This is dedicated to all the hackers and the crackers, to the hackers and the crackers.
I see in binary, I speak source code, step on my toes, I'll post a million jpegs of you
and a fag pwned.
In your digital stance, getting firewalled ho, cause I'm riding the net in my six-fold.
I was a dick with my 56, now with my cable I'm able to get that stable.
On the out, my name is Ace and I'm a Leo. On the digital highway, my name is Neo and I'm a hero.
In a flash, I'll screw you on burning Dreamcast. You need some ISO? Let me through my hard drive rifle.
Our exchange you could never stifle. In a digital hug, you just caught the love bug.
I bootlegged your CD, I caused a fight between Un and Jay-Z.
Your CG, it's all gonna be free, whether we take it by force or we take it nicely.
You feel that rattle in your bones? When I tell you we just hacked out Jones.
And NASDAQ leaves your fight on your back, cause I am he who loves to hack and crack.
Cause I am he who loves to hack and crack.
This is dedicated to the hackers and the crickets.
Serial codes, source codes, ISOs, RANS, SIPs, SIPs.
This is dedicated to the hackers and the crack.
Welcome once again to Binary Revolution Radio.
I am Stank Dog joining you this week on March 13th, 2007 for episode number 190.
Wow, I can't believe we're keep inching closer and closer to 200 episodes, weekly episodes of this radio show.
Amazing sometimes when you sit back and think that we started this almost four years ago.
Just baffling. I can't believe we've kept it going this long.
But, joining me this week on the show, which is going to be actually a very good show I think.
I'm already, even from the notes I'm already learning quite a bit.
Our good friend Mia Flux is joining us on the show again this week.
You were on, weren't you on the gangster episode a couple episodes ago?
Yeah, 187 on the undercover cop.
There you go. That was the gangster episode 187.
So, joining us again this week.
And we are going to talk about some pretty interesting stuff later on.
Cross-site scripting related things, but we'll go into some more detail later.
First, I do have a little bit of housekeeping to talk about here.
I'm not sure, I don't think I mentioned this on the show, or if I did, I didn't talk about it in detail.
But, we did just relaunch, or I guess, I don't know if I should say launched a new site, or relaunching a site.
But, the people who have been around for a while know that we've run a secure, disposable email service for quite a while now called willhackforfood.biz.
And, it works great.
It's been up and down a couple times due to some technical issues with our old server.
But, we are back up on a new server now.
That site is back up and running.
However, the reason I say launch or relaunch is because willhackforfood.biz actually started off totally as a joke.
.biz addresses at the time were, like, being sold for $1.95 a year or something like that because they wanted to promote them and get people out there using them.
It was when they first rolled out.
So, we went ahead and got it as a joke, and we thought it was kind of irony that it would be a .biz that we're begging, like, you know, having to sign up willhackforfood.biz.
So, it started off as a joke and just a sandbox for us to do some testing.
We never intended it to be a real site.
And then, when we came up with the idea of secure email from my presentation that I gave it at, I guess that was Interzone 4, 3, 4, whatever.
We created the idea and created the site, and we decided since we already had that domain and it's kind of funny, we'd use it.
Well, long story short, which is something I'm not good at making a long story short, willhackforfood.biz is just not the ideal URL to use for email.
It's long, first of all, too much to type.
The whole point of disposable email is you want to use something real quick and fast and throw something in there made up real fast.
.biz is not exactly the best domain because .biz is actually pretty well known.
A lot of spam originates from .biz addresses, and it's got the word hack right in the URL, so people could easily put a filter of it not allowing anything with the word hack in it, stuff like that.
There's just lots of reasons that it's a bad domain name to use for such a service.
So, what we've gone ahead and done is registered a new site for that.
It's still willhackforfood, we'll still refer to it as willhackforfood or WAF for short, but the new domain is wh4nf.org, wh4f.org.
It's the same thing, same interface, and it works the same ways that it always has, so anybody that's been missing it or has forgotten about it, it is back up and running.
There are still a few features we want to add to it, like suggesting names because it's kind of hard to tell which names have been used, but, again, disposable, you should just be making up some gibberish stuff anyway, so the odds of a name collision at this early stage in the game is pretty low.
So, and actually, I think you've used that site before, haven't you?
Didn't you tell me one time that you like that, the willhackforfood service?
Oh...
Back when we were, I think back when I...
I did it was a while ago, I can't remember offhand.
Yeah, I think back when we were talking about, because I gave the presentation, before I gave it a dinner zone, I gave it down at the Fort Lauderdale 2600 meeting using Dodger, an account I created called Dodger, on the fl2600.com site where I showed how dodget.com was vulnerable to this backdoor attack, and that's kind of what gave me the idea for the whole thing.
But, yeah, that's been quite a while ago.
But it's been around...
