wtorek, 3 lutego 2015

evercookie.swf - Stored Cross-Site Scripting

Today @samykamkar released new version of evercookie that fixes Stored Cross-Site Scripting issue that I reported. Here is how it works in details.

First of all - we should check vulnerable code: evercookie.as

So - the flash file takes flashVar parameter everdata and puts it to SharedObject (something like Local Storege but for Flash). If some data already was in SharedObject - it pass its value to javascript function called _evercookie_flash_var() without any checks. So the proof of concepts for this version looks simple:

http://vulnerable-hostname/evercookie.swf?everdata=f');alert('XSS');// 

After visiting this and then visiting page that embeds evercookie.swf - we'll see wonderful alert box ;-) and the best part - it's stored one.

Few weeks ago someone made pull request for fixing some issues (not security related) with QQBrowser and simply replaced getURL() function with ExternalIterface.call(). So - someone accidentally fixed old bug and created new one ;-) Here's the code: evercookie2.as

+ 2nd PoC:

http://vulnerable-hostname/evercookie.swf?everdata=f\\"))}catch(e){}alert(1);//

...and life goes on. :)

If you're using evercookie - please update to newest version. You can also check the video demonstration: https://www.youtube.com/watch?v=kWAiV6Bjm2s


68 komentarzy:

  1. This is most informative and also this post most user friendly and super navigation to all posts... Thank you so much for giving this information to me.
    rpa training in chennai
    rpa training in bangalore
    rpa course in bangalore
    best rpa training in bangalore
    rpa online training

    OdpowiedzUsuń
  2. Well researched article and I appreciate this. The blog is subscribed and will see new topics soon.
    python course in pune
    python course in chennai
    python course in Bangalore

    OdpowiedzUsuń
  3. I am really impressed with your efforts and really pleased to visit this post.
    python course in pune
    python course in chennai
    python course in Bangalore

    OdpowiedzUsuń
  4. Thanks you for sharing this unique useful information content with us. Really awesome work. keep on blogging
    Online DevOps Certification Course - Gangboard
    Best Devops Training institute in Chennai

    OdpowiedzUsuń
  5. Hmm, it seems like your site ate my first comment (it was extremely long) so I guess I’ll just sum it up what I had written and say, I’m thoroughly enjoying your blog. I as well as an aspiring blog writer, but I’m still new to the whole thing. Do you have any recommendations for newbie blog writers? I’d appreciate it.
    Advanced AWS Course Interview Questions And Answers, Top 250+AWS Jobs Interviews Questions and Answers 2018
    Advanced AWS Jobs Interview questions and answers |Best Top 110 AWS Interview Question and Answers – india

    OdpowiedzUsuń
  6. Hmm, it seems like your site ate my first comment (it was extremely long) so I guess I’ll just sum it up what I had written and say, I’m thoroughly enjoying your blog. I as well as an aspiring blog writer, but I’m still new to the whole thing. Do you have any recommendations for newbie blog writers? I’d appreciate it.
    Advanced AWS Course Interview Questions And Answers, Top 250+AWS Jobs Interviews Questions and Answers 2018
    Advanced AWS Jobs Interview questions and answers |Best Top 110 AWS Interview Question and Answers – india

    OdpowiedzUsuń
  7. Some us know all relating to the compelling medium you present powerful steps on this blog and therefore strongly encourage
    contribution from other ones on this subject while our own child is truly discovering a great deal.
    Have fun with the remaining portion of the year.

    Selenium training in bangalore | best selenium training in bangalore

    OdpowiedzUsuń
  8. I think this is the best article today about the future technology. Thanks for taking your own time to discuss this topic, I feel happy about that curiosity has increased to learn more about this topic.Artificial Intelligence Training in Bangalore. Keep sharing your information regularly for my future reference.

    OdpowiedzUsuń
  9. I ReGreat For Your Information The Information U have Shared Is Fabulous And Interesting So Please keep Updating Us The Information Shared Is Very Valuable Time Just Went On Reading The Article Python Online Course AWS Online Course Data Science Online Course Hadoop Online Course

    OdpowiedzUsuń
  10. Thanks for sharing valuable information. Your blogs were helpful to Azure learners. I request to update the blog through step-by-step. Also, find the Azure news at
    Such an ideal piece of blog. It’s quite interesting to read content like this. I appreciate your blog
    Data Science Course

    OdpowiedzUsuń
  11. simply superb, mind-blowing, I will share your blog to my friends also
    I like your blog, I read this blog please update more content on hacking,Nice post
    Tableau online Training

    Android Training

    Dot net Course

    iOS development course

    OdpowiedzUsuń
  12. very informative blog and useful article thank you for sharing with us , keep posting learn more about aws with cloud computing
    AWS Online Training

