1
00:00:00,000 --> 00:00:06,100
I guess what can I say about this next presenter that we have?

2
00:00:06,420 --> 00:00:13,540
But all I know is, you know, having been in the community, I've heard of Brute Logic.

3
00:00:13,660 --> 00:00:15,060
I've heard the name for a long time.

4
00:00:15,480 --> 00:00:27,040
And I have to say, we are very delighted, and it's about time that we finally have Brute Logic come and present here at the Pack Attacking Village here at DEF CON.

5
00:00:27,040 --> 00:00:35,580
So, Brute Logic's name is, I mean, if you look up cross-site scripting, Brute Logic is synonymous, name is synonymous.

6
00:00:36,880 --> 00:00:40,120
And before I begin, I do want to make a personal rag.

7
00:00:40,320 --> 00:00:46,540
We still have no idea why in the world you use Cristiano Ronaldo in your title slide.

8
00:00:47,180 --> 00:00:49,020
Without much ado, Brute Logic!

9
00:00:51,460 --> 00:00:52,560
Thank you, thank you.

10
00:00:55,660 --> 00:00:56,840
So, hi, everyone.

11
00:00:57,620 --> 00:00:58,660
Sounds good?

12
00:00:58,840 --> 00:00:59,380
Okay.

13
00:00:59,900 --> 00:01:00,500
Hi, everyone.

14
00:01:01,940 --> 00:01:07,560
I am Rodolfo Assis from Brazil, better known as Brute Logic.

15
00:01:08,100 --> 00:01:15,120
And we are going to see what can be done with it for the win.

16
00:01:18,720 --> 00:01:21,680
So, I'm working at Sucuri Security.

17
00:01:22,160 --> 00:01:24,080
Guys there, please.

18
00:01:25,900 --> 00:01:27,020
Which is...

19
00:01:27,040 --> 00:01:29,460
GoDaddy company for the win, also.

20
00:01:30,260 --> 00:01:36,460
And I do some cross-site scripting, filter bypass, and some bash stuff.

21
00:01:37,740 --> 00:01:50,580
I help it to fix some vulnerabilities out there, but you won't see me in any of our fans, except the Microsoft one, because who is not there, right?

22
00:01:53,160 --> 00:01:56,300
And I have an online access, too.

23
00:01:56,300 --> 00:01:56,320
If I switch it on, you all see that you are going to see a video.

24
00:01:56,320 --> 00:01:57,580
So, this is the beginning of the Sucuri Security tool, and discovery service.

25
00:02:00,840 --> 00:02:09,300
Okay, this is going to be a fast-paced talk, about the dangers of XSS, with a little

26
00:02:10,320 --> 00:02:12,900
intro to it, for those who don't know it.

27
00:02:16,280 --> 00:02:20,020
So we are going here on the ELPAR, and so I'm going to introduce you to a test patch,

28
00:02:20,480 --> 00:02:21,640
which is called the XSS package.

29
00:02:21,880 --> 00:02:26,280
And the fact that it's already a standard Tutorial, so in fact, I'm not going to give you

30
00:02:26,280 --> 00:02:33,900
model of the document in order to display it so we can use JavaScript to

31
00:02:33,900 --> 00:02:46,940
to do almost everything in browser here is a classical example of PHP code we

32
00:02:46,940 --> 00:02:57,900
have a variable user which is printed back to the screen then we have the

33
00:02:57,900 --> 00:03:09,740
input job but we could change the input for an XSS vector we got this pop-up

34
00:03:09,740 --> 00:03:14,200
which is a proof of concept of the cross-site script

35
00:03:16,940 --> 00:03:24,200
okay we have too many too many types you know server-based which can be

36
00:03:24,200 --> 00:03:32,160
reflected or stored and client-based after the code get processed by the

37
00:03:32,160 --> 00:03:43,520
JavaScript engine in the browser okay so after after it we can't simply keep

38
00:03:43,520 --> 00:03:46,360
popping out it's you know we have to do something

39
00:03:46,360 --> 00:03:46,920
we have to do something we have to do something we have to do something we

