Actually you would be right by OWASP definition: "Cross-site scripting
(sometimes referred to as XSS)
vulnerabilities occur when an attacker uses a web application to send malicious
code, generally in the
form of a script, to a different end user." This is why I wish there were more
widely accepted
standards and terms for vulnerabilities and threats.
Most people would think of this as an XSS attack but I just don't understand
what makes an attack a
"cross-site" scripting attack when the payload of the script simply rides other
users' sessions making
requests within the application using their identity. I'm definitely in
agreement that the
vulnerability that allowed this attack would allow a stored XSS attack as well.
In my opinion it would
be simply a matter of adding logic to the script that causes the victim's
browser to communicate to
another site (send a session cookie to an attacker-owned site, pop up a form
that submits to an
attacker-owned site, etc).
This is all semantics obviously but does anybody else have an opinion on what
the criteria for a
"cross-site scripting" attack is? I'm just trying to get it straight in my head
so that my
categorization of attacks is correct.
Jake Reynolds, CCIE, CCSP, MCSE, CCSA, JNCIA-FWV, CWNA
Senior Security Engineer -- Consulting Services
FishNet Security
Phone: 816.421.6611
Toll Free: 888.732.9406
Fax: 816.421.6677
http://www.fishnetsecurity.com
-----Original Message-----
From: Radoslav Vasilev [mailto:rvasilev@fit.edu]
Sent: Friday, October 14, 2005 9:47 AM
To: Reynolds, Jake
Cc: webappsec@securityfocus.com
Subject: RE: myspace hack
IMHO the fact that the attacker is capable of executing arbitrary code
on the client side would classify this as XSS. Although there is no
jumping between sites, I'm sure that it can be accomplished quite
easily.
.:radi.v
-----Original Message-----
From: Reynolds, Jake [mailto:Jake.Reynolds@fishnetsecurity.com]
Sent: Friday, October 14, 2005 10:30 AM
To: Chris Varenhorst; Akash
Cc: webappsec@securityfocus.com
Subject: RE: myspace hack
I wouldn't consider this an XSS attack. Where in the attack did
information cross sites? This seems
like it is an embedded XSS attack in that a malicious script was entered
into a profile in hopes that
victims would view and execute it. However, nothing was sent across
sites via the script. The
vulnerability was a lack of output validation in my opinion, which is
the same vulnerability that an
XSS attack would exploit. I don't know how you would classify the
attack... Probably "self-replicating
session riding". Yeah that has a nice FUD-factor to it.
Jake Reynolds, CCIE, CCSP, MCSE, CCSA, JNCIA-FWV, CWNA
Senior Security Engineer -- Consulting Services
FishNet Security
Phone: 816.421.6611
Toll Free: 888.732.9406
Fax: 816.421.6677
http://www.fishnetsecurity.com
-----Original Message-----
From: Chris Varenhorst [mailto:varenc@MIT.EDU]
Sent: Thursday, October 13, 2005 8:39 AM
To: Akash
Cc: webappsec@securityfocus.com
Subject: Re: myspace hack
Oh wow I'm wrong, I'm apparently thinking of current myspace bots which
do
as I described. It looks this was in fact made possible by an XSS
vulnerability.
Sorry
On Thu, 13 Oct 2005, Chris Varenhorst wrote:
This isn't hacking at all. (at least not what I'd call it)
This is writing a script to go through myspace IDs (which happen to be
squential) issuing friend requests to every one of them. To prevent
this, now myspace limits friend requests to a certain number per day.
Hope that covers it!
-Chris
On Thu, 13 Oct 2005, Akash wrote:
Does anyone has more technical details about how 1 million accounts
got hacked in about 24 hours.
This is the supposed confession of the hacker
http://fast.info/myspace/
I currently studying for CEH and just finished reading about XSS. So
this is of special interest.
regards
akash
