UI-Redressing Attacks - The Process & Exploitation

Mercedes-Benz Research and Development India

UI-Redressing AttacksThe Process & ExploitationAmol Naik4th Aug 2012


UI-Redressing Attacks: The Process & Exploitation | Amol Naik | 4th Aug 20122

Agenda

• Introduction to UI-Redressing attacks• Server-Side Mitigations• Bug Bounties• Target• Tools• CSS Basics• Exploitation Techniques


3

I am

• Web Application Pentester• Bug Hunter – Google, Facebook, Twitter• Web Challenges Coder for nullcon HackIM since 2011• Winner of ClubHACK preCON 2011 CTF• Active member of Garage4Hackers• Blog at: http://amolnaik4.blogspot.com• Twitter: @amolnaik4



4

UI-Redressing Attacks

•Change User Interface in Browser• Invisible Iframes• CSS Tricks• HTML5 Drag-Drop

•Victims clicks button/link on attacker’s site

•He/She actually clicking on Vulnerable Site



5

UI-Redressing Attacks




Impact

• One Click Attack• CSRF Protection Bypass• Cross-Domain Content Extraction• Exploit “Self XSS”



Server-Side Mitigations

• X-Frame-Options- HTTP Response Header- Supported by all latest browsers

• X-Frame-Options: DENY- The page can not be rendered in a frame, regardless of the site attempting to do

so

• X-Frame-Options: SAMEORIGIN- The page can only be rendered in a frame on the same origin as the page itself



Server-Side Mitigations

• Frame Bursting Code- JavaScript- Ensures the current frame is the most top level window



Bug Bounties

• Google- Bounty Price upto $3133.7- XSS, CSRF main focus- Researcher will be listed in Google Security Hall of Fame

• Facebook- Bounty price upto $5000- XSS, CSRF, Open Redirect, Database Injection- Researcher will be listed in Facebook WhiteHat List



Target

• CSRF Protected actions

• Pages with sensitive information in page-source

• Self XSS



Tools



CSS Basics

• Opacity- Set Transparency to an element

• Top,Left- Negative values shifts elements out of browser window

• Position- Static (default)- Relative- Absolute- Fixed



Exploitation Techniques



Simple Clickjacking

• Google- Remove Google Books Service- FIXED

• Facebook- Add Any Facebook App- FIXED



Hijack 2 Clicks

• Google- Remove Google Web History, Health & Orkut- FIXED



Cross-Domain Content Extraction

• Facebook- Get Token from page-source- Use of HTML5 Drag-Drop- Only possible in FireFox 13- FIXED



Fake Captcha

• Facebook- Get Token- FIXED



Self-XSS

• Scenario- Input field is vulnerable to XSS- Vulnerable page sends user input to other page- And output is reflected to vulnerable page- Ajax call used to send the user data- GET/POST XSS exploitation method doesn’t work- How to exploit ?



Self-XSS

• Solution- HTML5 Drag-Drop

• Google- Google Map examples- Google Base examples- FIXED



Bursting Frame Buster

• Adobe- Adobe Flash Manager Setting page- Discovered & reported by “Nafeez Ahmed AKA skeptic_fx”- “204 No Content” is the trick- FIXED



Thanks

• Lavakumar K : http://www.andlabs.org• Kotowicz : http://blog.kotowicz.net• Nafeez Ahmed : http://blog.skepticfx.com• Marcus Niemietz : “UI Redressing: Attacks & Countermeasures

Revisited”• OWASP : http://www.owasp.org• Imperva : http://www.imperva.com• W3School : http://www.w3school.com



Questions

• Amol Naik- http://amolnaik4.blogspot.com- @amolnaik4

UI-Redressing Attacks - The Process & Exploitation

Technology

Transcript of UI-Redressing Attacks - The Process & Exploitation