Showing posts with label spam. Show all posts
Showing posts with label spam. Show all posts
Thursday, 4 June 2015
Facebook Old Generated URLs Still Vulnerable to Open Redirect Attacks & A New Open Redirect Web Security Bugs
This summary is not available. Please
click here to view the post.
Saturday, 9 May 2015
ESPN Are Suffering Serious XSS and Dest Redirect Privilege Escalation Security Vulnerabilities
Popular ESPN website (espn.go.com) has been found to be vulnerable to multiple serious XSS and Dest Redirect Privilege Escalation security vulnerabilities according to Wang Jing, a mathematics student from the School of Physical and Mathematical Sciences at Nanyang Technological University in Singapore.
Wang found a large number of ESPN’s credible links were vulnerable to XSS and Dest Redirect Privilege Escalation attacks. These vulnerabilities occur at ESPN’s “login” & “register” pages.
ESPN is one of the most common U.S.-based cable and satellite TV channel with close to 100 million subscribers. Its Alexa global rank is 63 and US rank is 14. Based on eBizMBA, “As of December 1, 2014, ESPN has an estimated 80,000,000 unique monthly visitors.” At the same time, ESPN broadcasts in more than 200 countries.
Wang posted his findings on the Full Disclosure forum. He wrote that he had reported the issues to ESPN in early May 2014 but the vulnerabilities are still unpatched. According to Wang, “Those vulnerabilities are very dangerous. Since they happen at ESPN’s “login” & “register” pages that are credible. Attackers can abuse those links to mislead ESPN’s users. The success rate of attacks may be high.“
Proof of concept videos have also been released on YouTube to illustrate an attack.
According to OWASP, “XSS allows attackers to execute scripts in the victims browser which can hijack user sessions, deface websites or redirect the user to malicious sites.” While Dest Redirect Privilege Escalation “is used in phishing attacks to get users to visit malicious sites without realizing it.”
If ESPN’s users were exploited, attackers can get their identity. Those attacks can also be used to steal password, perform denial of service attacks, spy users’ habits, alter browser functionality, access sensitive information and so on.
Wang wrote his tests were using Firefox (33.0) in Ubuntu (14.04) and IE (8.0. 7601) in Windows 8. And the attack could work without a user being logged in.
Thursday, 4 December 2014
Google Covert Redirect Web Security Bugs Based on Googleads.g.doubleclick.net
Bypass Google Open Redirect Filter Based on Googleads.g.doubleclick.net
-- Google Covert Redirect Vulnerability Based on Googleads.g.doubleclick.net
(1) WebSite:
google.com
"Google is an American multinational technology company specializing in Internet-related services and products. These include online advertising technologies, search, cloud computing, and software. Most of its profits are derived from AdWords, an online advertising service that places advertising near the list of search results.
The corporation has been estimated to run more than one million servers in data centers around the world (as of 2007). It processes over one billion search requests and about 24 petabytes of user-generated data each day (as of 2009). In December 2013, Alexa listed google.com as the most visited website in the world. Numerous Google sites in other languages figure in the top one hundred, as do several other Google-owned sites such as YouTube and Blogger. Its market dominance has led to prominent media coverage, including criticism of the company over issues such as search neutrality, copyright, censorship, and privacy." (Wikipedia)
(2) Vulnerability Description:
Google web application has a computer cyber security problem. Hacker can exploit it by Covert Redirect attacks.
The vulnerabilities can be attacked without user login. Tests were performed on Microsoft IE (10.0.9200.16750) of Windows 8, Mozilla Firefox (34.0) & Google Chromium 39.0.2171.65-0 ubuntu0.14.04.1.1064 (64-bit) of Ubuntu (14.04)，Apple Safari 6.1.6 of Mac OS X Lion 10.7.
(1) WebSite:
google.com
"Google is an American multinational technology company specializing in Internet-related services and products. These include online advertising technologies, search, cloud computing, and software. Most of its profits are derived from AdWords, an online advertising service that places advertising near the list of search results.
The corporation has been estimated to run more than one million servers in data centers around the world (as of 2007). It processes over one billion search requests and about 24 petabytes of user-generated data each day (as of 2009). In December 2013, Alexa listed google.com as the most visited website in the world. Numerous Google sites in other languages figure in the top one hundred, as do several other Google-owned sites such as YouTube and Blogger. Its market dominance has led to prominent media coverage, including criticism of the company over issues such as search neutrality, copyright, censorship, and privacy." (Wikipedia)
(2) Vulnerability Description:
Google web application has a computer cyber security problem. Hacker can exploit it by Covert Redirect attacks.
The vulnerability exists at "Logout?" page with "&continue" parameter, i.e.
The vulnerabilities can be attacked without user login. Tests were performed on Microsoft IE (10.0.9200.16750) of Windows 8, Mozilla Firefox (34.0) & Google Chromium 39.0.2171.65-0 ubuntu0.14.04.1.1064 (64-bit) of Ubuntu (14.04)，Apple Safari 6.1.6 of Mac OS X Lion 10.7.
(2.1) When a user is redirected from Google to another site, Google will check whether the redirected URL belongs to domains in Google's whitelist (The whitelist usually contains websites belong to Google), e.g.
docs.google.com
googleads.g.doubleclick.net
If this is true, the redirection will be allowed.
However, if the URLs in a redirected domain have open URL redirection vulnerabilities themselves, a user could be redirected from Google to a vulnerable URL in that domain first and later be redirected from this vulnerable site to a malicious site. This is as if being redirected from Google directly.
One of the vulnerable domain is,
googleads.g.doubleclick.net (
(2.2) Use one webpage for the following tests. The webpage address is "http://www.inzeed.com/
Vulnerable URL:
POC:
POC Video:
Blog Detail:
http://securityrelated.blogspot.com/2014/11/covert-redirect-vulnerability-based-on.html
(3) What is Covert Redirect?
Covert Redirect is a class of security bugs disclosed in May 2014. It is an application that takes a parameter and redirects a user to the parameter value without sufficient validation. This often makes use of Open Redirect and XSS vulnerabilities in third-party applications.
Covert Redirect is also related to single sign-on. It is known by its influence on OAuth and OpenID. Almost all OAuth 2.0 and OpenID providers worldwide are affected. Covert Redirect was found and dubbed by a Mathematics PhD student Wang Jing from School of Physical and Mathematical Sciences, Nanyang Technological University, Singapore.
After Covert Redirect was published, it is kept in some common databases such as SCIP, OSVDB, Bugtraq, and X-Force. Its scipID is 13185, while OSVDB reference number is 106567. Bugtraq ID: 67196. X-Force reference number is 93031.
After Covert Redirect was published, it is kept in some common databases such as SCIP, OSVDB, Bugtraq, and X-Force. Its scipID is 13185, while OSVDB reference number is 106567. Bugtraq ID: 67196. X-Force reference number is 93031.
Discover and Reporter:
Wang Jing, Division of Mathematical Sciences (MAS), School of Physical and Mathematical Sciences (SPMS), Nanyang Technological University (NTU), Singapore. (@justqdjing)
More Details:
Subscribe to:
Posts (Atom)