the-web-application-hackers-handbook

562 Chapter 13 n Attacking Users: Other Techniques
Many web servers contain image files located at unique URLs. The following
code checks for a specific image associated with a popular range of DSL routers:
If the function notNetgear is not invoked, the server has been successfully
fingerprinted as a NETGEAR router. The script can then proceed to attack the
web server, either by exploiting any known vulnerabilities in the particular
software or by performing a request forgery attack. In this example, the attacker
could attempt to log in to the router with default credentials and reconfigure
the router to open additional ports on its external interface, or expose its administrative
function to the world. Note that many highly effective attacks of this
kind require only the ability to issue arbitrary requests, not to process their
responses, so they are unaffected by the same-origin policy.
In certain situations, an attacker may be able to leverage DNS rebinding techniques
to violate the same-origin policy and actually retrieve content from web
servers on the local network. These attacks are described later in this chapter.
Exploiting Non-HTTP Services
Going beyond attacks against web servers, in some situations it is possible to
leverage a user’s browser to target non-HTTP services that are accessible from
the user’s machine. Provided that the service in question tolerates the HTTP
headers that unavoidably come at the start of each request, an attacker can send
arbitrary binary content within the message body to interact with the non-HTTP
service. Many network services do in fact tolerate unrecognized input and still
process subsequent input that is well-formed for the protocol in question.
One technique for sending an arbitrary message body cross-domain was
described in Chapter 12, in which an HTML form with the enctype attribute set
to text/plain was used to send XML content to a vulnerable application. Other
techniques for delivering these attacks are described in the following paper:
www.ngssoftware.com/research/papers/InterProtocolExploitation.pdf
Such interprotocol attacks may be used to perform unauthorized actions on
the destination service or to exploit code-level vulnerabilities within that service
to compromise the targeted server.
Furthermore, in some situations, behavior in non-HTTP services may actually
be exploitable to perform XSS attacks against web applications running on the
same server. Such an attack requires the following conditions to be met:
n The non-HTTP service must be running on a port that is not blocked by
browsers, as described previously.
n The non-HTTP service must tolerate unexpected HTTP headers sent by
the browser, and not just shut down the network connection when this
happens. The former is common for many services, particularly those
that are text-based.