full-disclosure - Re: Web 2.0 backdoors made easy with MSIE & XMLHttpRequest

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <45C748FD.50008@kennedyinfo.com>
Date: Mon, 05 Feb 2007 10:10:53 -0500
From: Troy Cregger <tcregger@...nedyinfo.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Web 2.0 backdoors made easy with MSIE
	&	XMLHttpRequest

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

>> The 2005 text does briefly mention "Accessing content / web-scanning" 
>> (take a look at Notes 1-3).
>> 
>> So the problem is much older.

Well, that's Micro$loth for ya.

Amit Klein wrote:
> Michal Zalewski wrote:
>> On Sat, 3 Feb 2007, Michal Zalewski wrote:
>>
>>   
>>>   xmlhttp.open("GET\thttp://dione.ids.pl/\tHTTP/1.0\n\n", "x",true);
>>>     
>> Funny enough, Paul Szabo was quick to point out that Amit Klein found the
>> same vector that I used here for client-side backdoors in May 2006 (still
>> not patched?! *shrieks in horror*), but for cache poisoning:
>>
>>   "IE + some popular forward proxy servers = XSS, defacement (browser cache poisoning)"
>>   http://www.securityfocus.com/archive/1/434931
>>
>> This is getting depressing. May 2006.
>>
>>   
> Much worse. The basic technique already appeared in two of my previous 
> write-ups:
> 
> "Exploiting the XmlHttpRequest object in IE - Referrer spoofing, and a 
> lot more..." (September 2005)
> http://www.securityfocus.com/archive/1/411585
> 
> "XS(T) attack variants which can, in some cases, eliminate the need for 
> TRACE </archive/107/308433/30/0/threaded>" (January 2003)
> http://www.securityfocus.com/archive/107/308433
> 
> The 2005 text does briefly mention "Accessing content / web-scanning" 
> (take a look at Notes 1-3).
> 
> So the problem is much older.
> 
> Thanks,
> -Amit
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFFx0j9nBEWLrrYRl8RAuzDAJ9j7ucnNaYlD7qXuFOsvwirZ4+WGwCfaupB
6WNArFbS1cB+5CRbYvkh/go=
=4eMy
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/