Learn, hack!

URL

https://media.blackhat.com/bh-us-10/presentations/Shah/BlackHat-USA-2010-Shah-DOM-Hacks-Shreeraj-slides.pdf

File name

BlackHat-USA-2010-Shah-DOM-Hacks-Shreeraj-slides.pdf

File size

825.9 KB

MD5

d8b837abce1cf777e4d1a8838a421f78

SHA1

2eb52d29e2a277de83eb393ea42b47379196f735

Web 2.0 applications are using dynamic DOM manipulations extensively for presenting JSON or XML streams in the browser. These DOM calls mixed with XMLHttpRequest (XHR) object are part of client side logic written in JavaScript or part of any other client side technology be it Flash or Silverlight. DOM driven XSS is a sleeping giant in the application code and it can be exploited by an attacker to gain access to the end user’s browser/desktop. This can become a root cause of following set of interesting vulnerabilities – Cross Widget Sniffing, RSS feed reader exploitation, XHR response stealing, Mashup hacking, Malicious code injection, Spreading Worm etc. This set of vulnerability needs innovative way of scanning the application and corresponding methodology needs to be tweaked. We have seen DOM driven XSS exploited in various different popular portals to spread worm or virus. This is a significant threat on the rise and should be mitigated by validating un-trusted content poisoning Ajax or Flash routines. DOM driven XSS, Cross Domain Bypass and CSRF can cause a deadly cocktail to exploit Web 2.0 applications across Internet. This presentation will be covering following important issues and concepts.