Comments on: XSS for Fun and Profit http://michaeldaw.org/papers/paper-290507 Weekly humour Thu, 07 May 2009 20:09:50 +0000 http://wordpress.org/?v= hourly 1 By: David http://michaeldaw.org/papers/paper-290507/comment-page-1#comment-49547 David Thu, 17 Jan 2008 07:14:09 +0000 http://michaeldaw.org/papers/paper-290507/#comment-49547 ups.. :) now i see that this site is support tag () And in my up post i meant code like [] ups.. :) now i see that this site is support tag ()
And in my up post i meant code like
[]

]]> By: David http://michaeldaw.org/papers/paper-290507/comment-page-1#comment-49546 David Thu, 17 Jan 2008 07:06:41 +0000 http://michaeldaw.org/papers/paper-290507/#comment-49546 Hello, guys! I'm very interesting about this article and especially about XSIO - Cross Site Image Overlaying But.. I'v tested many socials networks like myspace, digg, etc and couldn't find such vulns I mean, that wnen I type in comments a code like: I don't see the image in comments. Could some body explain^ may be this bug already fixed everywhere or what I'm making wrong? ---------- Thank's beforehand! Hello, guys!
I’m very interesting about this article and especially about XSIO – Cross Site Image Overlaying
But.. I’v tested many socials networks like myspace, digg, etc and couldn’t find such vulns
I mean, that wnen I type in comments a code like:

I don’t see the image in comments.
Could some body explain^ may be this bug already fixed everywhere or what I’m making wrong?

———-
Thank’s beforehand!

]]> By: kuza55 http://michaeldaw.org/papers/paper-290507/comment-page-1#comment-35215 kuza55 Sat, 02 Jun 2007 13:03:08 +0000 http://michaeldaw.org/papers/paper-290507/#comment-35215 Whoops, my mistake, since you needed to provide a domain initially I assumed (:() that it was tied - I should really start checking all the things I say. But I would still be surprised if it didn't raise a flag somewhere at Google when some code starts getting used on a new site. Whoops, my mistake, since you needed to provide a domain initially I assumed (:() that it was tied – I should really start checking all the things I say.

But I would still be surprised if it didn’t raise a flag somewhere at Google when some code starts getting used on a new site.

]]> By: Ad-Jacking Affiliate Anchor Tags - Operation n http://michaeldaw.org/papers/paper-290507/comment-page-1#comment-34907 Ad-Jacking Affiliate Anchor Tags - Operation n Sat, 02 Jun 2007 00:16:10 +0000 http://michaeldaw.org/papers/paper-290507/#comment-34907 [...] This article is part of my concept Ad-Jacking: XSSing for Fun and Profit. [...] [...] This article is part of my concept Ad-Jacking: XSSing for Fun and Profit. [...]

]]> By: david.kierznowski http://michaeldaw.org/papers/paper-290507/comment-page-1#comment-34414 david.kierznowski Fri, 01 Jun 2007 01:18:25 +0000 http://michaeldaw.org/papers/paper-290507/#comment-34414 Kuza55: Adsense is not domain specific, you can have adsense running on multiple domains, see: http://adsense.blogspot.com/2005/08/from-inside-adsense-mail-bag.html Obviously nonces don't help much when XSS is involved, as we can fetch the nonce from the page and then append the appropriate data. In fact, who cares, most affiliate programmes dont support this and adsense data can be replayed successfully, I have tested this. Whats more, part of ad-jacking is adding our own content including nonces (if any) into a page, effectively ad-jacking it. Kuza55:
Adsense is not domain specific, you can have adsense running on multiple domains, see: http://adsense.blogspot.com/2005/08/from-inside-adsense-mail-bag.html

Obviously nonces don’t help much when XSS is involved, as we can fetch the nonce from the page and then append the appropriate data. In fact, who cares, most affiliate programmes dont support this and adsense data can be replayed successfully, I have tested this. Whats more, part of ad-jacking is adding our own content including nonces (if any) into a page, effectively ad-jacking it.