I remember that wasn't there, actually, I think that was at a DC305 meeting.
Oh, was it?
Wow, I forgot all about those, too.
Yeah, that was with Diablo back in the day.
Yeah, I forgot all about those, too.
Well, it's been around for quite a while.
Yeah, that sort of died quietly, but that was pretty fit, man.
Yeah, that was pretty cool.
All right, so that is still around, so wh4f.org.
It's also shorter, easier to type, etc., etc.
So, check that out.
The only other piece of housekeeping I have is actually kind of a story time, if you will.
This is kind of a funny story.
They lighten the show up before we get into some deep tech here.
Long-time listeners of the show and long-time friends of mine know that I have a little problem with sleeping.
I have horrible, horrible insomnia.
I've actually coined the phrase hacker's insomnia, which I think is one of my few articles that you actually liked.
Oh, I love that one.
The hacker's insomnia article, which was basically a 4 a.m. rant of mine, or, yeah, I guess, for lack of a better word,
where I just was frustrated with being up yet again another night because I'm always up thinking about code, thinking about stuff, and have problems sleeping.
Well, I've pretty much had it my whole life.
It's just been getting worse and worse.
It takes me several hours to fall asleep, and if I wake up in the middle of the night, it's hard to get back to sleep.
It just sucks being me.
Wah, wah, wah.
Emo, emo.
I'm familiar with that, too, because I think I read that article at, like, 3.30 in the morning.
See, that's irony.
Yeah, as soon as I read that article, I was like, all right, you know, I'm going to start hanging out with Stank next meeting.
There you go.
So, okay, so emo, emo, life sucks, nobody understands me.
Anyway, so I finally went and did something about it.
I'll make this quick because it might be kind of boring, but I actually finally went.
If anybody's ever heard of this, they have something called a sleep study.
And, no, this is not like some college volunteer to make 50 bucks.
This is actually something you can go to the doctor, and basically they send you to a sleep study place.
I don't know if there's a term for it, but basically it's a glorified hotel, or simplified hotel for, I guess, a better word,
where they go in there, and they basically attach a whole bunch of wires and sensors to you.
And I actually took some camera phone pictures I might have to upload to the website,
even though I know they will be Photoshop material, Photoshop bait.
But basically they tape all these sensors to different parts of your face.
First of all, it was just pure comedy when I first go into this place.
They sit you down in the chair, and they measure your head with a tape measure, which is already kind of weird.
It's like, what the hell?
You've got a pretty big head.
Yeah, exactly, and, yeah, that's what she said.
And every time he would measure the head, my head, he would put a little grease pencil,
and he's marking X's all over my head and all over my face and crap like that,
for everywhere that he was going to connect a sensor.
It looked like a fucking tic-tac-toe board or something.
It was like 3D tic-tac-toe.
So I had all of these wires basically running to different parts of my body,
all my shins, my chest, my head, the back of my head, my neck, my scalp.
I don't know how in the world anybody could, they expect anybody to sleep with these things.
I think there were 46 different sensors that they had on me through, I think, 20-something different wires.
And they were all stuck to your, different parts of your body,
and then they put this weird glue-type stuff to keep them from coming off at night while you are trying to sleep.
And the cool part about it, and the reason it's worth mentioning on the show,
besides the Simple Hacker Insomnia rant,
is that all of this stuff is tied back to a computer center.
And actually when I walked in, I walked past, I saw this huge lab they had,
where, because they have, I think he said, 10 rooms in the center, in the sleep center.
And each one of them was tied to someone's room,
where it could monitor all of their vital signs and all that stuff at night while they slept.
So that was kind of cool, and ironically, I was there Saturday night this past weekend,
which is, if anybody knows, was the Daylight Savings night.
The mini Y2K, the OMG, my clocks might be off by an hour.
That's got more problems than you think.
Yeah, well...
Especially across the 2,000 computers.
Come on, what's the worst case scenario?
You're off by a freaking hour, come on.
If you've got problems bigger than that, then you didn't code very well to begin with.
You've got all the Outlook users going,
oh no, my appointments are off by an hour.
Yeah, exactly.
So, all this stuff is monitor by a computer.
I actually asked them, you know, they give you the general chit-chat,
what do you do for a living, blah, blah, blah.
And I said, oh, I'm a computer programmer.
Hey, what are the chances I could go back and see your computer system?
Because I was curious in how it worked, and they would, of course, not let me do that.
This is a medical facility, doctors, privacy, all that kind of stuff, comes into play,
which was kind of depressing.
But okay, I can understand that.
So anyway, they hooked me up to all this stuff.
Finally, you go in at, at least for this one, I went in at 8 o'clock,
but you're not allowed to go to sleep until 10, theoretically.
And they wake you up at 5 a.m. to be out by 6 in the morning.