40
00:03:46,920 --> 00:03:57,980
fit we have visual defacement what is that it's a way to to to change the look

41
00:03:57,980 --> 00:04:06,020
of the page and this might impact some business decision for example like buying

42
00:04:06,020 --> 00:04:14,500
selling of stocks or bitcoins here is a simple code which don't really use

43
00:04:14,500 --> 00:04:16,900
JavaScript it's just an HTML code

44
00:04:16,900 --> 00:04:26,360
HTML code to change the change the page with a picture and here is more more

45
00:04:26,360 --> 00:04:33,640
complex one it was a kind of a joke which I ordered the headline of the

46
00:04:33,640 --> 00:04:43,420
this website with this code we have an iframe and then because the cross-site

47
00:04:43,420 --> 00:04:46,740
scripting is on a search feature of the site

48
00:04:46,740 --> 00:04:53,520
we have to call the the page first use this source and then we make some

49
00:04:53,520 --> 00:04:58,220
stylish over it and finally with the all load event handler

50
00:04:58,520 --> 00:05:03,360
we are able to use the JavaScript to change the headline

51
00:05:06,960 --> 00:05:08,080
there's another one

52
00:05:11,720 --> 00:05:16,380
we can't access everything inside the

53
00:05:16,380 --> 00:05:16,640
page

54
00:05:16,740 --> 00:05:22,860
with JavaScript. So we can grab personal information like credit card, social

55
00:05:22,860 --> 00:05:31,460
security number, or phone number, address. We are able also to log what victim is

56
00:05:31,460 --> 00:05:42,060
typing and we can also, we can also fake, build a fake login form to grab

57
00:05:42,060 --> 00:05:49,840
credentials. Here is the code of the keylogger. We have two, two files. The PHP

58
00:05:49,840 --> 00:05:59,820
one is for log. It opens a file and writes on it. And the GS one, it's the one

59
00:05:59,820 --> 00:06:10,780
that, that takes the what the victim press, the keys, and send to the PHP file. Here

60
00:06:10,780 --> 00:06:11,760
is a GIF showing

61
00:06:11,760 --> 00:06:12,040
a GIF showing

62
00:06:12,060 --> 00:06:22,560
this in action. I'm typing this at this side. And the other side, the file is being updated.

63
00:06:28,180 --> 00:06:41,760
Okay, account stealing. We can steal cookies, you know. But now, usually, we, we will face

64
00:06:41,760 --> 00:06:51,820
HTTP one, HTTP one flagged ones. So, but we can still compromise the account using

65
00:06:52,900 --> 00:07:04,940
password change, or email change, functionality, which are unprotected. Like, so, okay. Here

66
00:07:04,940 --> 00:07:11,740
is a code, short JavaScript code to still cook, a simple one. And here is, now, we have

67
00:07:11,740 --> 00:07:22,800
an example of the unprotected password change. In WordPress.com. Okay. Memory corruption.

68
00:07:27,080 --> 00:07:36,000
Thanks to the guys at MatterSploit, it's easy to, to allow some exploits against the

69
00:07:36,000 --> 00:07:36,620
browser victim.

70
00:07:40,200 --> 00:07:41,720
Here is the, the code. And then now, if you're using some kind of a background, if you're

71
00:07:41,720 --> 00:07:45,380
metasploit-based. It's called a browser-autopal.

72
00:07:46,460 --> 00:07:49,220
There is the first and the second version

73
00:07:51,520 --> 00:07:52,320
which will

74
00:07:52,320 --> 00:07:58,060
launch memory exploits, memory based exploits against the browser.

75
00:07:59,300 --> 00:08:01,520
To do that we don't, we only

76
00:08:01,520 --> 00:08:05,000
need to call an image with a source of the

77
00:08:05,000 --> 00:08:10,820
attacker domain. XSS-WAR.

78
00:08:16,540 --> 00:08:18,720
Like any worm, we can

79
00:08:18,720 --> 00:08:23,320
simply spread it across the database and

80
00:08:23,320 --> 00:08:27,260
try to compromise all the accounts of the social network.

