XSS is #1 threat in web application security. We all know it's pretty common, from time to time we encounter a website where a single input field is vulnerable. Happily we send out
alert(document.cookie) only to find out that session cookie is
httpOnly (it's a good sign!). On the other side we know that XSS gives us, white hats, an almost unlimited potential on how to alter the vulnerable page. We can:
- deface it,
- steal user's form values
- redirect to form a phishing attack
- look at cookies
- try to send malware through a drive-by download attack
- and many more...
However, what to do if we found a vulnerability on
one page, and all the interesting things are on the
other page on the same domain? Say, the vulnerability is on
http://vulnerable.example.com/search and we'd really like to steal user's credentials from
http://vulnerable.example.com/login-form? Of course, with JS it's possible, but usually it's a difficult manual process to construct such payload. Today I'll present a way that makes it
dead easy to:
- track user's actions on a vulnerable website (clicks, form submits),
- track outside links,
- monitor pages content and report any interesting HTML elements (e.g. the secret credentials)
All of this is possible
with a single injected script - think
XSS-injected Google Analytics! With just one XSS vulnerability on any page an attacker gets information about all browsing actions of unsuspecting user. Demo inside!
Posts