So, first of all, they're not even giving you eight hours of sleep,
which I think is a pretty crappy sleep study.
Second of all, it takes me a while to fall asleep.
That's why I'm there.
So I'm in there and laying down, finally drift off to sleep after, I don't know,
a half hour to an hour, which is a really good night for me.
And, well, and now let me describe the room.
The room itself was basically a very simple hotel, queen-size bed.
It had a chair and, like, dressers and drawers and shit.
I don't know what the hell people do in these things for one night to sleep study.
I probably don't want to know, but basically there is a bed in the center of the room or whatever,
and directly across from the bed, as you're laying there and looking at the ceiling opposite of your head,
where your head's laying, there is one of those dome cameras.
So it's already kind of, like, really pervy feeling, like I'm being watched at night while I'm asleep.
I was scared to scratch my sack overnight because I didn't know if it was on film.
And it's going to, you know, I'm going to wake up and find myself on YouTube with my ball sack glued to my leg or something like that.
So that was already creepy.
And they've got a microphone in case you snore or make any noise or talk during your sleep so they can record all that.
That's already really creepy.
Now, again, I'm under that, I did ask, and I'm, you know, typical privacy policies apply here.
This is a medical procedure.
So I was assured that that was safe and it wasn't going to end up on YouTube, but you never know.
So I'm sure some of the funny ones, it's hard to not post them out somewhere.
Anyway, go to sleep for what I would guess.
They don't give you any clocks.
You're not allowed to have a cell phone, anything like that, no interaction.
Once they shut the door, you're in there and that's it.
So I'm in there for probably what I'm guessing is a half hour to an hour to fall asleep.
I'm guessing I slept for maybe two to three hours, two to two and a half hours.
And then the other thing in the room is right behind the bed, right behind your head where you're sleeping, is a speaker.
Where they're monitoring from the other room, they communicate with you.
So I'm in there, dead asleep, and all of a sudden, this booming voice comes on and says,
well, like, my name, excuse me, Mr. Dog, we need you to roll over onto your back so that we can get a clear reading while you sleep.
Because I guess I had rolled over onto my side.
But it comes at, like, super high volume, booming.
I thought God himself was talking to me or something.
Completely startled me.
I jump out of bed, like, swinging to kick somebody's ass.
I didn't know what the hell was going on.
So that was not cool at all.
And then...
Like that movie, True Genius or whatever, right?
With Val Kilmer.
Real genius, Val Kilmer.
Yeah, you remember that one where they do that implant in the filling?
Yeah, exactly.
And if anybody...
That's a...
If no one's...
Stop touching yourself.
Or I'll put it on YouTube.
And actually, that's a great movie.
If anybody listening, as far as hacker movies go, it's not so much computer hacking exactly,
but it's very scientific, and the people in there have a lot in common with hackers, believe it or not,
even though it's more science, laser-based storyline.
But anyway, I digress.
So I will shorten up, though, simplify the story.
Wakes me up out of a dead sleep.
I'm completely wide awake because of that.
I don't know if that's part of the test.
Maybe they're supposed to see how I react if they wake me up in the middle of the night.
I don't know.
But I couldn't go back to sleep after that.
I'm laying there in bed.
I'm rolling around.
I'm trying to figure out what the hell's going on.
I can't fall back asleep.
I'm thinking about code.
I'm thinking about the problem I had with some PHP I was working on the night before.
I'm thinking about some SQL code I've got to write Monday when I get back to work.
I've got all this stuff.
I must have been up for probably two or three hours after that trying to fall asleep and not able to,
and I was pissed off that the guy woke me up in the first place.
So, all in all, I'm saying that it really, really sucked.
I guess that's the short answer to the whole story.
I was not happy with it.
It was not as clinical as I had thought.
It was just downright creepy, and I will not get the results to see if there's anything wrong with me,
at least sleeping-wise, that is.
We all know that there's a lot more wrong with me than that, until sometime in the end of the month.
So, maybe I'll keep people up to date and find out if there's anything wrong with me
and if hacker's insomnia is, in fact, curable.
So, there.
There's some housekeeping.
We haven't done show-and-tell or story time in a long time.
So, I guess that is enough to start this show off,
and we have a short email section this time,
so we have plenty of time to talk about our main topic.
So, stick with us for a few minutes, and let's do some email.
And our first email this week is actually, this is kind of a message to pass on from our good friend Mubix,
who's been on the episode of the show before.
Mubix was on the USB key.
We talked about a lot of cool tools and might be doing some more episodes on that topic in the future,
as we'll find out a little bit later here.
But, he sends an email because we want to remind all the listeners that coming up on the 23rd of March,
ShmooCon is going to be going on up in Washington, D.C.
So, the 23rd of March, after all the talks are done,
there's going to be a meet-up at the Chipotle that's right around the corner from the hotel where ShmooCon is being held.