81
00:08:29,820 --> 00:08:31,780
And probably the admins also.

82
00:08:33,480 --> 00:08:34,860
Here is an experiment

83
00:08:39,700 --> 00:08:40,800
of an experiment

84
00:08:40,820 --> 00:08:44,760
of XSS-WAR in action. You guys can watch it later.

85
00:08:49,520 --> 00:08:50,140
CMS.

86
00:08:52,040 --> 00:08:53,420
We have a guy here,

87
00:08:53,560 --> 00:08:59,600
expert in CMS, Mark. We can use XSS

88
00:08:59,600 --> 00:09:03,580
to achieve code execution

89
00:09:04,240 --> 00:09:07,460
at the CMS install.

90
00:09:09,240 --> 00:09:10,680
We just need to get

91
00:09:10,820 --> 00:09:15,060
the anti-cSER sage token and submit it.

92
00:09:18,100 --> 00:09:23,580
Wordpress is by far the most-used CMS nowadays.

93
00:09:24,820 --> 00:09:27,040
In my blog I have code for all three,

94
00:09:27,180 --> 00:09:29,260
Wordpress, Joomla and Drupal.

95
00:09:30,100 --> 00:09:32,600
You are going to see now the Wordpress one,

96
00:09:32,800 --> 00:09:36,260
the code to, to make an XSS becomes code

97
00:09:36,260 --> 00:09:38,040
execution, code execution the website.

98
00:09:38,040 --> 00:09:51,700
we are using hello dolly plugin and then we start defining some variables the path

99
00:09:51,700 --> 00:10:00,420
the file and the payload which will be a reverse shell use we are using netcat to

100
00:10:00,420 --> 00:10:17,380
get a reverse shell we take the surf token with the first request the dollar variable

101
00:10:17,380 --> 00:10:28,980
is the post body that will be used here and finally we find the request to to make the

102
00:10:28,980 --> 00:10:30,280
PHP code

103
00:10:31,060 --> 00:10:45,940
execute and open the netcat listing here's the gift showing admin is open the the post

104
00:10:45,940 --> 00:10:50,640
tube preview and then the shell is open the other side

105
00:10:55,900 --> 00:10:59,940
we have a less dangerous outcome

106
00:11:00,420 --> 00:11:03,820
with, like, forced download of files,

107
00:11:06,120 --> 00:11:07,760
denial of service, and

108
00:11:08,880 --> 00:11:11,960
we can also get some geolocation

109
00:11:11,960 --> 00:11:14,140
or audio-video capture,

110
00:11:17,040 --> 00:11:19,640
but with permission of the victim.

111
00:11:22,160 --> 00:11:23,500
It's very easy to

112
00:11:24,160 --> 00:11:28,500
deliver XSS, because we can share in social networks,

113
00:11:28,500 --> 00:11:31,180
we can disguise it with

114
00:11:31,180 --> 00:11:35,720
URL shortened services, and we also have

115
00:11:35,720 --> 00:11:38,580
spam, spear phishing, and waterhole techniques

116
00:11:38,580 --> 00:11:42,140
to help the attacker or the test.

117
00:11:44,820 --> 00:11:46,500
Here are some references

118
00:11:47,460 --> 00:11:50,860
of my blog and my YouTube channel,

119
00:11:52,280 --> 00:11:54,220
so you guys can check later.

120
00:11:54,220 --> 00:11:56,920
And here is a reminder,

121
00:11:58,080 --> 00:12:02,200
if you are not convinced yet of how much

122
00:12:02,200 --> 00:12:04,560
dangerous can be an XSS attack.

123
00:12:09,860 --> 00:12:12,000
Okay, any questions?

124
00:12:28,060 --> 00:12:29,020
Which one?

125
00:12:31,980 --> 00:12:32,720
Okay.

126
00:12:33,460 --> 00:12:36,660
The slides will be online, probably today.

127
00:12:38,220 --> 00:12:38,960
Okay.

128
00:12:45,480 --> 00:12:49,860
The worst thing?

