XSSing Your Way to Shell

Post on 11-Jun-2015

433 views 1 download

Preview:

Click to see full reader

Tags:

Report this document
SHARE

description

NOTE: Download the PDF for high-resolution text. (It appears that SlideShare does not handle custom fonts very well.) Alternative Med-Res Source: https://speakerdeck.com/varbaek/xssing-your-way-to-shell Cross-Site Scripting isn’t new, but there is generally a large belief among vendors, corporations and even some hackers that XSS can only be used to conduct client-side attacks such as session hijacking and similar attacks, or with tools such as BeEF. This talk dives into finding a 0day in a web application, creating a basic payload, and then; the development of an idea, that becomes an asynchronous JavaScript payload able to use any administrative feature enabling the attacker to execute arbitrary code on the server. During the talk, custom-built JavaScript payloads enabling arbitrary code execution will be demonstrated. Location: Thursday 29th May 2014 - 12:15 @ Beurs van Berlage - Amsterdam - Netherlands. Bio: Hans-Michael Varbaek is a Security Consultant at Sense of Security and is an active part of the penetration testing team. He is an IT security specialist, independent researcher, and penetration tester. Hans has periodically been invited to help out community driven projects such as The Exploit Database (which he participated actively in by e.g. managing their forums and writing blog entries about web application security). Hans has presented about advanced attack methods (e.g. chained exploits) and secure web application development for numerous clients as well. Along with an IT-Administrator degree, Hans is an Offensive Security Certified Expert (OSCE) and GIAC Penetration Tester (GPEN). Toolkit: https://github.com/Varbaek/xss-shell-payloads YouTube: https://www.youtube.com/playlist?list=PLIjb28IYMQgoZaHaHUYCc8VsFETfHl4i3 Vimeo: https://vimeo.com/varbaek/videos

Transcript of XSSing Your Way to Shell

Sense of Security Pty Ltd Sydney Level 8, 66 King St Sydney NSW 2000 Australia

Melbourne Level 10, 401 Docklands Dr Melbourne VIC 3008 Australia

T: 1300 922 923 T: +61 (0) 2 9290 4444 F: +61 (0) 2 9290 4455

info@senseofsecurity.com.au www.senseofsecurity.com.au ABN: 14 098 237 908

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

http://www.exploit-db.com/exploits/16076
http://www.exploit-db.com/exploits/16076
http://www.exploit-db.com/exploits/16076
http://www.exploit-db.com/exploits/16076
http://en.wikipedia.org/wiki/Linkback

•

•

•

•

http://en.wikipedia.org/wiki/Linkback
http://www.exploit-db.com/exploits/16076
http://www.exploit-db.com/exploits/16076
http://www.exploit-db.com/exploits/16076
http://www.exploit-db.com/exploits/16076

•

•

•

http://www.exploit-db.com/exploits/16077/
http://www.exploit-db.com/exploits/16077/
http://www.exploit-db.com/exploits/16077/
http://www.exploit-db.com/exploits/16077/
http://www.exploit-db.com/exploits/16077/
http://www.exploit-db.com/exploits/16077/
http://www.exploit-db.com/exploits/16077/
http://www.exploit-db.com/exploits/16077/

•

•

•

•

•

•

•

http://ars.to/15XSmt8
http://ars.to/15XSmt8

•

•

•

•

•

•

•

http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/
http://blog.canonical.com/2013/07/30/ubuntu-forums-are-back-up-and-a-post-mortem/

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

•

http://www.exploit-db.com/vbseo-from-xss-to-reverse-php-shell/
http://www.exploit-db.com/vbseo-from-xss-to-reverse-php-shell/
http://www.exploit-db.com/vbseo-from-xss-to-reverse-php-shell/
http://www.exploit-db.com/vbseo-from-xss-to-reverse-php-shell/
http://www.exploit-db.com/vbseo-from-xss-to-reverse-php-shell/
http://www.exploit-db.com/vbseo-from-xss-to-reverse-php-shell/
http://www.exploit-db.com/vbseo-from-xss-to-reverse-php-shell/
http://www.exploit-db.com/vbseo-from-xss-to-reverse-php-shell/
http://www.exploit-db.com/vbseo-from-xss-to-reverse-php-shell/
http://www.exploit-db.com/vbseo-from-xss-to-reverse-php-shell/
http://www.exploit-db.com/vbseo-from-xss-to-reverse-php-shell/
http://www.exploit-db.com/vbseo-from-xss-to-reverse-php-shell/
http://www.exploit-db.com/vbseo-from-xss-to-reverse-php-shell/
http://www.exploit-db.com/vbseo-from-xss-to-reverse-php-shell/
http://www.exploit-db.com/vbseo-from-xss-to-reverse-php-shell/
http://www.exploit-db.com/vbseo-from-xss-to-reverse-php-shell/
https://github.com/Varbaek
https://github.com/Varbaek
http://www.shodanhq.com/
https://www.whitehatsec.com/resource/stats.html
https://www.whitehatsec.com/resource/stats.html
https://www.whitehatsec.com/resource/stats.html
http://www.losttype.com/edmondsans/
http://www.losttype.com/edmondsans/
http://www.losttype.com/edmondsans/
http://www.losttype.com/font/?name=maven
http://www.losttype.com/font/?name=maven

•

Top related

YOUR COMFORT, YOUR WAY
 Documents
Your health, your way
 Documents
Your Benefits, Your Way
 Documents
Your memories your way!
 Documents
Your Way, My Way And The Navy Way
 Documents
Improving your shell usage - 2010
 Technology
Get Out of Your Shell - Easter 2016
 Education
CMShip for UPS Guide - cmstothemax.com€¦ · sample and shell company data. In no way do we claim that this data will match your company structure completely. The shell templates
 Documents
Why Zsh is Cooler than Your Shell
 Documents
Shell Scheme Information HAVILLS - Havill Exhibition S · Optional extras for your stand Choice to create and present your environment Basic Shell Scheme Shell Dimensions Panel Dimensions
 Documents
YOUR HUSH YOUR WAY
 Documents
Your cloud. Your way.
 Technology
Your Resume Your Way
 Documents
Preview Shell Charg#101232 - citibank.com.hk · • You should not leave an ATM until you get your cash and your credit card back Shell Shell Shell ... What to do in case of loss,
 Documents
Identify the shell type shown here. (Click the mouse to turn the page) As a way of checking your understanding of shell structures to this point, you might.
 Documents
Your future, your way
 Documents
shell X · Shell is constantly investing to develop better process oils to support your business. Whatever your needs and applications, Shell can provide a full range of process oils,
 Documents
SHELL work permits A6-1 - a-way-of-living.infoa-way-of-living.info/site/wp-content/plugins/downloads-manager... · SHELL work permits A6-1.ai Author: Veselin Raznatovic Created Date:
 Documents
Your Intranet, Your Way
 Technology
Improve your command line UX with Fish Shell
 Technology

Copyright © 2022 FDOCUMENTS