I guess what can I say about this next presenter that we have?
But all I know is, you know, having been in the community, I've heard of Brute Logic.
I've heard the name for a long time.
And I have to say, we are very delighted, and it's about time that we finally have Brute Logic come and present here at the Pack Attacking Village here at DEF CON.
So, Brute Logic's name is, I mean, if you look up cross-site scripting, Brute Logic is synonymous, name is synonymous.
And before I begin, I do want to make a personal rag.
We still have no idea why in the world you use Cristiano Ronaldo in your title slide.
Without much ado, Brute Logic!
Thank you, thank you.
So, hi, everyone.
Sounds good?
Okay.
Hi, everyone.
I am Rodolfo Assis from Brazil, better known as Brute Logic.
And we are going to see what can be done with it for the win.
So, I'm working at Sucuri Security.
Guys there, please.
Which is...
GoDaddy company for the win, also.
And I do some cross-site scripting, filter bypass, and some bash stuff.
I help it to fix some vulnerabilities out there, but you won't see me in any of our fans, except the Microsoft one, because who is not there, right?
And I have an online access, too.
If I switch it on, you all see that you are going to see a video.
So, this is the beginning of the Sucuri Security tool, and discovery service.
Okay, this is going to be a fast-paced talk, about the dangers of XSS, with a little
intro to it, for those who don't know it.
So we are going here on the ELPAR, and so I'm going to introduce you to a test patch,
which is called the XSS package.
And the fact that it's already a standard Tutorial, so in fact, I'm not going to give you
model of the document in order to display it so we can use JavaScript to
to do almost everything in browser here is a classical example of PHP code we
have a variable user which is printed back to the screen then we have the
input job but we could change the input for an XSS vector we got this pop-up
which is a proof of concept of the cross-site script
okay we have too many too many types you know server-based which can be
reflected or stored and client-based after the code get processed by the
JavaScript engine in the browser okay so after after it we can't simply keep
popping out it's you know we have to do something
we have to do something we have to do something we have to do something we
fit we have visual defacement what is that it's a way to to to change the look
of the page and this might impact some business decision for example like buying
selling of stocks or bitcoins here is a simple code which don't really use
JavaScript it's just an HTML code
HTML code to change the change the page with a picture and here is more more
complex one it was a kind of a joke which I ordered the headline of the
this website with this code we have an iframe and then because the cross-site
scripting is on a search feature of the site
we have to call the the page first use this source and then we make some
stylish over it and finally with the all load event handler
we are able to use the JavaScript to change the headline
there's another one
we can't access everything inside the
page
with JavaScript. So we can grab personal information like credit card, social
security number, or phone number, address. We are able also to log what victim is
typing and we can also, we can also fake, build a fake login form to grab
credentials. Here is the code of the keylogger. We have two, two files. The PHP
one is for log. It opens a file and writes on it. And the GS one, it's the one
that, that takes the what the victim press, the keys, and send to the PHP file. Here
is a GIF showing
a GIF showing
this in action. I'm typing this at this side. And the other side, the file is being updated.
Okay, account stealing. We can steal cookies, you know. But now, usually, we, we will face
HTTP one, HTTP one flagged ones. So, but we can still compromise the account using
password change, or email change, functionality, which are unprotected. Like, so, okay. Here
is a code, short JavaScript code to still cook, a simple one. And here is, now, we have
an example of the unprotected password change. In WordPress.com. Okay. Memory corruption.
Thanks to the guys at MatterSploit, it's easy to, to allow some exploits against the
browser victim.
Here is the, the code. And then now, if you're using some kind of a background, if you're
metasploit-based. It's called a browser-autopal.
There is the first and the second version
which will
launch memory exploits, memory based exploits against the browser.
To do that we don't, we only
need to call an image with a source of the
attacker domain. XSS-WAR.
Like any worm, we can
simply spread it across the database and
try to compromise all the accounts of the social network.
And probably the admins also.
Here is an experiment
of an experiment
of XSS-WAR in action. You guys can watch it later.
CMS.
We have a guy here,
expert in CMS, Mark. We can use XSS
to achieve code execution
at the CMS install.
We just need to get
the anti-cSER sage token and submit it.
Wordpress is by far the most-used CMS nowadays.
In my blog I have code for all three,
Wordpress, Joomla and Drupal.
You are going to see now the Wordpress one,
the code to, to make an XSS becomes code
execution, code execution the website.
we are using hello dolly plugin and then we start defining some variables the path
the file and the payload which will be a reverse shell use we are using netcat to
get a reverse shell we take the surf token with the first request the dollar variable
is the post body that will be used here and finally we find the request to to make the
PHP code
execute and open the netcat listing here's the gift showing admin is open the the post
tube preview and then the shell is open the other side
we have a less dangerous outcome
with, like, forced download of files,
denial of service, and
we can also get some geolocation
or audio-video capture,
but with permission of the victim.
It's very easy to
deliver XSS, because we can share in social networks,
we can disguise it with
URL shortened services, and we also have
spam, spear phishing, and waterhole techniques
to help the attacker or the test.
Here are some references
of my blog and my YouTube channel,
so you guys can check later.
And here is a reminder,
if you are not convinced yet of how much
dangerous can be an XSS attack.
Okay, any questions?
Which one?
Okay.
The slides will be online, probably today.
Okay.
The worst thing?
Uh...
We can execute code in the website,
you know, if you know how to
make the request, and if the admin
is XSS with it, with the link of the page,
with the XSS.
How do you...
I usually use separate browsers
for each thing.
So my blog, for example,
I use another browser just for it,
just to make the update,
just to access the dashboard,
and I use another one to navigate,
so XSS has to be found in the same browser.
It can...
It can be found in the same browser.
I can't be XSS
in my blog if I don't
use that browser to
navigate, to open links,
malicious links.
Okay?
A user has to rely on
uh...
the browser
filter, for example,
Chrome, or
it has to rely on
simply not click on links,
that comes to your inbox,
and
that kind of security measures
everyone has to...
to take.
Okay?
Yeah?
A plug-in?
Browser plug-in?
You mean the, uh,
a, uh,
an XSS vector to use?
No,
for the user side.
User side?
Yeah,
but we're worried that
it requires...
No, no, not yet.
I don't have one.
Anyone?
Anyone else?
Anyone else going once?
Going twice
Ladies and gentlemen, one more time
Food logic
Thank you