Zoiz Blog » Concept

SQL Injection using XSS

Zoiz — Mon, 11 Aug 2008 16:47:28 +0000

It’s been couple of weeks since my last post. I’ve been very busy managing my newly set up company. And I think it’s time to post another (lame) article right here on this very (lame) blog.

After reading “Thousand Ways to SQL Injection“, people started to ask me whether it is possible to launch a SQL injection using XSS? Some of them questioned me about the possiblity of it, some of them don’t even believe it’s possible. And well some of them say that’s gonna happen but don’t know how or never came accross one.

Let’s take a look at the following ‘fictive’ (and lame) scenario of SQL Injection using XSS :

As we know that site abc.com uses GoodGoodCMS_v1.0 as their Content Management System. Mr. Z, the attacker, found out that GoodGoodCMS has a XSS flaw on the admin page. But well there is nothing much to exploit since GoodGoodCMS doesn’t uses Cookies as the authentication method. But Mr. Z did found out that the GoodGoodCMS uses Cookies values in SQL Query without a proper filter.

Guess what? Mr. Z pull a XSS and insert something like this:

This is my concept of SQL Injection using XSS. Correct me if I am wrong, and you are very welcome to shout your ideas about this topic here.

Thanks

Zoiz – http://zoiz.web.id

Bypass Anti XSS Filter : A Little Nice XSS Trick

Zoiz — Wed, 16 Jul 2008 04:52:13 +0000

Sometimes when I develop web applications, I’ll feel not good if I am asked to allow HTML in user inputs / outputs. What scares me? XSS I think.

This morning I received an interesting email from webappsec.org mailing list. Amit Klein founds out that he can trigger a XSS without a
…

The XSS is something like this :

And the attacker should put some JS on his host on the exact directory (ex : http://www.attacker.com/foo/bar.js). You know what happens next rite?

The coolest part of this XSS is it doesn’t even need a

And visit the page you wanted to test, and see what happen

Here is an example vulnerable site for you : http://www.quirksmode.org/js/detect.html

Common Bad Habits of a Professional Web Developer

Zoiz — Mon, 10 Mar 2008 13:00:45 +0000

If you are a web developer, then you must read this. This time I’ll not talk about any critical vulnerabilities or exploits on a system, CMS, etc. Let’s talk about a web developer / web master bad habit itself. A bad habit that will lead them to be mass owned.

The problem lies within a password, a default password. Yes, the default password problem do exists on custom CMS! If you are still confuse of what I am talking about, I’ll give a REAL LIFE case, but of course I’ll will not mention the vulnerable sites. I’ll use example site name instead.

Here the story goes :

Let’s say Company X is a group of professional web developers. They have been developing web system for years and are well experienced. Let’s assume that they have developed 30 sites so far.

And Mr. Z, the attacker is eager to own site V, one of Company X customer.

And so Mr. Z went to site V to take a deep look. But the result shows no significant bugs found. And so he took another approach to try his luck. He went to Company X site and listed all their customers sites. He found out one of their customers site, site Y had a critical SQL Injection vulnerability. He exploited the site until he got all the users Login ID and passwords.

Then he went to site V again, and use the Login ID and passwords from site Y and try to log in to site V. Miracle happened, he successfully logged in to site V administration control panel. He owned site V through site Y.

This is a true story, and happened in our real life. Some web developer companies have some kind of default password for all sites that they developed. I am not sure what is the real purpose, but as my conclusion is that they are too LAZY to remember all the passwords. Because of this bad habits, sometimes mass hacking occurs.

I write this article isn’t base on no proofs, I ever owned dozen of sites with a single user name and password just like the story above. But I never damage or deface them, it’s not an ethical act to me.

And my advice to you is, if you are a web developer don’t take this bad habit or ready to be owned!

Massive HTML Injection Vulnerability

Zoiz — Sat, 16 Feb 2008 05:14:34 +0000

This could become a massive vulnerability since many sites or blogs out there allow user to post image on their article’s comment. As my small research, I found out that we could launch a HTML Injection, XSS and even CSRF attack to sites that vulnerable to this. Here is the PoC :

The method is the same as my Pop Up Method, it triggered javascript inside image error handler hence it bypasses javascript filter. This apply to sites that allow users to post image on their comments.

By : Zoiz [at] http://zoiz.web.id
Nothing is Secure