It's going to be 9 p.m. after all the talks, March 23rd at Chipotle.
How's this for irony? How's this for an address?
2600 Connecticut Avenue, Washington, D.C., 20008.
I don't think you could have made that up that it's 2600 Connecticut Avenue.
That worked out pretty good.
Definitely.
So, he's looking for artists that can make some flyers to hand out at the conference
to let everybody know where it's at.
So, if people want to drift over from the conference,
have everybody's logos on it, stuff like that.
So, if anybody wants to contact him about that,
his email address is jd, as in John Doe,
jd.mubix at gmail.com.
And he says the winning submission will get a t-shirt from all the shows
and signed version of the flyer.
Don't worry, he will buy the shirts.
All right.
And, not only is he buying shirts,
he says he's going to be having free beer and food.
By the way, you got your beer handy right there, right?
Oh, I got my beer.
By the way, do you have your sweet tea?
Oh, I do have my sweet tea.
See, you and Logos X.
Yeah, yeah.
Oh, I forgot to mention that at the beginning.
The, uh...
Uh-oh.
You've got your sweet tea,
but I've generally got my Guinness.
I substituted it tonight for a nice Stella.
You know, I figured an icy pint of Stella will do me good.
Well, you and Logos X,
we have to get you both liquored up to get you to do the show.
Yeah, it's like you can't talk me into it
until I've had at least, like, a couple beers.
Exactly, exactly.
So, if the show degrades after about an hour
and you start slurring, you know why.
So, yeah.
So, anyway, free beer and food
for everybody in the community,
podcasters, vidcasters, and stuff like that.
And there's going to,
he said there will be a beer tab for our listeners,
but it's probably going to go really, really quickly.
Simple Nomad's actually going to be there
as a guest of honor,
so that's very cool, too.
So, go, again, this is after the talks,
9 o'clock, March 23rd at Chipotle,
2600 Connecticut Avenue,
just around from the hotel.
So, go check it out.
Meet up with a bunch of the podcasters,
vidcasters, radio show hosts,
because I don't like the word podcaster.
Radio show hosts, etc., etc.
I, unfortunately, am not going to be able
to make it there.
I wanted to, but it just didn't work out timing
for me at work, unfortunately.
So, I'm not going to be there,
but I know the guys from Hack 5
are definitely going to be there.
I think, actually,
I'm not going to even drop any more names,
because I'm not sure who's committed
and not committed to going yet.
So, check out,
well, actually, there's no website,
so I guess you can email Mubix
at the email address I mentioned earlier
if you want any more information
or want to get any more details on the meetup.
So, if you're in the area
or going to ShmooCon,
or even if you're not going to ShmooCon,
let me clarify,
you don't have to have tickets.
This is outside of ShmooCon.
This is away.
So, even if you live in the area
and weren't able to get tickets
or don't want to go to ShmooCon,
didn't want to go,
you can still meet up afterwards at this.
This is completely irrelevant of ShmooCon,
the way it ended up working out.
So, I don't know if that's better.
That probably is better.
So, whatever.
So, our next email comes from Lex.
Lex says,
when you talked about the hacker's USB toolkit in 188,
again, that's Mubix's episode,
I was pretty surprised
that I didn't hear anything
about what I think is the most powerful tool
I have on my USB drive,
a fully bootable Linux system.
I run...
Yeah, that was one thing
that I was going to bring up.
You know, I heard that on the show last week,
and he was talking about all the tools,
but I was going to say, you know,
most of the more recent computers
can boot up straight from USB.
So, I mean, a Linux system is pretty handy.
Right, right.
And, of course,
we won't go into the security vulnerability
of booting from a USB,
and allowing your computer to boot from that,
but yeah.
And, you know,
and actually,
let me finish reading this,
and then we'll address it.
He says,
I run Puppy Linux,
and that's puppylinux.org,
all one word,
on my 128 meg flash drive.
It's specifically designed
for this kind of situation,
or for similar cramped conditions,
such as a small sliver of a hard drive
or a live CD.
What's pretty neat about Puppy and others
is that it saves all the changes I make
to any part of the file system
using UnionFS.
For a USB stick,
it dumps the changed files
to a little ext3FS in a file.
For multi-session CD mode,
it actually burns a new session
with the ext3FS onto the CD,
and at next boot,
the most recent session is loaded up.
Pretty neat.
So now I carry around in my pocket
a little Linux distro
with all the hacking tools
I could possibly need
with a nice graphical X-session,
Firefox,
media players,
and lots of system diagnostic
and repair tools.
If I need a new tool,
I just download it and install it,
and it'll be there next time I boot.
Any computer that'll let me boot
a USB drive,
and that's most of them now,
as Mia Flux just referred to,
can be an instant Linux box.
