Bypassing Same Origin Policy - Hacking-Lab · 2010. 9. 7. · Tel +41 55-214 41 60 Fax +41 55-214...

Tel +41 55-214 41 60Fax +41 55-214 41 61team@csnc.ch www.csnc.ch

Compass Security AGGlärnischstrasse 7Postfach 1628CH-8640 Rapperswil

Bypassing Same Origin Policy

Simon Egli, IT Security Analyst

E-Banking

Why?Separated Content

Restricted DOM Access

Access to Cookies

Same Origin Policy Same Origin Policy

19901st Web Server1st Web Site1st Web Browser

1996JavaScriptSame Origin PolicyNetscape Navigator 2.0

2003Web 2.0

think Web 2.0 is of course a piece of jargon, nobody evenknows what it means Tim Berners-Lee

Same Origin Policy

Same Origin Followers

Restricted access to Cookies / DOM for: Java Script

XMLHttpRequest (XHR)

Adobe Flash

Java Applet

Microsoft Silverlight

ActiveX

Browser Extensions & Plugins

Background HTTP requests from JavaScript

Invented by Microsoft in 2000 (Internet Explorer 5)

IE 5/6: COM/ActiveX object Microsoft.XmlHttp

IE 7, Firefox, Opera, Safari and other browsers:Native JavaScript object XmlHttpRequest

XMLHttpRequest

And AJAX / XMLHttpRequest?

Non-origin requests are

not supported with XHR

var xmlHttp = new XMLHttpRequest();

var url = 'http://www.other.com/res/pub-data/';

function callOtherDomain(){

if(xmlHttp) {

xmlHttp.open('GET', url, true);

xmlHttp.onreadystatechange = handler;

xmlHttp.send();

www.other.com www.origin.com

Use Script from 3rd Party

JavaScript from 3rd party site IS

GENERALLY DENIED to access

the origin cookie because of the

SAME ORIGIN POLICY

3rd party site Origin site

Origin Determination Rule

= Protokoll (http/https)

+ Host (www.csnc.ch)

+ Port (:80)

Origin Example

Referenz URL: http://www.csnc.ch/de/index.html

1. http://www.csnc.ch/en/index.html

2. https://www.csnc.ch/de/index.html

3. http://csnc.ch/de/index.html

4. http://v1.www.csnc.ch/de/index.html

By-passing SOP?

Why by-passing SOP?

www.mashup.com

Why by-passing SOP?

www.mashup.com

Use Script from 3rd Party

JavaScript from 3rd party site

IS ALLOWED to access the

origin cookie, if the script is

loaded from the origin site

with <script src=>

3rd party site Origin site

Example Google Analytics

Tel +41 55-214 41 60Fax +41 55-214 41 61team@csnc.ch www.csnc.ch

Compass Security AGGlärnischstrasse 7Postfach 1628CH-8640 Rapperswil

A New Solution is Required!

You will loose control andauthority of your domain if youuse <script src tags!

Cross-Origin Resource Sharing

CORS, a W3C Working Draft - 27 July 2010

CORS Compatibility

XMLHttpRequest (XHR) XDomainRequest (XDR)

v2.0V8.0

CORS Simple Request

if(xmlHttp) {

xmlHttp.send();

Simple Request ExampleClient Request:GET /resources/public-data/ HTTP/1.1Host: bar.otherUser-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b3pre)Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-us,en;q=0.5Accept-Encoding: gzip,deflateAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7Keep-Alive: 300Connection: keep-aliveReferer: http://foo.example/examples/access-control/simpleXSInvocation.htmlOrigin: http://foo.example

#1 Example Server Response:HTTP/1.1 200 OKDate: Mon, 01 Dec 2008 00:23:53 GMTServer: Apache/2.0.61 Access-Control-Allow-Origin: *Keep-Alive: timeout=2, max=100Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: application/xml

[XML Data]

#2 Example Server Response:HTTP/1.1 200 OKDate: Mon, 01 Dec 2008 00:23:53 GMTServer: Apache/2.0.61 Access-Control-Allow-Origin: http://foo.exampleKeep-Alive: timeout=2, max=100Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: application/xml

[XML Data]

CORS Preflighted Request Example

1.) OPTIONS Request2.) GET / POST Request3.) Server sends data

CORS Request with credentials

if(xmlHttp) {

xmlHttp.withCredentials = "true";

xmlHttp.send();

Request with CredentialsClient Request:GET /resources/public-data/ HTTP/1.1Host: bar.otherUser-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.1b3pre)Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-us,en;q=0.5Accept-Encoding: gzip,deflateAccept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7Keep-Alive: 300Connection: keep-aliveReferer: http://foo.example/examples/access-control/simpleXSInvocation.htmlOrigin: http://foo.exampleCookie: pageAccess=2

Server Response:HTTP/1.1 200 OKDate: Mon, 01 Dec 2008 00:23:53 GMTServer: Apache/2.0.61 Access-Control-Allow-Origin: http://foo.exampleAccess-Control-Allow-Credentials: trueKeep-Alive: timeout=2, max=100Connection: Keep-AliveContent-Type: application/xml

[XML Data]

Mitigation

CORS allowes to load cross-domain data from foreign domains

Server decides which origin is allowed to access the data

Separate critical / non-critical applications into different subdomains E.g. http://app1.mybank.com / http://app2.mybank.com