]]> By: kuza55 http://michaeldaw.org/papers/paper-290507/comment-page-1#comment-34399 kuza55 Fri, 01 Jun 2007 00:40:42 +0000 http://michaeldaw.org/papers/paper-290507/#comment-34399 Ah, alright, I guess I missed your point then. I thought you were talking about smiulating user actions like ad clicks, but I see what you mean now. One thing which Google does is tie the Adsense code to a specific domain, so you'd have to either sign up with a different account for every site, or create an iframe to your domain, and have the ad serving code there, so that its rendered on your domain. But to answer your question; yes it does matter if the ad company is using nonces, because unless we know those nonces we can't simulate user clicks, and can only either hijack clicks (by placing the iframe under the cursor), or by serving the ads and getting CPM money. Ah, alright, I guess I missed your point then. I thought you were talking about smiulating user actions like ad clicks, but I see what you mean now.

One thing which Google does is tie the Adsense code to a specific domain, so you’d have to either sign up with a different account for every site, or create an iframe to your domain, and have the ad serving code there, so that its rendered on your domain.

But to answer your question; yes it does matter if the ad company is using nonces, because unless we know those nonces we can’t simulate user clicks, and can only either hijack clicks (by placing the iframe under the cursor), or by serving the ads and getting CPM money.

]]> By: david.kierznowski http://michaeldaw.org/papers/paper-290507/comment-page-1#comment-33949 david.kierznowski Thu, 31 May 2007 07:11:24 +0000 http://michaeldaw.org/papers/paper-290507/#comment-33949 Mod'ed this comment, it was very sarcastic before :) Kuza55: well this is exactly the kind of thing I'm currently researching. Let me try answer your questions with a question: If we have XSS on the current ad serving page do we really care if they are using nonces? Your comment seems to be driven toward XSSing the Ad Servers.. I am referring more toward an attacker using the XSS vector to spread his/her ad network (i.e. Persistent XSS in forum, reflected XSS in search engine etc) Mod’ed this comment, it was very sarcastic before :)

Kuza55: well this is exactly the kind of thing I’m currently researching. Let me try answer your questions with a question:
If we have XSS on the current ad serving page do we really care if they are using nonces?

Your comment seems to be driven toward XSSing the Ad Servers.. I am referring more toward an attacker using the XSS vector to spread his/her ad network (i.e. Persistent XSS in forum, reflected XSS in search engine etc)

]]> By: kuza55 http://michaeldaw.org/papers/paper-290507/comment-page-1#comment-33943 kuza55 Thu, 31 May 2007 06:57:10 +0000 http://michaeldaw.org/papers/paper-290507/#comment-33943 AFAIK Google and Yahoo (and most likely others) write an iframe to the page, and the iframe contains links with nonces in them, so unless you're talking about XSS Vulns in the ad serving domain (which is highly unlikely since both Google and Yahoo use domains separate from all their other domains for serving ads), then I'm not quite sure where this is going. And if you *are* talking about XSS holes in ad serving domains, well, I don't think that you're going to find any on an ad serving company of any size, with semi-decent web server configurations. AFAIK Google and Yahoo (and most likely others) write an iframe to the page, and the iframe contains links with nonces in them, so unless you’re talking about XSS Vulns in the ad serving domain (which is highly unlikely since both Google and Yahoo use domains separate from all their other domains for serving ads), then I’m not quite sure where this is going.

And if you *are* talking about XSS holes in ad serving domains, well, I don’t think that you’re going to find any on an ad serving company of any size, with semi-decent web server configurations.

]]> By: david.kierznowski http://michaeldaw.org/papers/paper-290507/comment-page-1#comment-33250 david.kierznowski Wed, 30 May 2007 06:42:40 +0000 http://michaeldaw.org/papers/paper-290507/#comment-33250 ntp, think of it as click-fraud on steroids; the direction of this article is to demonstrate snippets of code that attackers can use with the rising of web 2.0. It is no longer about what an attacker can embed in his page, but what an attacker can embed in others web sites with web 2.0 super-worm, propogating with JSON and XSS. We can manipulate and hijack websites current Ad schemes, rewrite pages etc. Click-fraud is obsolete :) ntp, think of it as click-fraud on steroids; the direction of this article is to demonstrate snippets of code that attackers can use with the rising of web 2.0. It is no longer about what an attacker can embed in his page, but what an attacker can embed in others web sites with web 2.0 super-worm, propogating with JSON and XSS. We can manipulate and hijack websites current Ad schemes, rewrite pages etc. Click-fraud is obsolete :)

]]> By: ntp http://michaeldaw.org/papers/paper-290507/comment-page-1#comment-33206 ntp Wed, 30 May 2007 02:21:37 +0000 http://michaeldaw.org/papers/paper-290507/#comment-33206 click-fraud? click-fraud?

]]>