Your show inspired me
to get back under the hood
of my Puppy system.
Now the saved EXT3 file system
on my USB stick is written
using the Crypto Loopback driver,
so a password is required
to boot into my keychain
and get at my files.
TrueCrypt is great,
but this is even more powerful
because it requires no thought,
and my files are always protected.
From Lex,
pronunciation L-E-X.
Now see,
it's always the guys
with the easy handles
that give me a pronunciation key.
Like I'm sitting here
stumbling going,
is it Lex or is it Leeks
or Lexa?
I can handle Lex,
but for those of you
with a little bit more complex handles,
send me a pronunciation key.
But Lex,
I got that one.
Yeah,
I'm always confused
at the people
who like look at my name
and interpret it
as something different
because I figure,
you know,
M-E-A-F-L-U-X
could only be read
so many ways,
you know,
but it's amazing
how many people
will confuse
like the F for a T
and be like,
oh,
meatlox for
less unappropriate things.
And I'm like,
uh,
no.
I was trying to keep
the show clean this week,
but I failed miserably.
Yeah,
exactly,
yeah.
I think it's the UX
and the whole,
you know,
Yeah,
exactly.
But honestly,
I never even thought really
of joking around
with your handle
until you brought it up.
You're the one that said
people call you meatflux
and we started calling you
anyway.
that was IRC,
exactly.
Right,
that's joking around.
I mean,
you know,
an IRC anything goes.
You got such,
you know,
knobs out there
that they just,
you know,
sort of,
uh,
get themselves in.
But, uh,
meat knob.
Yeah,
yeah,
I've always been amazed.
The whole,
uh,
Dr. Zygman thing
with the carrot,
I wanted to pronounce that,
you know.
Yeah,
carrot Zygman.
I did do that with him
all the time,
joking around.
I think I'm going
to change my handle
now to meat knob.
Meat underscore knob,
just to,
because I like the sound of it.
Yeah,
I,
um,
I was thinking,
you know,
I'm just waiting for somebody
to have a handle
with like,
you know,
an exclamation point
in front of it
and be like,
you know,
bang Bob,
like,
you know,
like a exclamation,
exclamation point Bob,
you know,
or something like that.
You gotta have one of those ones
where like,
it'll be humorous
for people to understand
what the actual characters mean,
but a lot of people
just seem to think like,
you're more elite,
the more numbers
and like,
special characters
you throw in there.
Could I get,
would I get sued for copyright
if I made exclamation bus?
Would they sue me
from bang bus?
Probably.
That's probably
a pretty good handle.
You just have
exclamation point bus.
I wonder if you,
not to know that people,
you know,
uh,
That's actually
an interesting question.
That's actually
just kind of a,
joking aside,
that is kind of
an interesting question
because,
what if you did take
an elitized version
of a company name
or a,
something like that?
I wonder how legal
that would,
legally that would work
as well.
As long as their lawyers
have money,
you're screwed.
Well, yeah,
you're always gonna get
buried in the money,
but,
on principle,
I'm curious how that might be.
I mean,
there's fair use
and parity protection
and stuff like that,
but I wonder if I,
eh,
I don't know.
Anyway,
just popped into my head.
I was gonna say
about,
like,
the,
the Linux distros,
I know I've played around
with DSL and stuff like that.
Um,
I haven't gone too far
down the rabbit hole
for,
uh,
booting,
uh,
booting different OS's
from USB,
but it's been pretty handy.
I've had a couple of friends
who are technicians too
and they've just run,
like,
uh,
virus scanning
and AdWare scanning tools
from Linux on there
and that way,
you know,
like,
uh,
if there's any issues,
I mean,
like,
I had a problem
on my uncle's computer,
I remember a few months back,
where he,
uh,
he specifically couldn't delete
a couple of different files
and he's,
he's fairly proficient.
He's an engineer.
He's,
he's the guy who probably got me
into computer programming,
um,
and,
uh,
he could not delete
these specific files
from his system
and they were being loaded
every single time
the computer loaded.
Now,
we could,
like,
you know,
edit the registry keys
and stuff like that,
but we couldn't,
even from DOS,
well,
DOS didn't have,
you know,
NTFS,
but I went into NTFS DOS,
NTFS DOS still wouldn't let us,
you know,
um,
delete the files,
so I pretty much ended up
having to use,
like,
a Linux live boot CD
to go through
and delete the files
so that it wouldn't
reinfect the machine
and then,
you know,
remove the registry keys.
Right.
And at that point,
you know,
times like that,
you know,
it makes sense
that a lot of,
uh,
technicians,
you know,
a lot of computer repair people
are even switching to Linux
for the diagnostics
and recovery tools,
you know.
Certainly.
