はてなブックマーク

DOM Clobbering Thursday, 16 May 2013 The DOM is a mess. In an effort to support legacy quick short cuts such as “form.name” etc the browsers have created a Frankenstein monster. This is well known of course but I just wonder how far the rabbit hole goes. I’m gonna share what I discovered over the years. HTML Collections First up is my favourite “HTML Collections”, when html elements are combined i

Tweetable PHP-Non Alpha Thursday, 13 December 2012 I started to try and break the 10 charset limit of PHP non-alpha after @InsertScript showed me that PHP Dev supports [] syntax for arrays. I wondered if it would be possible to break the limit within production PHP. At first I thought you could but then after some testing I found that there was no way to concat without “.” and no way to call a str

Firefox knows what your friends did last summer Wednesday, 10 October 2012 Update… Mozilla have now fixed the problem on Thursday. Not only did they take down the original release but fixed it very quickly within two days which is very impressive. Good work! I was writing some JavaScript and found that the following happens: /undefined/.test(undefined)//true The undefined value is converted to a s

Eval a url Tuesday, 8 May 2012 You might have seen a blog post or came to the conclusion that urls are in fact valid JavaScript such as: http://thespanner.co.uk (label) (comment) That’s weird and cool but how do we execute JavaScript from the url? Something like: http://thespanner.co.uk\nalert(1) (label) (comment) (newLine) (functionCall) Trouble is the new line isn’t allowed inside the browser ur

XSS technique without parentheses Tuesday, 1 May 2012 This is a very old technique I discovered years ago which I used to bypass a filter and it’s pretty awesome. It might come in handy to bypass a WAF or filter since it’s not public until now. First you need to understand (which you probably do) that the window object is the default object in JavaScript and every time you execute code it’s like y

Non alphanumeric code in PHP Thursday, 22 September 2011 So a small php shell was tweeted around and it inspired me to investigate a way to execute non-alphanumeric code. First off I started with the idea of using octal escapes in PHP and constructing the escape so for example: \107 is “G” if I could construct the “107” and add the backslash to the beginning maybe I could construct “G”. It worked

JSON Hijacking Monday, 30 May 2011 There isn’t a lot of information about JSON hijacking out there at the minute, I will aim to provide a “news update” on the state of publicly known techniques. First off I will give a quick overview of how JSON data can be stolen and explain how JavaScript reads JSON. JavaScript’s quirky nature There is a little quirk in how JavaScript reads objects, it is a synt

I tweeted this a while ago but Twitter sucks when it comes to finding anything and I thought it was good enough for a blog post. Way back in Safari 3.0 and Internet Explorer 5.5 and the old Opera you could mess with JavaScript urls and the base tag. Me, Mario and Brainpillow documented this on HTML5 security cheatsheet ages ago. The original vector allows you to use inject a JavaScript url in the

Ping pong obfuscation Monday, 23 November 2009 This is a fun post about a feature I found in IE that allows you to do some crazy obfuscation. I’ll start off with some simple examples:- <img src=1 language=vbs onerror=msgbox+1> <img src=1 language=vbscript onerror=msgbox+1> <img src=1 onerror=vbs:msgbox+1> So here we’re not obfuscating but I’m showing how IE accepts the language attribute and a lab

onreadystatechange Wednesday, 8 April 2009 I like this event, it’s pretty cool. The reason why it’s interesting from a XSS perspective is that it is executed automatically without user interaction. This is rare in the XSS playground, usually you have to use onerror, onload or onfocus events and they only work in certain circumstances. I’d better mention that the event is only relevant to Internet

XSS Rays Wednesday, 25 March 2009 I’ve developed a new XSS scanner tool that’s written in Javascript called XSS Rays for Microsoft. They have given me permission to release the tool as open source which is awesome because it can be used for other open source applications. I recommend you use it as part of the web development process to make sure you’ve filtered XSS correctly on your application. I

Inline UTF-7 E4X javascript hijacking Tuesday, 24 February 2009 I finally get to talk about this because Yosuke Hasegawa has already disclosed the IE/FF variant with JSON data. I also discovered the UTF-7 JSON hacking independently but I wasn’t aware it was public so I didn’t blog about it. Just in case you haven’t, you should check out his presentation it’s awesome! Anyway onto E4X I just love it

Detecting browsers javascript hacks Thursday, 29 January 2009 I enjoyed my last experiment to create tiny browser detection hacks, so I thought I’d try and do some more in other browsers. I’ve found these while testing Hackvertor and writing the inspection functions. The rules are simple if you want to post your own:- 1. The variable assignment must be the abbreviation of the browser. E.g. FF, IE,

XSS attacks a practical example Monday, 1 October 2007 I’ve been talking with Hackathology and he was having trouble understand the context of certain XSS attacks, so I decided to write him a quick PHP document which creates vulnerable variables and examples. The document has links which perform the injections on itself, I didn’t have IE handy to test so forgive me if the IE examples don’t quite w