for functionality on site that will allow a secondary request onto the same domain Iframes, Frames Form submissions href attributes JavaScript Redirects Places where both <a> and </a> can be injected

Frames Form submissions href attributes JavaScript

13 Hiding data from Primary Request: Landing in Attribute space? Hexadecimal: &#xyy; - HTML Decimal: &#ZZ; - HTML Named Entity: &ww; - HTML URL/URI: %VV RFC Landing in JavaScript space? URL/URI: %VV RFC

14 Filter doesn t like. Periods <form> <frame> <iframe> Filter sometimes permits, sometimes doesn t: () [] {} Parenthesis, Square Brackets, Curly Brackets The word style Can use class instead (see demos)

16 Content Security Policy A policy language used to declare a set of content restrictions for a web resource, and a mechanism for transmitting the policy from a server to a client where the policy is enforced. Content Security Policy Maybe no more XSS (if done correctly)??? What about Internet Explorer?

a server to a client where the policy is enforced. Content Security Policy 1.

17 Only Internet Explorer 10 & 11 have any support for Content Security Policy Content Security Policy support in Internet Explorer 10 & 11 is limited Uses older X-Content-Security-Policy header instead of official Content-Security-Policy Source: Does Content Security Policy currently help? (no)

older X-Content-Security-Policy header instead of official

18 Microsoft s No Fix response: Two different reasons given: First Reason (given back in Oct 2013): Requires special functionality Not actually true everything used in bypass has been part of official HTML spec since at least 1998 Second Reason (given later, Dec 2013): Requires user interaction Partially true, but not fully true

used in bypass has been part of official HTML spec since at least 1998 Second

19 Bonus Bypass: If webapp performs double-url/uri decoding, Internet Explorer s XSS filter doesn t catch it Demo (if time permits)

20 The Playground Deliberately vulnerable pages Can be used for training on bypass

21 Links: xss-filter-design-philosophy-in-depth.aspx

22 Any Questions? Thank You ToorCon!

Bypassing Internet Explorer s XSS Filter

Bypassing Internet Explorer s XSS Filter Or: Oops, that s not supposed to happen. Carlos @RTWaysea About Me Mechanical Drafting Background Engine parts, Architectural fixtures, etc. Friend said Try This