Download

106 Chapter 4 • XSS TheoryGET / HTTP/1.1Host: ha.ckers.orgUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1) Gecko/20070219 Firefox/2.0.0.2Accept: image/png,*/*;q=0.5Accept-Language: en-us,en;q=0.5Accept-Encoding: gzip,deflateReferer: http://sla.ckers.org/forum/Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7Keep-Alive: 300Proxy-Connection: keep-aliveReferring URLs are not always reliable and using them for anything other than casualobservation can get you into trouble.There are a number of circumstances in which a referringURL will be blank, wrong, or non-existent:■■■■■■■META tags can be used to remove the referring URL of the site you started on.Sometimes it is very useful to remove referring URLs to subvert referrer detection.Some security products like Zonelabs Zone Alarm Pro, Norton Internet Security,and Norton Personal Firewall drop the referring URL.When a user clicks on any link located in an HTML file from the local drive to asite on the public Internet, most modern browsers won’t send a referring URL.XMLHTTPRequests can spoof or remove certain headers.Flash can spoof or remove certain headers.Robots can lie about referring URLs to get Web sites to log this information onthe Web where a search engine spider may find it, which will help their ranking insearch engines.Users can modify or remove referring URLs using proxies or other browser/networktools (e.g., Burp).This happens rarely, but nevertheless it should be noted as itis an attack well known by Web application experts.Not only can referring URLs be spoofed or wrong, but they can contain XSS.Normally a referring URL would be URL-encoded, but there’s no reason it has to be if itbehooves the attacker and it doesn’t break the logging application in doing so:Referer: http://ha.ckers.org/?alert("XSS")This previous example can have very dangerous side effects, beyond just running somesimple JavaScript. Often times logging infrastructure is visible only to administrators. If theadministrator were to come across XSS on a private page, it would be run in context of thatprivate page. Furthermore, if a variable is added to the JavaScript, the attacker could be cer-