Download

178 Chapter 5 • XSS Attack MethodsIntroductionCross-site scripting (XSS) attacks are often considered benign, or at least limited with regardto their malicious potential. For example, most people understand that JavaScript malicioussoftware (malware) can steal cookies or redirect a person to another site. However, these simplisticattacks, while useful, only begin to scratch the surface as to what a person can doonce they are allowed to run code on your browser. In this chapter, you will be introducedto the far reaching potential that a small bug in a Web site can give an attacker. Fromstealing your history to stealing your router, JavaScript malware makes it all possible.History StealingWhen an adversary conducts intelligent attacks, additional knowledge of their victims andtheir habits are essential. Instead of aiming widely, an attacker may target specific vulnerableareas where they’re most likely to succeed. Using a few JavaScript/CSS tricks, it’s trivial toexpose which Web sites a victim has visited, determine if they are logged-in, and revealnuggets of their search engine history. Armed with this information, an attacker may initiatewire transfers, propagate Web Worms, or send Web Mail spam on Web sites where thevictim currently has authenticated access.JavaScript/CSS API “getComputedStyle”The JavaScript/CSS history hack is a highly effective brute-force method to uncover wherea victim has been.The average Web user sticks to the same few dozen or so Web sites innormal everyday activity.The first thing an attacker will do is collect a list of some of themost popular Web sites. Alexa’s 1 top Web site list is a useful resource to make the processmuch easier. Sprinkle in a few online banking sites and well-known payment gateways, andan attacker now has a comprehensive reconnaissance list to focus on.This technique takes advantage of the Document Object Model’s (DOM) use of differentcolors for displaying visited links. By creating dynamic links, an attacker can check the“getComputedStyle” property in JavaScript to extract history information (Figure 5.1). It’s asimple process. If a link has one color, such as blue, the victim has not visited the URL. Ifthe text is purple, then they have been there.Code for Firefox/Mozilla. May Work In Other BrowsersVisited