And that's why they rose
in popularity so much,
but again,
you just,
like you said,
and that's what I was going to say
is I still just boot
from a Linux bootable CD,
you know,
I still haven't bothered
to really investigate
or look into
a bootable USB key.
I know that a CD
is going to work
no matter how old
the hardware is
or how old the system is.
If I can boot
from the CD-ROM drive,
I've got everything there
and I've got more storage space
on the CD,
well,
you know,
unless you've got a 1 gig plus
or,
you know,
more than 660,
700 megs.
Yeah,
exactly.
Well,
we're not like,
you know,
all the noobs,
we're like old school,
you know,
like I used to carry it.
I remember when I used
to repair computers,
I would carry around,
you know,
like,
essentially a freaking,
you know,
briefcase full of CDs,
you know.
See,
I'm even...
Those utilities,
you can just toss them
onto a USB drive
and like,
boom,
you're done.
No,
see,
you're not old school.
Old school,
I walked around
with a little carrying case
of like 15 floppy disks.
Is that what you're going to say?
And actually,
I did have computers
that used cassettes
to store data on as well,
but no,
actually,
but I was talking more along
the having a diskette
that was like an old,
remember,
back in the old gaming days,
you used to have to carry
a boot disk with you
so you could run memory managers
and whatnot.
So I always had a memory manager disk
for any purposes.
It's back in the old Windows 3 days.
A virus scanner,
some utility tools,
DOS shells,
stuff like that.
So,
diskettes, baby.
And the 5.25 inch floppies
where you had like 14 disks
for a game
and it always told you,
you know,
insert disk 7 of 15.
Yeah,
that was the days,
boy,
that was hard.
I remember that.
Actually,
that was a little bit more old school.
I'm going to try not to date myself anymore
as I'm about to turn 25,
so.
Oh,
man,
I don't even remember
when I was 25.
Anyway,
all right,
so let's,
let's see,
where were we?
Oh,
yeah,
I guess it goes without saying
that,
you know,
there's tons and tons
of things we could have talked about
putting on a USB drive.
I mean,
I'm sure we missed quite a bit
and that's why we put the call out
if anybody had some suggestions
or things worth mentioning
to email us
and let us know.
You know,
we've got a limited amount of time
on the radio show
to talk about it,
so we specifically singled out
and chose those few things
because we thought it was a good mix
of some things people know,
but then again,
some other ones
that they may not know,
so we kind of tried to mix it up,
but we've actually talked about
maybe doing some future episodes
by theme or genre
or relationship of tools,
like maybe we'll do one of
a bunch of different scanning tools
that you can,
that are very portable
or a bunch of different,
you know,
like application level stuff
that's actually useful to you,
like OpenOffice portable,
Firefox portable,
stuff like that.
So yeah,
we're definitely never going to hit
all of them.
It's one of those,
all in,
you know,
so big of a topic
that we're never going to
fit it all into one
or even many episodes.
It's always going to be
something we miss,
so that's why we want our readers
or readers,
our listeners,
excuse me,
to mail us
and let us know
some cool things
that they have found
because certainly
there's stuff that
we have missed.
So I'm,
let's see,
we are,
we still got a good amount
of time left for the show
to dedicate to this main topic
because this one's going to be,
well,
let me,
first of all,
let me preface this
and say it's going to be
a little bit tricky
with this topic
because it's very technical
and it's going to be
kind of hard to translate
some of this on radio,
but Mia Flux and I
have been talking about this
for a couple of weeks
of how we can pull this off
and got some good notes together
so we're going to jump into it,
give it a shot,
we're going to try to be careful
not to drop too many code snips
or when we do,
we're going to try to give you
some examples,
some links to some pages
where you can actually view them
while you're listening
along with the show
and even if you need to go back
and re-listen to a show
or rewind or whatever,
you can do that too
so that might be helpful.
But that main topic
that I'm referring to
is cross-site scripting
as well as cross-site request forgery
or forgery request,
I've seen it said both ways.
So we're going to talk about
those two things
are commonly mentioned together
and specifically I think
and you tell me here,
we're going to kind of
talk about this
a lot of relationships
between this and Ajax
because Ajax is making
these things a lot more,
I don't know,
not deadly is a bad word,
a lot more useful,
a lot more,
I don't know,
I'm not sure,
a lot more common
I guess is a simple way
of saying it.
Exactly, yeah.
So, I guess,
I mean,
I'll let you
kind of roll with this
because I'm not,
like I said,
it's such an all-encompassing thing,
I don't even know
exactly where to start.
I mean,
some history a little bit,
I guess,
we want to lay some foundation
down to start with,
right?
Yeah, exactly.
I mean,
there's,
like you just said,
there's about
15 different ways
we could spin this
and I could probably
make several episodes
so I guess
pretty much
just going to lay
the foundations
and a lot of
basic information
to get people started
and if they're interested
we can probably go
from there
in future episodes.
