Zoiz Blog » XSS Corner

SQL Injection using XSS

Zoiz — Mon, 11 Aug 2008 16:47:28 +0000

It’s been couple of weeks since my last post. I’ve been very busy managing my newly set up company. And I think it’s time to post another (lame) article right here on this very (lame) blog.

After reading “Thousand Ways to SQL Injection“, people started to ask me whether it is possible to launch a SQL injection using XSS? Some of them questioned me about the possiblity of it, some of them don’t even believe it’s possible. And well some of them say that’s gonna happen but don’t know how or never came accross one.

Let’s take a look at the following ‘fictive’ (and lame) scenario of SQL Injection using XSS :

As we know that site abc.com uses GoodGoodCMS_v1.0 as their Content Management System. Mr. Z, the attacker, found out that GoodGoodCMS has a XSS flaw on the admin page. But well there is nothing much to exploit since GoodGoodCMS doesn’t uses Cookies as the authentication method. But Mr. Z did found out that the GoodGoodCMS uses Cookies values in SQL Query without a proper filter.

Guess what? Mr. Z pull a XSS and insert something like this:

This is my concept of SQL Injection using XSS. Correct me if I am wrong, and you are very welcome to shout your ideas about this topic here.

Thanks

Zoiz – http://zoiz.web.id

Bypass Anti XSS Filter : A Little Nice XSS Trick

Zoiz — Wed, 16 Jul 2008 04:52:13 +0000

Sometimes when I develop web applications, I’ll feel not good if I am asked to allow HTML in user inputs / outputs. What scares me? XSS I think.

This morning I received an interesting email from webappsec.org mailing list. Amit Klein founds out that he can trigger a XSS without a
…

The XSS is something like this :

And the attacker should put some JS on his host on the exact directory (ex : http://www.attacker.com/foo/bar.js). You know what happens next rite?

The coolest part of this XSS is it doesn’t even need a

How to use? CSRF is the answer. Remember that XSS & CSRF are pal

Thanks,

Zoiz
http://zoiz.web.id

WP-StatPress XSS

Zoiz — Sat, 05 Jul 2008 15:42:09 +0000

If you are using WP-StatPress plugin (1.2.9 or below) on your WP blog, you might need to take a look at this :

php Line 1146 : $referrer = (isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : ”);

This might pull a XSS out of your admin page if a malicious user spoof the a referer URL into something like this : http://bla3.com/’>”>

You might either update your Statpress or fixed it yourself by sanitizing the $referrer.

http://wordpress.org/extend/plugins/statpress/

Credits flies to : Rogério Vicente & Daniele Lippi

Base64 Encoded XSS

Zoiz — Thu, 29 May 2008 16:42:00 +0000

This is rare, but there is one. A live XSS out there on one of Yahoo!’s portal (Found by Lokipaki). And the XSS is base64 encoded. When I tried the XSS myself, I felt a little shocked because this XSS actually bypassed No-Script plugin.

Here is the Proof of Concept :

http://bbs.cn.yahoo.com/searchApplyBoard/PHNjcmlwdD5hbGVydCgiWFNTLWJ5cGFzcy1Oby1TY3JpcHQiKTwvc2NyaXB0Pg==.html

Result :

XSS on Yahoo over No-Script plugin. It’s a triple kill! I know Yahoo! is in the No-Script white-list, but I thought No-Script was supposed to block this XSS anyway. What do you think?

Register.net.id Bugs Hunt

Zoiz — Thu, 10 Apr 2008 16:34:29 +0000

This Might Be The Biggest Ever Zero Day Vulnerabilities Reported in Indonesia From the View of it’s Impact.

Register.net.id is a .id domain registrar of Indonesia. It provided Indonesia webmasters domains at affordable prices (But I got this domain for FREE – promotion period only!! ). Since it’s a domain registrar site, so it can be considered as a very important site in Indonesia. It serves webmasters in Indonesia for their .id domains need with approximately more than 40.000 active domains, which is a huge number.

One of the term to apply a .id domain is that user must upload his/her personal information thingie like Personal Identity Card, NPWP, SIUP, SITU, etc. Depend on what kind of TLD he/she wanted. For example, to request a .web.id domain, an user must upload his/her Personal Identity Card (KTP). And so are other kinds of TLD. Since Register.net.id holds and stores many important documents from their users, it system’s security became ultimately important. Thus my bugs hunt project began

Those bugs below are being keep by me for some time. I’ve never publish it for public. Since I’ve reported those bugs to Register.net.id Admin and most of are are fixed, now I am able to publish what I’ve found

1. Whois XSS

The XSS vulnerability on the Whois engine first time found by me on 14 July 2007. You can read this post about how I found it, and this post that I rewrite. It’s not a big vulnerability though, but due to it’s mass, so it’s worth mentioning

Status : Fixed, Date : unknown

2. Personal Documents Leakage

By modifying the document id, I am able to list all the documents that is stored on the database easily. The documents included Personal Identification Card (KTP), NPWP, SIUP, SITU, etc. This is a serious problem though. And also a malicious user can perform an illegal request without a proper privilege to view other users personal information. If you do not know how much your personal information worth, you must read this : http://www.bankrate.com/brm/news/pf/20060221b1.asp.

My friend, Th0R has also published a white-paper about this personal document leakage issue too on his blog.