Imagining I want to develop a website to intentionally harm its visitors, what kind of attacks can I do ? I figure a typical CSRF attack would work, but could I steal cookies from another website that isn't mine? What else could I do?

I'm developing a system that allows third-party html/javascript code and I need to prevent any exploits I can. Google Caja and similar systems aren't really relevant in my case, I think, since there is no host and guest code on the same page, only guest code.

  • 1
    Ideally, you'd write a 0-day drive by vulnerability, allowing you to compromise anyone who visits. At that point, you can do pretty much anything, up to and including installing a root kit. However, this is generally beyond most programmers ability, meaning that the question is a bit too broad. What would you consider harm? Would flashing the screen to potentially cause seizures in photo-sensitive epileptics count? Popping up a really annoying advert? Playing "Never Gonna Give You Up" on a loop? – Matthew Jan 26 '17 at 15:04
  • All those examples given would be "harm" with varying degrees of gravity.The possibility you gave of installing a root kit spiked my interest, but something like messing with your filesystem or launching a process, as far as i know, isn't possible since the built-in browser sandbox protects you from that, is this correct? – André Lopes Jan 26 '17 at 15:23
  • 1
    In theory, yes, but there are almost always flaws in these things. There might be a specific tiny element within an image processing library which allows arbitrary memory read, and another method whereby making a specific series of calls allows arbitrary memory write, and if someone joins those points, they've got control of the system. Browsers are really complicated bits of software, which have to deal with lots of edge cases, so it's almost inevitable that there are mistakes in implementations. Read en.wikipedia.org/wiki/Drive-by_download for a few more details. – Matthew Jan 26 '17 at 15:30
  • Are you limiting yourself to Javascript-based exploits, or is any attacker-controller data delivered to the browser fair game? Your second paragraph seems to imply that you are only interested in Javascript and HTML, but do note that both of those can be used to pull in arbitrary data from elsewhere. – a CVn Jan 26 '17 at 16:14
  • @Matthew Thank you for the helpful information, looks like I have a huge amount of possibilities regarding this issue. Currently I'm only concerned with javascript/HTML exploits as I'm now studying what I need to do to provide my platform with a secure way to execute foreign html/js. – André Lopes Jan 26 '17 at 17:39

Javascript is an engine executing code client side. If you allow third party uncontrolled javascript in your site, that means that potentially visitors of your site may execute arbitrary code in your browser.

Damages can come at various levels:

  • simplest and lightest: simply play with the browser. As an example start a background loop that repeadetly shows popups
  • slightly more advanced: remove the browser menu and intercept the close event to prevent user to simply close the application to get rid of the popups
  • still one step further, play with the stored browser config by changing shortcuts or favorites to call an infected page
  • hardest but more harmfull: use flaws of browsers to escape from the browser sandbox and directly access the underlying system

Depending on the system, the browser and their configurations, some of those attacks will not be possible. But even the lightest one, the background loop that continuously open popups is extremely annoying for a user, and you can be sure that he/she will never come again to your site.

  • Thank you! I've never thought on changing the favorites to link an attacker's owned website (possibly with a XSS'd link). Very clever. – André Lopes Jan 28 '17 at 16:51

Generally speaking, I think your best bet is to install Kali linux on VM and test your website and webserver for vulnerabilities. If you patch it up enough to make Kali testing negative, you'll be safe against the majority of potential hacking.

Having a closer look into Nikto web scanner and then perhaps using the Kali arsenal to make sure there are no holes left, should suffice basic needs. However, know that there will always be a hole somewhere, perhaps unnoticed by most, that Mr. Robot could exploit at some point. :-)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.