129
00:12:56,060 --> 00:12:56,700
Uh...

130
00:12:58,360 --> 00:13:01,920
We can execute code in the website,

131
00:13:02,240 --> 00:13:05,860
you know, if you know how to

132
00:13:05,860 --> 00:13:09,780
make the request, and if the admin

133
00:13:09,780 --> 00:13:13,380
is XSS with it, with the link of the page,

134
00:13:13,540 --> 00:13:15,180
with the XSS.

135
00:13:18,360 --> 00:13:19,340
How do you...

136
00:13:21,280 --> 00:13:25,220
I usually use separate browsers

137
00:13:26,220 --> 00:13:27,560
for each thing.

138
00:13:27,780 --> 00:13:29,640
So my blog, for example,

139
00:13:29,760 --> 00:13:31,680
I use another browser just for it,

140
00:13:31,800 --> 00:13:34,160
just to make the update,

141
00:13:34,420 --> 00:13:35,640
just to access the dashboard,

142
00:13:35,960 --> 00:13:38,400
and I use another one to navigate,

143
00:13:39,360 --> 00:13:43,520
so XSS has to be found in the same browser.

144
00:13:43,840 --> 00:13:44,860
It can...

145
00:13:44,860 --> 00:13:45,160
It can be found in the same browser.

146
00:13:45,180 --> 00:13:47,200
I can't be XSS

147
00:13:47,200 --> 00:13:49,300
in my blog if I don't

148
00:13:49,300 --> 00:13:50,880
use that browser to

149
00:13:50,880 --> 00:13:52,980
navigate, to open links,

150
00:13:53,120 --> 00:13:53,760
malicious links.

151
00:13:54,540 --> 00:13:55,100
Okay?

152
00:14:00,320 --> 00:14:03,080
A user has to rely on

153
00:14:03,080 --> 00:14:03,560
uh...

154
00:14:03,560 --> 00:14:06,700
the browser

155
00:14:06,700 --> 00:14:08,760
filter, for example,

156
00:14:08,880 --> 00:14:10,500
Chrome, or

157
00:14:10,980 --> 00:14:12,320
it has to rely on

158
00:14:12,320 --> 00:14:14,540
simply not click on links,

159
00:14:15,180 --> 00:14:16,360
that comes to your inbox,

160
00:14:17,300 --> 00:14:18,140
and

161
00:14:18,800 --> 00:14:20,640
that kind of security measures

162
00:14:20,840 --> 00:14:22,100
everyone has to...

163
00:14:22,100 --> 00:14:23,180
to take.

164
00:14:24,960 --> 00:14:25,800
Okay?

165
00:14:27,100 --> 00:14:27,940
Yeah?

166
00:14:39,260 --> 00:14:41,140
A plug-in?

167
00:14:41,340 --> 00:14:42,660
Browser plug-in?

168
00:14:49,940 --> 00:14:51,720
You mean the, uh,

169
00:14:52,060 --> 00:14:52,160
a, uh,

170
00:14:52,160 --> 00:14:53,800
an XSS vector to use?

171
00:14:54,280 --> 00:14:54,660
No,

172
00:14:54,800 --> 00:14:56,040
for the user side.

173
00:14:56,060 --> 00:14:57,020
User side?

174
00:14:57,500 --> 00:14:57,620
Yeah,

175
00:14:57,660 --> 00:14:58,580
but we're worried that

176
00:14:58,580 --> 00:15:01,220
it requires...

177
00:15:02,220 --> 00:15:04,560
No, no, not yet.

178
00:15:04,740 --> 00:15:05,740
I don't have one.

179
00:15:11,200 --> 00:15:11,800
Anyone?

180
00:15:11,820 --> 00:15:12,380
Anyone else?

181
00:15:13,120 --> 00:15:15,080
Anyone else going once?

182
00:15:15,180 --> 00:15:16,560
Going twice

183
00:15:18,380 --> 00:15:19,900
Ladies and gentlemen, one more time

184
00:15:19,900 --> 00:15:21,180
Food logic

185
00:15:21,760 --> 00:15:22,400
Thank you