#learn365 Day-7: Cross-Site Script Inclusion (XSSI)
- XSS & XSSI are differemt.
In XSS, the payload is included on the victim to perform an action. However, In the case of XSSI, the victim's code (JS) is embedded in the attacker-controlled page.

#BugBountyTips #infosec (1/n)
(2/n)
In XSSI, the goal is to usually steal the data bypassing the restrictions such as the Same Origin Policy (SOP).
XSSI is less utilized and I never paid much attention to this attack vector. This seems to be an interesting and realistic, easy to exploit attack vector.
(3/n)
This attack is to mainly target the sensitive information that might get dynamically stored in the javascript files when a user performs some activity. If there are not proper restrictions set, an attacker can easily read and get hold of sensitive information.
(4/n)
However, this can also be utilized to steal other information such as authentication tokens.
There are mainly Four Situations when it comes to XSSI attack:
1. Regular XSSI (Static JS)
2. Authenticated Access to Static JS
3. Dynamic Javascript
4. Non-Script Attack
(5/n)
1. Regular XSSI - Static Javascript
- This is similar to looking for the hardcoded data in a javascript file.
- Since the javascript file is static, an attacker can try to embed it on a page in order to extract information.

This is the most common and easiest way.
(6/n)
2. Authenticated Access to Static JS or Dynamic JS
- In the case of Dynamic JS, the sensitive information is added to the Javascript file when the user performs an action.
- In the case of Authenticated Static JS, it requires an attacker to be authenticated.
(7/n)
- Testing Steps:
1. Perform an action with an authenticated user.
2. Perform the same action with the unauthenticated user.
3. Compare the content of JS files included in the response in both cases. If there is a difference it may give an idea of dynamic JS being used.
(8/n)
To Automatically detect this attack:
1. Use Detect DynamicJS Burp Plugin
2. It Passively scans all JS files & then scanning those files without auth identifier like cookies.
3. If the issue is found, it will be seen under Target Tab as an Informational severity finding.
(9/n)
Some Interesting Attacks as Described in OTG:
1. Sensitive Data Leakage via Global Variables
2. Leakage via Global Function Parameters
3. Leakage via CSV with Quotations Theft
4. Leakage via JavaScript Runtime Errors
5. Leakage via Prototype Chaining Using this

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Harsh Bothra

Harsh Bothra Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @harshbothra_

9 Jan
#Learn365 Day - 8: JSONP Attack
(Deleted prev. post and re-sharing as there are some modifications & to avoid false statement)
JSONP stands for JavaScript Object Notation with Padding which allows sending JSON data across domains without worrying about Cross-Domain Issues. (1/n)
(2/n)
It utilizes <script> tag to perform the action instead of using XHR. However, the function requires to be existing in the global scope.
It is an insecure communication method & should be used when no personal/sensitive data is involved & sanitizing the callback function.
(3/n)There are multiple attacks affecting the JSONP implementation as it doesn't have a security feature.
The “padding” or function to call with the JSON data, is often specified as a parameter. Often this parameter is called callback and is reflected as-is in the response.
Read 8 tweets
6 Jan
#Learn365 Day-6: Cross-Site Leaks

Goldmine to Learn: xsleaks.com

Cross-Site Leaks/XS-Leaks is a less explored security issue that usually comes from Side-Channel Attacks. I found this an interesting vector but unusual.

(1/n)

#BugBountyTips #infosec #AppSec
(2/n)
This basically utilizes the web's core principle of composability in order to determine & extract useful information.

XS-Leaks take advantage of small pieces of information that are exposed during interactions between websites.
(3/n)
Cross-Site Oracle.

This can be considered as a querying mechanism. The information used for this attack is of binary form and called Oracles. It usually has an answer of "Yes" or "No". You can say True or False.
Read 11 tweets
5 Jan
#Learn365 Day-5: Client-Side Template Injection (CSTI)
1. This occurs at the client-side like other JS attacks such as XSS.
2. This is mainly seen in the various JS libraries like AngularJS, VueJS etc which utilize the template engines at the client-side.
(1/n)
#bugbountytips
(2/n)
3. The presence of "ng-app" in the page source identifies the use of templates.
4. If the application directly accepts the input and process it without any validation, it may be vulnerable to CSTI.
5. CSTI leads to perform cross-site scripting attacks by escaping...
(3/n)
6. Testing this issue is similar to Server-Side Template Injection.
7. Steps:
a. In the suspected field, provide a payload like {{11*5}}
b. If the response reflected is 55, this tells that there is the use of the template and further you can try performing CSTI to XSS
Read 4 tweets
4 Jan
#Learn365 Day-4: Unauthenticated & Exploitable JIRA Vulnerabilities

There are multiple security vulnerabilities associated with the various versions of JIRA software which are exploited in wild and is one of my personal favourite 3rd Party apps to hunt.

#BugBountyTips

(1/n)
(2/n)
1. CVE-2020-14179 (Information Disclosure)
a. Navigate to <JIRA_URL>/secure/QueryComponent!Default.jspa
b. It leaks information about custom fields, custom SLA, etc.

2. CVE-2020-14181 (User Enumeration)
a. Navigate to <JIRA_URL>/secure/ViewUserHover.jspa?username=<uname>
(3/n)
3. CVE-2020-14178 (Project Key Enumeration)
a. Navigate to <JIRA_URL>/browse.<project_key>
b. Observe the error message on valid vs. invalid project key. Apart from the Enumeration, you can often get unauthenticated access to the project if the protections are not in place.
Read 9 tweets
3 Jan
#learn365 Day-3 SAML Vulns
SAML (Security Assertion Markup Language) is widely used for authentication. It uses XML schema and is prone to multiple security vulnerabilities. Some of the common security issues are:

1. XML Signature Wrapping (XSW) Attacks:
(1/n) #bugbountytips
(2/n)
.. XSW Attacks happen when the XML Digital Signature (XML DSig) is not validated which is used to establish a trust b/w IDPs & Service Providers.
This attack can lead to situations like Privilege Escalation, Authentication Abuse & Denial of Service as well.
(3/n)
Good Resource on SAML Signature Attacks: research.aurainfosec.io/bypassing-saml…
Burp Extensions: SAML Raider
There are multiple variants of XSW attacks from XSW1 to XSW8 (Way of exploitation varies a bit). You can read more about them here in little details: github.com/swisskyrepo/Pa…
Read 8 tweets
2 Jan
#learn365 Day-2: Regular Expression Denial of Service (ReDoS)
Due to weakly implemented RegEx Sometimes it is possible to perform a DoS attack by making this expression to evaluate an expression which will make the application work relatively slow. (1/n)

#bugbountytips
(2/n) Usually, this attack is explored and exploited when the source code is available and you can figure out what regular expressions are used in the code at what fields. For example, at the mobile no input field, what is the regex that validates the mobile no input field.
(3/n) However, you can also try to find this in Black/Gray Box engagements.

Method: Open the JavaScript files and search for the "RegExp(" function and try to figure out what function utilize that particular Regex.
Evaluation: github.com/2bdenny/ReScue This is a good tool...
Read 6 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!