    OdpowiedzUsuń
  13. A bewildering web journal I visit this blog, it's unfathomably heavenly. Oddly, in this present blog's substance made purpose of actuality and reasonable. The substance of data is informative
    Oracle Fusion Financials Online Training
    Oracle Fusion HCM Online Training
    Oracle Fusion SCM Online Training

    OdpowiedzUsuń
  14. A bewildering web journal I visit this blog, it's unfathomably heavenly. Oddly, in this present blog's substance made purpose of actuality and reasonable. The substance of data is informative
    Oracle Fusion Financials Online Training
    Oracle Fusion HCM Online Training
    Oracle Fusion SCM Online Training

    OdpowiedzUsuń
  15. A bewildering web journal I visit this blog, it's unfathomably heavenly. Oddly, in this present blog's substance made purpose of actuality and reasonable. The substance of data is informative
    Oracle Fusion Financials Online Training
    Oracle Fusion HCM Online Training
    Oracle Fusion SCM Online Training

    OdpowiedzUsuń
  16. Thanks for sharing valuable article having good information and also gain worth-full knowledge.


    Oracle ICS Online Training

    OdpowiedzUsuń
  17. Thank you for sharing your awesome and valuable article this is the best blog for the students they can also learn.

    Workday Online Training

    OdpowiedzUsuń
  18. A befuddling web diary I visit this blog, it's incredibly grand. Strangely, in this present blog's substance made motivation behind fact and sensible. The substance of information is instructive
    Oracle Fusion Financials Online Training
    Oracle Fusion HCM Online Training
    Oracle Fusion SCM Online Training

    OdpowiedzUsuń
  19. Really appreciate this wonderful post that you have provided for us.Great site and a great topic as well i really get amazed to read this. Its really good.
    data science course malaysia

    OdpowiedzUsuń
  20. Very informative post and you are obviously very knowledgeable in this field. Very useful and solid content. Thanks for sharing

    ExcelR Data Science in Bangalore

    OdpowiedzUsuń
  21. I feel very grateful that I read this. It is very helpful and very informative and I really learned a lot from it.
    date analytics certification training courses

    OdpowiedzUsuń
  22. Attend The Python training in bangalore From ExcelR. Practical Python training in bangalore Sessions With Assured Placement Support From Experienced Faculty. ExcelR Offers The Python training in bangalore.
    python training in bangalore

    OdpowiedzUsuń












  23. It has fully emerged to crown Singapore's southern shores and undoubtedly placed her on the global map of residential landmarks. I still scored the more points than I ever have in a season for GS. I think you would be hard pressed to find somebody with the same consistency I have had over the years so I am happy with that.

    BIG DATA COURSE MALAYSIA

    OdpowiedzUsuń
  24. I would recommend my profile is important to me, I invite you to discuss this topic...
    Data Science Course in Pune

    OdpowiedzUsuń
  25. I am looking for and I love to post a comment that "The content of your post is awesome" Great work!





    Big Data Course

    OdpowiedzUsuń
  26. I finally found great post here.I will get back here. I just added your blog to my bookmark sites. thanks.Quality posts is the crucial to invite the visitors to visit the web page, that's what this web page is providing.data science course in dubai

    OdpowiedzUsuń
  27. I just got to this amazing site not long ago. I was actually captured with the piece of resources you have got here. Big thumbs up for making such wonderful blog page!data science course in dubai

    OdpowiedzUsuń

  28. Great Article. This Blog Contain Good information about ERP Software. Thanks For sharing this blog. Can you please do more articles like this blog.


    machine maintenance software price in us
    machine maintenance software development in us
    crm software development cost in us
    erp in chennai
    crm software development cost in chennai
    cloud erp in chennai

    OdpowiedzUsuń
  29. Attend The Python Training in Bangalore From ExcelR. Practical Python Training in Bangalore Sessions With Assured Placement Support From Experienced Faculty. ExcelR Offers The Python Training in Bangalore.
    Python Training in Bangalore

    OdpowiedzUsuń
  30. Such a very useful article. Very interesting to read this article.I would like to thank you for the efforts you had made for writing this awesome article.
    rpa training in malaysia

    OdpowiedzUsuń
  31. This is also a very good post which I really enjoyed reading. It is not every day that I have the possibility to see something like this..
    www.technewworld.in
    How to Start A blog 2019
    Eid AL ADHA

    OdpowiedzUsuń

  32. Pretty good post. I just stumbled upon your blog and wanted to say that I have really enjoyed reading your blog posts. Any way I’ll be subscribing to your feed and I hope you post again soon.
    Great post, Love it.

