full-disclosure - JavaScript Lazy Authorization Forcer and Visited Link Scaner

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <6905b1570608151455qa6018b0se5a57ba3d1c472f3@mail.gmail.com>
Date: Tue, 15 Aug 2006 22:55:52 +0100
From: "pdp (architect)" <pdp.gnucitizen@...glemail.com>
To: full-disclosure@...ts.grok.org.uk, pen-test@...urityfocus.com, 
	webappsec@...urityfocus.com, bugtraq@...urityfocus.com
Cc: 
Subject: JavaScript Lazy Authorization Forcer and Visited
	Link Scaner

Lazy Authorization Forcer
http://www.gnucitizen.org/projects/javascript-authorization-forcer/

This is an idea I am still developing but here you go POC is available
and it works. The malicious JavaScript presented here will try to
guess URLs that contain credentials. It is sort of Basic
Authentication/FTP Authentication bruteforcer.

The POC works well in IE6, IE7, Firefox and Opera. I wasn't able to
suppress the Basic Authentication dialog when trying to create Basic
Authentication Bruteforcer. However, I came up with this lazyForce
implementation. A typical attack vector will be as the following:

1. The attacker discovers your internal IP
2. Based on your IP a class C range is enumerated using the Port
Scanning or Visited Link Scanning technique.
3. Once a target is discovered a large enough dictionary is used to
find valid credentials associated with each IP.

In order to make IE work a style sheet that is embeded inside the
current document needs to be reused. Read the provided source code for
more information.

Visited Link Scanner
http://www.gnucitizen.org/projects/javascript-visited-link-scanner/

This is a technique that I've learned from Jeremiah Grossman
(http://jeremiahgrossman.blogspot.com/) and his presentation on
JavaScript malware. Please, keep all the credits for this finding to
Jeremiah.

http://www.gnucitizen.org/projects/javascript-visited-link-scanner/visitedlinkscanner.js
The POC presented here is my improved version of the POC presented in
BlackHat. I made it work well in IE6, IE7, Firefox and Opera. IE6 has
very nasty disabilities when dealing with dynamically generated style
sheets. However, these can be easy sorted out by reusing the current
style sheet. If you are interested how it works just read the provided
source code.

Well, this is it.

-- 
pdp (architect)
http://www.gnucitizen.org

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/