Re: [Full-disclosure] Web 2.0 backdoors made easy with MSIE & XMLHttpRequest

[Troy Cregger <tcregger@xxxxxxxxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

>> The 2005 text does briefly mention "Accessing content / web-scanning" 
>> (take a look at Notes 1-3).
>> 
>> So the problem is much older.

Well, that's Micro$loth for ya.

Amit Klein wrote:
> Michal Zalewski wrote:
>> On Sat, 3 Feb 2007, Michal Zalewski wrote:
>>
>>   
>>>   xmlhttp.open("GET\thttp://dione.ids.pl/\tHTTP/1.0\n\n";, "x",true);
>>>     
>> Funny enough, Paul Szabo was quick to point out that Amit Klein found the
>> same vector that I used here for client-side backdoors in May 2006 (still
>> not patched?! *shrieks in horror*), but for cache poisoning:
>>
>>   "IE + some popular forward proxy servers = XSS, defacement (browser cache 
>> poisoning)"
>>   http://www.securityfocus.com/archive/1/434931
>>
>> This is getting depressing. May 2006.
>>
>>   
> Much worse. The basic technique already appeared in two of my previous 
> write-ups:
> 
> "Exploiting the XmlHttpRequest object in IE - Referrer spoofing, and a 
> lot more..." (September 2005)
> http://www.securityfocus.com/archive/1/411585
> 
> "XS(T) attack variants which can, in some cases, eliminate the need for 
> TRACE </archive/107/308433/30/0/threaded>" (January 2003)
> http://www.securityfocus.com/archive/107/308433
> 
> The 2005 text does briefly mention "Accessing content / web-scanning" 
> (take a look at Notes 1-3).
> 
> So the problem is much older.
> 
> Thanks,
> -Amit
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFFx0j9nBEWLrrYRl8RAuzDAJ9j7ucnNaYlD7qXuFOsvwirZ4+WGwCfaupB
6WNArFbS1cB+5CRbYvkh/go=
=4eMy
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/