All right.
But I guess
I'd like to talk about,
you know,
the history of,
say,
like XML HGP request
and essentially
what Ajax is nowadays
and how it got there.
Originally,
people got the type
of Ajax response
by using
iframes and layers
and that was
in Internet Explorer 3
which was released
in 1996
and Mozilla 4
in 1997.
Mozilla ended up
copying it
to get that functionality
and that's because
people got tired
of the general,
you know,
HTTP model
which is
go through,
click on a link,
entire page refreshes,
et cetera,
et cetera.
So they said,
you know,
hey,
let's stick,
you know,
layer in here
and iframe in there
and when somebody
does anything
on a web application
we'll just upload
that portion
of the page.
Now frames
and that evolved,
what's that?
I was going to say,
frames is generally
an IE term
and layers
is generally
the Mozilla term.
They're like
interchangeable
with each other,
different,
that's back when
the browser wars
were still going on,
right?
Exactly.
Now there's frames
which work across
both of them
but iframes
are specific
to Internet Explorer
and layers
are specific
to Mozilla
originally.
I guess it was
spelt Mozilla
but pronounced
Netscape
if you want
to get particular.
Well,
yeah.
People may get
pedantic with that
so you don't have
to go ahead
and cover my bases.
No,
you don't.
Yeah,
so those evolved
into,
on Microsoft's side,
Microsoft's remote
scripting,
MSRS
and basically
what it did
is it involved
JavaScript on the client
and a Java applet
to achieve
some of those
same effects
and that still
was lacking
in some ways
and Microsoft
pushed
and put
an XML
HTTP request
in their browser
with Internet Explorer 5.
Now,
what that was
is that
through JavaScript
you could actually
pull back
an XML
response
from another
website
and I mean
it got used
all sorts of ways
you know
whether it was
just straight HTML
or XML
you know
and parsed
on the JavaScript
side
et cetera
but it was
very useful
and it got
implemented later
on in Mozilla
Firefox
you know
Opera
et cetera
a little bit later.
Ajax
was coined
by Jesse James
Garrett
in February
2005
but the reason
why I'm talking
about it earlier
like all those
earlier things
led up to it
so a lot
of people
you know
think Ajax
which is
asynchronous
JavaScript
and XML
was a new
thing
you know
as soon
as it hit
in like
February 2005
there were loads
of people
going like
oh my god
I didn't know
you could do that
OMG
Web 2.0
these two people
have pretty much
been doing it
since like
96
so it was
almost 10 years
later that
the technology
sort of
came to
fruition
and popularity
would probably
be the better
word
on that one
so Web 2.0
started back
in 1996
is that what
you're saying
yeah
essentially
for these two
people
the problem
was that
a lot of
you know
developers
a lot of
web developers
didn't know
about it
and a lot
of clients
weren't
you know
screaming for it
nowadays
it's pretty hard
not to find
a company
that wants
to make
everything
as fast
as that
Google thing
you know
people look
at their
web mail
or they look
at something
else
or any
basically
you know
web based
application
and they go
oh hey
you know
I remember
looking at
Dell
for the
whole
Ajax hype
and they
used to
have
on their
driver search
they would
have a
drop down
you could
select
you know
the baseline
model
and then
it would
have specific
models
that would
pop up
right after
that
and I
remember
seeing that
initially
and thinking
that was
really cool
you know
but
it was
unusual
nowadays
everybody
has an
Ajax
application
it's
practically
the
website
of
1993
or 4
every company
was like
we gotta
have a
website
right
and the
thing is
though
they're
really
they can
it's
really
useful
I mean
they really
they can
be
what's
frustrating
nowadays
is that
yes
like you're
saying
everybody
wanted a
website
back then
now everybody
wants a
web 2.0
site
they want
an Ajax
site
and
unfortunately
they're
pushing out
a lot
of Ajax
just for
the sake
of it
it's not
even really
doing anything
that useful
that's worth
putting it
out for
and
I know
we're going
to say
this later
I guess
I'm setting
this up
for later
on
is
when you
throw stuff
up
quickly
and sloppily
like that
without doing
it properly
you're bound
to leave
a lot of
holes in
there
and that
is exactly
what's
happening
and where
a lot
of this
stuff
is coming
from
but we're
definitely
going to
come to
that later
right
exactly
and I mean
that's the
thing
like
I've been
developing
Ajax
applications
for over
a year
now
and I
used some
of these
tricks
earlier
on
actually
to tell
you the
truth
except for
it wasn't
really called
Ajax
then
but my
nickname
in the
office
is actually
Ajax
they call
me Ajax
so
you any
indicator
what do
they call
you behind
your back
that's what
I want
to know
I don't
know
xmlhcp
request