    OdpowiedzUsuń
  33. I like viewing web sites which comprehend the price of delivering the excellent useful resource free of charge. I truly adored reading your posting. Thank you!
    big data course malaysia

    OdpowiedzUsuń
  34. Easily, the article is actually the best topic on this registry related issue. I fit in with your conclusions and will eagerly look forward to your next updates.Data Science Courses

    OdpowiedzUsuń
  35. Great Article… I love to read your articles because your writing style is too good, its is very very helpful for all of usYou will get an introduction to the Python programming language and understand the importance of it. How to download and work with Python along with all the basics of Anaconda will be taught. You will also get a clear idea of downloading the various Python libraries and how to use them.
    Topics
    About ExcelR Solutions and Innodatatics
    Do's and Don’ts as a participant
    Introduction to Python
    Installation of Anaconda Python
    Difference between Python2 and Python3
    Python Environment
    Operators
    Identifiers
    Exception Handling (Error Handling)
    Excelr Solutions

    OdpowiedzUsuń
  36. Really nice and interesting post. I was looking for this kind of information and enjoyed reading this one. Keep posting. Thanks for sharing.
    big data course malaysia

    OdpowiedzUsuń
  37. Best article, i really liked it , also checkout Checkout online doctor

    OdpowiedzUsuń
  38. Such a great and informative article.
    You just made my day thanks for sharing this article.

    data science course singapore is the best data science course

    OdpowiedzUsuń
  39. Great post and creative ideas. I am happy to visit and read useful articles here. I hope you continue to do the sharing through the post to the reader.

    AWS Online Training

    AI Training

    OdpowiedzUsuń
  40. Great post and creative ideas. I am happy to visit and read useful articles here. I hope you continue to do the sharing through the post to the reader.

    AWS Online Training

    OdpowiedzUsuń
  41. Spotify Premium APK is one online music streaming application where you can easily interact with all the songs that are existing in the music industry.
    https://spotifypremiumapk.mobi
    Spotify Premium
    Spotify Premium APK
    spotify premium apk ios
    spotify downloader apk
    spotify premium download

    OdpowiedzUsuń
  42. An overwhelming web journal I visit this blog, it's unfathomably amazing. Unusually, in this present blog's substance made inspiration driving truth and reasonable. The substance of data is enlightening
    Oracle Fusion Financials Online Training
    Oracle Fusion HCM Online Training
    Oracle Fusion SCM Online Training

    OdpowiedzUsuń
  43. Awesome post. You Post is very informative. Thanks for Sharing.
    Data Warehousing Training in Noida

    OdpowiedzUsuń
  44. Download latest audio and video file fromvidmate

    OdpowiedzUsuń
  45. ROBLOX MUSICS CODE. ROBLOX MUSIC CODES AND UNLIMITED ROLOX SONG ID's LIST. Roblox Song ID · ROBLOX MUSIC CODES

    Music Codes For Roblox

    OdpowiedzUsuń
  46. I love your article so much. Good job
    ExcelR is a global leader delivering a wide gamut of management and technical training over 40 countries. We are a trusted training delivery partner of 350+ corporate clients and universities across the globe with 28,000+ professionals trained across various courses. With over 20 Franchise partners all over the world, ExcelR helps individuals and organisations by providing courses based on practical knowledge and theoretical concepts.

    Excelr Solutions

    OdpowiedzUsuń
  47. I love your article so much. Good job
    Participants who complete the assignments and projects will get the eligibility to take the online exam. Thorough preparation is required by the participants to crack the exam. ExcelR's faculty will do the necessary handholding. Mock papers and practice tests will be provided to the eligible participants which help them to successfully clear the examination.

    Excelr Solutions

    OdpowiedzUsuń
  48. An overwhelming web journal I visit this blog, it's unfathomably amazing. Unusually, in this present blog's substance made inspiration driving truth and reasonable. The substance of data is enlightening
    Oracle Fusion Financials Online Training
    Oracle Fusion HCM Online Training
    Oracle Fusion SCM Online Training

    OdpowiedzUsuń
  49. This is also a very good post which I really enjoyed reading. It is not every day that I have the possibility Python classes in pune to see something like this..

    OdpowiedzUsuń
  50. nice blog
    get best placement at VSIPL

    get digital marketing services
    seo network point

    OdpowiedzUsuń
  51. Attend The Data Analytics Course in Bangalore From ExcelR. Practical Data Analytics Course in Bangalore Sessions With Assured Placement Support From Experienced Faculty. ExcelR Offers The Data Analytics Course in Bangalore.
    ExcelR Data Analytics Course in Bangalore

    OdpowiedzUsuń
  52. I like you article. if you you want to saw Sufiyana Pyaar Mera Star Bharat Serials Full
    Sufiyana Pyaar Mera

    OdpowiedzUsuń