the-web-application-hackers-handbook

Chapter 13 n Attacking Users: Other Techniques 563
n The non-HTTP service must echo part of the request contents in its response,
such as in an error message.
n The browser must tolerate responses that do not contain valid HTTP
headers, and in this situation must process a portion of the response as
HTML if that is what it contains. This is in fact how all current browsers
behave when suitable non-HTTP responses are received, probably for
backward-compatibility purposes.
n The browser must ignore the port number when segregating cross-origin
access to cookies. Current browsers are indeed port-agnostic in their
handling of cookies.
Given these conditions, an attacker can construct an XSS attack targeting the
non-HTTP service. The attack involves sending a crafted request, in the URL
or message body, in the normal way. Script code contained in the requests is
echoed and executes in the user’s browser. This code can read the user’s cookies
for the domain on which the non-HTTP service resides, and transmit these
to the attacker.
Exploiting Browser Bugs
If bugs exist within the user’s browser software or any installed extensions, an
attacker may be able to exploit these via malicious JavaScript or HTML. In some
cases, bugs within extensions such as the Java VM have enabled attackers to
perform two-way binary communication with non-HTTP services on the local
computer or elsewhere. This enables the attacker to exploit vulnerabilities that
exist within other services identified via port scanning. Many software products
(including non-browser-based products) install ActiveX controls that may
contain vulnerabilities.
DNS Rebinding
DNS rebinding is a technique that can be used to perform a partial breach of
same-origin restrictions in some situations, enabling a malicious website to
interact with a different domain. The possibility of this attack arises because the
segregations in the same-origin policy are based primarily on domain names,
whereas the ultimate delivery of HTTP requests involves converting domain
names into IP addresses.
At a high level, the attack works as follows:
n The user visits a malicious web page on the attacker’s domain. To retrieve
this page, the user’s browser resolves the attacker’s domain name to the
attacker’s IP address.
n The attacker’s web page makes Ajax requests back to the attacker’s domain,
which is allowed by the same-origin policy. The attacker uses DNS rebinding