0

A victim has two tabs open. One tab has an HTTPS site and one tab has HTTP site. What are the ways to attack HTTPS (https://www.example.com) site from HTTP site (http://somerandomdomain.com)?

Here is the one way that I think HTTPS site can be attacked:

If the HTTPS site is not using 'secure' attribute for its cookies, then including an <img src='http://www.example.com/someimage.png'> in http://somerandomdomain.com through MitM makes browser to send example.com's cookie in plain-text.

Any other attacks possible here?

Improve this question
1
  • if it doesn't have secure cookies and doesn't have HSTS set (or you can 'DeLorean' the browser's time, but that's more than just an HTTP page)
    – dave_thompson_085
    Jan 31, 2019 at 3:23

1 Answer 1

Reset to default
1

Most cross-site web app vulns can be exploited from an HTTP page, even against HTTPS pages. This includes XSS, CSRF, clickjacking ("mixed content" blocking usually prevents hosting insecure content in a secure parent, not the other way around), Rosetta Flash (JSONP reflection attack), and so on.

Some attacks against TLS and especially HTTPS also require the victim to visit a HTTP site while signed into the target HTTPS site. For example, the weaknesses in SSL3's handling of CBC-mode ciphers (POODLE attack), RC4 bias attacks, compression-related attacks such as BREACH and CRIME, and probably some other attacks all require that the attacker run a script on the victim's browser that programmatically makes thousands of customized requests - typically cross-domain, and often though not always originating on an HTTP origin - to the vulnerable HTTPS site.

Improve this answer
3
  • When you say most cross-site web app vulns can be exploited, you mean they can be exploited the same way I gave in the example? Through MITM? Say an MITM can inject a script in somerandomdomain and if example.com has XSS, then it gets executed?
    – Illusion
    Feb 1, 2019 at 4:20
  • Yes, either through MitM or if you control the content on the HTTP server (with HTTP, MitM is basically equivalent to controlling the server in terms of what content the client gets). The web attacks (aside from cookie planting, like you mentioned) only require controlling the content. The TLS attacks mostly will require MitM, or at least being able to both control the content and monitor the network traffic.
    – CBHacking
    Feb 1, 2019 at 7:12
  • Awesome, thanks for the detailed explanation! Appreciate it!
    – Illusion
    Feb 1, 2019 at 17:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .