search
githubEdit

❌XSS and XSRF Together

hashtag
Introduction

  • Web application vulnerabilities

  • XSS

  • What is XSRF?

  • Code

  • Demo!

hashtag
Vulnerabilities

  • Content can be framed.

  • Cross Site Scripting XSS.

  • Method interchange (POST and GET).

  • Cross Site Request Forgery XSRF.

  • User enumeration via forgot password function.

  • Administrators can disable their own account.

  • ... and many others ...

hashtag
XSS

  • Cross Site Scripting, aka XSS, script injection.

  • The application had a help desk function.

  • Any user could create a troube ticket.

  • Ticket will be first viewed by administrator.

  • Script executes in the administrator browser.

  • Administrator can perform all of the functions vulnerable to XSRF.

hashtag
XSRF

  • Cross-Site Request Forgery is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated (OWASP).

  • This attack takes advantage of the application trusting any transaction coming from a browser where a user has an existing and valid session, or where one can be established automatically (SSO).

hashtag
XSS + XSRF

  • XSS and XSRF are like cousins, that get along very well, sneaky mischievous cousins.

  • Persistent Admin XSS within the application guarantees the attacker that the administrator will execute the code, the code will execute the XSRF transaction (s).

  • We want more than one transaction, hence the multi-post.

hashtag
Requirements for XSRF

  • The user has an existing or can create automatically a valid session.

  • The transaction has predictable parameters.

  • The victim click on a link, or types in a URL, or XSS.

  • The transaction is attractive to the attacker.

  • The attacker has knowledge of the above, or is very lucky.

hashtag
XSRF Functions

  • All the interesting ones in this app are as admin.

    • Add a user.

    • Change user password.

    • Put user in group.

    • Enable user.

    • Disable user.

    • Logout.

hashtag
Google-Foo

  • Needed to find multi-post XSRF code.

  • Found Tim Tomes @lanmaster53

Logolanmaster53.comwww.lanmaster53.comchevron-right

  • We based our code on his. He and Ethan Robish based their code on

http://ceriksen.com/2012/09/29/two-stage-csrf-attacks/ceriksen.comchevron-right

hashtag
Pseudo code

  • HTML to inject in XSS.

  • 1 form per transaction.

  • 1 iframe per form.

  • <body onload="runme();">

  • JavaScript:

    • The runme submits the forms one by one, in order, waiting for each one to complete.

hashtag
Needed a vulnerable app

  • Back to Google.

  • I needed and an app that was vulnerable for live demo -> Omeka.

LogoZero Science Lab » Omeka 2.2 CSRF And Stored XSS Vulnerabilitywww.zeroscience.mkchevron-right

  • Free open source content management application.

LogoOmekaomeka.orgchevron-right

hashtag
Omeka

  • Is vulnerable to XSRF in admin functions.

  • I could not use the application the I did the pen test for as a demonstration or public PoC.

  • Omeka is easy to install and easy to exploit!

hashtag
XSS

  • The persistent XSS in Omeka is in the API keys function.

hashtag
XSRF Defences

  • Add a random nonce/token to important forms. The only real defence, performance issues.

  • Referer HTTP header, Origin header, Captcha, reauth, OTP. UX!!!!

  • Use multiple forms, easily bypassed by multi-post technique.

LogoComplete application ownage via Multi-POST XSRF - SANS ISCSANS Internet Storm Centerchevron-right
PreviousBurp SuiteNextNoSQL Injection

Last updated