Host third-party scripts by yourself or trust the source

Load third-party scripts via local proxy

Cross origin resource sharing (CORS) Fully supported (XMLHttpRequest) by Firefox 3.5, Safari 4, Google Chrome 2

Proprietary implemented (XDomainRequest) by Internet Explorer 8

Q/A Session

Vielen Dank

References / Further Links

http://code.google.com/p/browsersec/w/list

http://www.w3.org/TR/cors/

https://developer.mozilla.org/En/HTTP_Access_Control

http://msdn.microsoft.com/en-us/library/cc709423(VS.85).aspx

http://hacks.mozilla.org/2009/07/cross-site-xmlhttprequest-with-cors/

http://www.nczonline.net/blog/2008/04/27/cross-domain-xhr-removed-from-firefox-3/

Bypassing Same Origin Policy - Hacking-Lab · 2010. 9. 7. · Tel +41 55-214 41 60 Fax +41 55-214...

Documents

Transcript of Bypassing Same Origin Policy - Hacking-Lab · 2010. 9. 7. · Tel +41 55-214 41 60 Fax +41 55-214...

Investment Strategy - SGKB · Impressum Issuer Hyposwiss Private Bank Ltd. Stauffacherstrasse 41 CH-8021 Zurich Phone +41 (0)44 214 31 11 Fax +41 (0)44 211 52 23

SSL/TLS jungle bringing light into the cipher forest€¦ · Tel +41 55 214 41 60 Fax +41 55 214 41 61 team@csnc.ch Compass Security Schweiz AG Werkstrasse 20 Postfach 2038 CH-8645

214 Manufacturing Survey 214 Manufacturing Survey · 214 Manufacturing Survey 214 Manufacturing Survey 1 Manufacturing has consistently been an important contributor to Maryland’s

Hacking-Lab Online Hack&Learn 9. December 2008€¦ · Hacking-Lab Glärnischstrasse 7 Postfach 1671 CH-8640 Rapperswil T +41 55 214 41 60 F +41 55 214 41 61 root@hacking-lab.com

C Arrays and Pointers - exploit.courses · Tel +41 55 214 41 60 Fax +41 55 214 41 61 team@csnc.ch Compass Security Schweiz AG Werkstrasse 20 Postfach 2038 CH-8645 Jona C Arrays and

214 kumar

214 КУЛТУРНАТА ПАМЕТlyuboslovie.shu.bg/2019/Luboslovie 19_last1-214-229.pdf · 214 КУЛТУРНАТА ПАМЕТ ЮЛИЯ ВРЕВСКА И ИВАН ТУРГЕНЕВ:

Exploiting and Defense · EBP isch doch 32 bit? Tel +41 55 214 41 60 Fax +41 55 214 41 61 team@csnc.ch ... To circumvent all common anti-exploiting technologies for Linux ... 12:

Social Engineering / SmartPhone and DriveBy · 2018-09-17 · Tel +41 55 214 41 60 Fax +41 55 214 41 61 team@csnc.ch Compass Security AG Werkstrasse 20 Postfach 2038 CH-8645 Jona

ARCTIC VOL. 41, NO, 3 (SEPTEMBER 1988) P. 203-214 The ...pubs.aina.ucalgary.ca/arctic/Arctic41-3-203.pdf · VOL. 41, NO, 3 (SEPTEMBER 1988) P. 203-214 ARCTIC The Helgoland Expedition

Compass Security AG Black Hat USA 2012 November 16th, 2012 · 2017-03-23 · Compass Security AG Werkstrasse 20 Postfach 2038 CH-8645 Jona T +41 55 214 41 60 F +41 55 214 41 61 team@csnc.ch

Hacking-Lab Online Wargames 19. November 2008 · CH-8640 Rapperswil T +41 55 214 41 60 F +41 55 214 41 61 root@hacking-lab.com Hacking-Lab Online Wargames ... corresponding servers

Incident Erfahrungen / Forensic Readiness · Tel +41 55 214 41 60 Fax +41 55 214 41 61 team@csnc.ch Compass Security AG Werkstrasse 20 Postfach 2038 CH-8645 Jona Incident Erfahrungen

SSL/TLS jungle bringing light into the cipher forest · 4/9/2014 · Tel +41 55 214 41 60 Fax +41 55 214 41 61 team@csnc.ch Compass Security Schweiz AG Werkstrasse 20 Postfach 2038

Intel Architecture...Tel +41 55 214 41 60 Fax +41 55 214 41 61 team@csnc.ch Compass Security Schweiz AG Werkstrasse 20 Postfach 2038 CH-8645 Jona Intel Architecture Tel +41 55 214

214 Dungeon

Surfacing 214

Windows Attack -Gain Enterprise Admin Privileges in 5 · PDF fileWindows Attack -Gain Enterprise Admin Privileges in 5 Minutes Tel +41 55-214 41 60 Fax +41 55-214 41 61 team@csnc.ch

Tel. +27 (0)41 504 9928 priya.peters@mandela.ac.za ... briefs/Creative... · Priya Peters . Room 214, Building 8, South Campus . Tel. +27 (0)41 504 9928 priya.peters@mandela.ac.za

Defeat Exploit MitigationsTel +41 55 214 41 60 Fax +41 55 214 41 61 team@csnc.ch Compass Security Schweiz AG Werkstrasse 20 Postfach 2038 CH-8645 Jona