Re: Web 2.0 backdoors made easy with MSIE & XMLHttpRequest

[Troy Cregger <tcregger () kennedyinfo com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> > The 2005 text does briefly mention "Accessing content / web-scanning" 
> > (take a look at Notes 1-3).
> >
> > So the problem is much older.

Well, that's Micro$loth for ya.

Amit Klein wrote:
> Michal Zalewski wrote:
> > On Sat, 3 Feb 2007, Michal Zalewski wrote:
> >
> >   
> > >   xmlhttp.open("GET\thttp://dione.ids.pl/\tHTTP/1.0\n\n";, "x",true);
> > >     
> > Funny enough, Paul Szabo was quick to point out that Amit Klein found the
> > same vector that I used here for client-side backdoors in May 2006 (still
> > not patched?! *shrieks in horror*), but for cache poisoning:
> >
> >   "IE + some popular forward proxy servers = XSS, defacement (browser cache poisoning)"
> >   http://www.securityfocus.com/archive/1/434931
> >
> > This is getting depressing. May 2006.
> >
> >   
> Much worse. The basic technique already appeared in two of my previous 
> write-ups:
>
> "Exploiting the XmlHttpRequest object in IE - Referrer spoofing, and a 
> lot more..." (September 2005)
> http://www.securityfocus.com/archive/1/411585
>
> "XS(T) attack variants which can, in some cases, eliminate the need for 
> TRACE </archive/107/308433/30/0/threaded>" (January 2003)
> http://www.securityfocus.com/archive/107/308433
>
> The 2005 text does briefly mention "Accessing content / web-scanning" 
> (take a look at Notes 1-3).
>
> So the problem is much older.
>
> Thanks,
> -Amit
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFFx0j9nBEWLrrYRl8RAuzDAJ9j7ucnNaYlD7qXuFOsvwirZ4+WGwCfaupB
6WNArFbS1cB+5CRbYvkh/go=
=4eMy
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/