Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests •...

58
BLIND XSS @adam_baldwin

Transcript of Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests •...

Page 1: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

BLIND XSS@adam_baldwin

Page 2: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

HI, I’M ADAM BALDWIN

Page 3: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

NOT THAT ADAM BALDWIN

Page 4: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

THIS ADAM BALDWIN

• Chief Security Officer at &yet• Security Lead for ^Lift Security• @adam_baldwin + @liftsecurity

Page 5: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

• What is it?• Using it in penetration tests• Challenges• xss.io

LET’S TALK BLIND XSS

Page 6: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

BLIND XSSWTF IS

Page 7: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

BLIND XSSWTF IS

Page 8: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

• Reflected• Persistent (stored)• DOM

XSS IS:

Page 9: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

• Reflected• Persistent (stored)• DOM

BLIND XSS IS:

Page 10: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

IT’S A DIFFERENT CHALLENGE.

Page 11: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

IT’S NOT LIKE BLIND SQLI WHERE YOU GET IMMEDIATE FEEDBACK.

Page 12: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

YOU HAVE NO IDEA WHERE YOUR PAYLOAD’S GOING TO END UP.

Page 13: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

YOU DON’T EVEN KNOW WHETHER YOUR PAYLOAD WILL EXECUTE (OR WHEN!)

Page 14: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

YOU MUST THINK AHEAD ABOUT WHAT YOU WANT TO ACCOMPLISH.

Page 15: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

... AND YOU HAVE TO BE LISTENING.

Page 16: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

BLIND XSS IS

Page 17: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

BLIND XSS ISCALL ME MAYBE?

Page 18: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

FOR EXAMPLE...From a recent penetration test

Page 19: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS
Page 20: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS
Page 21: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS
Page 22: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS
Page 23: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS
Page 24: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS
Page 25: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS
Page 26: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS
Page 27: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS
Page 28: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS
Page 29: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS
Page 30: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS
Page 31: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS
Page 32: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS
Page 33: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS
Page 34: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS
Page 35: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS
Page 36: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS
Page 37: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS
Page 38: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS
Page 39: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS
Page 40: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS
Page 41: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS
Page 42: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS
Page 43: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS
Page 44: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS
Page 45: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

1.Carefully choose the right payload for the right situation.

STEPS TO A SUCCESSFUL BLIND XSS EXPLOIT:

Page 46: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

1.Carefully choose the right payload for the right situation.

2.Get lucky!

STEPS TO A SUCCESSFUL BLIND XSS EXPLOIT:

Page 47: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

• Lots of payloads for various situations.

• ...but doing everything would be overkill.

HTML5SEC.ORG

Page 48: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

PLAN YOUR PAYLOAD.HOW WILL THE APP USE YOUR DATA?

Page 49: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

• log viewers• exception handlers• customer service apps (chats,

tickets, forums, etc)• anything moderated

NICE TARGETS:

Page 50: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

BLIND XSS MANAGEMENT

Page 51: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

XSS.IO CAN HELP!

Page 52: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

SIZE MATTERS... RIGHT?• Sometimes you need all the

character space you can get.• No short-url GUID• xss.io uses custom referrer-

based redirects instead

Page 53: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

EXPLOIT CREATOR• Snippets for common tasks• Quickly create and reference

dynamic payloads

Page 54: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

DEAD DROP BLIND XSS API AND MANAGER

Page 55: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

(XSS.IO DEMO)

Page 56: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

BUT WAIT, THERE’S MOREUnrelated but equally awesome

Page 57: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

CSRF.IO

Page 58: Blind XSS - DEF CON® Hacking Conference · •What is it? • Using it in penetration tests • Challenges • xss.io LET’S TALK BLIND XSS

</PRESENTATION>@adam_baldwin | @LiftSecurity


Java Security Mythen - Berlin Expert Days · XSS Stored! XSS Reflected! XSS Browser executes ... JavaServer Faces automatically escape all output. XSS in action. Don‘t take framework

Java Security Mythen - Berlin Expert Days · XSS Stored! XSS Reflected! XSS Browser executes ... JavaServer Faces automatically escape all output. XSS in action. Don‘t take framework

Rapid Blind SQL Injection Exploitation with BBQSQL CON 20/DEF CON 20 presentations/DE… · Blind SQL Injection Lots of excellent tools out there sqlmap, sqlninja, BSQL Hacker, the

Rapid Blind SQL Injection Exploitation with BBQSQL CON 20/DEF CON 20 presentations/DE… · Blind SQL Injection Lots of excellent tools out there sqlmap, sqlninja, BSQL Hacker, the

XSS Lightning talk

XSS Lightning talk

Netscaler WAF XSS

Netscaler WAF XSS

Evolution Xss

Evolution Xss

PRELIMINARY SLIDESconference.hackinthebox.org/hitbsecconf2012kul... · • 2007 - Orkut Worm • 2008 - Yahoo IM XSS • 2009 - Twitter hit by multiple XSS variants, Memova XSS •

PRELIMINARY SLIDESconference.hackinthebox.org/hitbsecconf2012kul... · • 2007 - Orkut Worm • 2008 - Yahoo IM XSS • 2009 - Twitter hit by multiple XSS variants, Memova XSS •

XSS Complete Guide

XSS Complete Guide

Advanced Blind SQL Injection - DEF CON CON 24/DEF CON 24 workshops/DEFCON-24... · Advanced Blind SQL Injection David Caissy. 24 About the instructor David Caissy • Web App Penetration

Advanced Blind SQL Injection - DEF CON CON 24/DEF CON 24 workshops/DEFCON-24... · Advanced Blind SQL Injection David Caissy. 24 About the instructor David Caissy • Web App Penetration

XSS Theory

XSS Theory

XSS - brutelogic.com.brbrutelogic.com.br/docs/XSS-FTW.pdf · Agenda Fast Intro to XSS Dangers of XSS Virtual Defacement LSD - Leakage, Spying and Deceiving Account Stealing Memory

XSS - brutelogic.com.brbrutelogic.com.br/docs/XSS-FTW.pdf · Agenda Fast Intro to XSS Dangers of XSS Virtual Defacement LSD - Leakage, Spying and Deceiving Account Stealing Memory

Dom based xss

Dom based xss

Ess xss homepage_framework_ecc_50_erp_2004

Ess xss homepage_framework_ecc_50_erp_2004

Xss a fondo

Xss a fondo

Xss Security Days

Xss Security Days

Identifying XSS Vulnerabilities

Identifying XSS Vulnerabilities

XSS Vulnerabilities

XSS Vulnerabilities

Xss Attacks Faq

Xss Attacks Faq

QUICK START GUIDE - Snap-on · abc def abc def abc def abc def ®® ® ® abc def abc def abc def abc def abc def abc def abc def abc def abc def ghi jkl mno abc def

QUICK START GUIDE - Snap-on · abc def abc def abc def abc def ®® ® ® abc def abc def abc def abc def abc def abc def abc def abc def abc def ghi jkl mno abc def

XSS Attacks

XSS Attacks

XSS Defense

XSS Defense