[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Full-disclosure] Self-contained XSS Attacks (the new generation of XSS)
- To: tim-security@xxxxxxxxxxxxxxxxxxx
- Subject: Re: [Full-disclosure] Self-contained XSS Attacks (the new generation of XSS)
- From: "Ron Jennings" <ronj@xxxxxxxxxxxxxxxxxx>
- Date: Sun, 24 Sep 2006 08:43:16 +0000
<html><div style='background-color:'><P><BR>Hi Tim,</P>
<P> You make a great point. </P><BR><BR><BR>
<DIV>
<P><FONT size=1> Ron Jennings,
NCIE SSP </FONT></P>
<P><FONT color=#003399> <FONT size=2>Chaser Security- A Microsoft
Partner</FONT></FONT></P>
<P><FONT color=#003399 size=2> Cell:559.360.2340 24hr.customer
service</FONT></P>
<P><FONT color=#003399 size=2> VOIP:562.365.1295 </FONT></P></DIV>
<BLOCKQUOTE style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #a0c6e5 2px solid; MARGIN-RIGHT:
0px"><FONT style="FONT-SIZE: 11px; FONT-FAMILY: tahoma,sans-serif">
<HR color=#a0c6e5 SIZE=1>
From: <I>Tim <tim-security@xxxxxxxxxxxxxxxxxxx></I><BR>To: <I>"pdp (architect)" <pdp.gnucitizen@xxxxxxxxxxxxxx></I><BR>CC: <I>full-disclosure@xxxxxxxxxxxxxxxxx, bugtraq@xxxxxxxxxxxxxxxxx,webappsec@xxxxxxxxxxxxxxxxx, websecurity@xxxxxxxxxxxxx</I><BR>Subject: <I>Re: [Full-disclosure] Self-contained XSS Attacks (the new generation of XSS)</I><BR>Date: <I>Fri, 22 Sep 2006 10:03:11 -0400</I><BR>><BR>>Hello pdp,<BR>><BR>> > http://www.gnucitizen.org/blog/self-contained-xss-attacks<BR>> ><BR>> > XSS attacks can be persistent and non-persistent. Persistent XSS is<BR>> > more dangerous since it allow attackers to control exploited clients<BR>> > for longer. On the other hand non-persistent XSS is considered less<BR>> > dangerous although it has been widely used in many phishing attempts.<BR>> ><BR>> > In this article I will
expose some of my findings around a new attack<BR>> > vector which is of type non-persistent XSS but a lot more dangerous<BR>> > than the persistent one.<BR>> ><BR>> > Some of you might be familiar with this attack vector; this subject<BR>> > has been covered very vaguely in the past and none of its full<BR>> > potentials has been explored. The impact of this attack is much bigger<BR>> > today and could affect many web applications.<BR>><BR>>This is a very interesting vector. However, I would argue that it is<BR>>not a new class of XSS. Generally, the classes have been defined based<BR>>on where the injected data flows from, not how it is injected in the<BR>>page.<BR>><BR>>For instance, stored or persistent XSS comes from an attacker via one<BR>>communication, gets saved on the server, and is later reproduced
to<BR>>another user. Reflected is generally embedded in a link, sent to a<BR>>victim, which a victim then sends to the webserver and is reflected back<BR>>to achieve injection. DOM-based is similar, but does not need to flow<BR>>to the webserver before coming back to get injected. I personally label<BR>>these three classes Type 2, Type 1 and Type 0 respectively, in order to<BR>>reduce confusion about terminology [1].<BR>><BR>>All three of these scenarios could be used with your injection vector.<BR>>A server side script could store the URL supplied by an attacker, and<BR>>later present it to a victim, thus making it persistent. Similarly, a<BR>>document.write() call could be exploited to inject a data: link, even if<BR>>the typical dangerous characters (', ", <, >, etc) were handled.<BR>><BR>>Don't get me wrong... I really like the vector,
and what you've brought<BR>>to the list. I just don't think it should be considered another class.<BR>><BR>>cheers,<BR>>tim<BR>><BR>><BR>>1. http://en.wikipedia.org/wiki/XSS<BR>><BR>>-------------------------------------------------------------------------<BR>>Sponsored by: Watchfire<BR>><BR>>Cross-Site Scripting (XSS) is one of the most common application-level<BR>>attacks that hackers use to sneak into web applications today. This<BR>>whitepaper will discuss how traditional CSS attacks are performed, how to<BR>>secure your site against these attacks and check if your site is protected.<BR>>Cross-Site Scripting Explained - Download this whitepaper today!<BR>><BR>>https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008Vmr<BR>>--------------------------------------------------------------------------<BR>><BR></FONT></BLOCKQUOTE></div></html>
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/