object
you know
microsoft
whatever
well
yeah
we won't
even go
into that
I had
some
fun
problems
before
we got
recording
today
didn't
I
but
anyway
let's
stick
to the
topic
here
so
I mean
like
back
in those
days
before
Ajax
really
even
came
around
there's
something
that
ties
into
it
and it
was
actually
on a
webmonkey
article
on cross
side
scripting
a while
ago
he's
actually
I can't
remember
the guy's
name
on webmonkey
that wrote
the article
but he
specifically
started using
xss
instead of
css
because of
course
css
was around
before then
for cascading
style sheets
and something
else
I can't
recall at the
moment
but
so he
basically
said
that's
really
stupid
we
should
actually
be
using
xss
instead
of
css
so
in that
one
he had
a really
interesting
thing
about
a guy
who used
to go
through
and check
guestbooks
and the
thing
was that
a lot
of the
guestbooks
would just
take the
text
and put
it into
the page
and display
it as
you know
just standard
text
in the
HTML page
now what
this guy
would do
is he
would actually
go through
and post
an image
tag
in the
middle
of his
text
for a
picture
of
Barney
the
dinosaur
and he
went around
for a while
and I guess
it was pretty
popular
and they
would go
around
to all
these
guestbooks
online
and just
post this
image tag
in the
middle
of the
text
and all
the pages
would render
it and show
you know
because they
weren't stripping
any of the
HTML tags
they were showing
you know
Barney the
dinosaur
in the middle
of their
guest page
well it's
better than
goat see
or the
weightlifter
or something
yeah I'm sure
there was
probably
a couple
of people
who stuck
like tub
girl in
there
I'm sure
yeah
I'm trying
to be less
malicious on
this and
actually talk
about somebody
who you know
just put a big
purple dinosaur
on your
guestbook
I don't know
that's pretty
offensive too
actually
if you think
about it
especially if
you're like
one of the
old school
like lead
people
it's like
yeah I've
been programming
on a back
since like
1977
somebody's
going to
take a
picture
somebody's
going to
take a
picture of
Barney
and
photoshop
it with
tub girl
and want
a picture
of Barney
shooting a
thousand
I guess
after this
article
people can
probably
maybe there'll
be a
resurgence
in Barney's
you know
that's why
I wanted to
sort of go
there a little
bit
I don't want
to be
responsible
for that
anyway
alright
yeah you're
right
let's go
back on
topic
yeah so
basically
when I was
talking earlier
about refreshing
certain portions
of the page
there's something
along that
came along
that really
helped
Ajax
and that's
DOM
or the
document
object
model
and
essentially
what that
is
you can
go through
and add
portions
to a
page
remove
portions
from a
page
and update
portions
of a
page
from
JavaScript
code
so you can
go through
and essentially
just have
like an
HTML page
which is
just
JavaScript
and generate
all the
HTML for
that page
and make it
dynamic
straight from
JavaScript
in fact
a lot
of Ajax
development
is pretty
JavaScript
heavy
you know
there's
primarily
the backend
is for
supplying
the data
and a lot
of the
behavior
and logic
is on
the front
end
so
with that
I sort
of wanted
to segue
into different
types of
cross-site
scripting
attacks
and the
first type
of attack
that I
wanted to
talk about
is actually
DOM
based
now
basically
what it
is
remote
execution
vulnerabilities
for any
HTML
not encoded
using
HTML
entities
can go
through
and bypass
the
client-side
sandbox
by running
trusted
within the
local zone
and possibly
exploiting the
entire system
now
what that
means
is that
if any
of the
code
is run
locally
like let's
say you
go through
and open
up an
HTML
file
locally
on your
computer
like you
save a
file and
open it
up
you can
go through
and at
that point
an HTML
file that
you open
on your
system
is inherently
trusted by
Windows
so you
can go
through and
have a
JavaScript
snippet
in that
page
that will
remotely
go back
grab code
and execute
it locally
that would
allow it
to say
have access
to files
on your
hard drive
and go
through
grab the
contents
of those
and put
it on
another
site
now
that's
fairly
rare
in that
you'd
actually
have to
have
an
HTML
page
locally
on
the
user
system
that
they
would
open
up
but you
could
do
something
like
have
say
an
HTML
or
HTML
file
or
something
like
that
wouldn't
open
by
default
or have
a link
where
somebody
saves
a
file
and
just
save
the
HTML
file
and
open
it
in
the
browser
and
at
that
point
you
can
essentially
root
their
box
from
your
script
alone
so
this
isn't
like
drive-by
downloads
and stuff
like that
it's a little
bit more
complex
and one
of the
lesser
seen
cross-site
scripting
exploits
but it's
still
possible
and
basically
a famous
example
for that
one
was
Google
had a
website
that was
identified
and published
by
Yer
Amit
in
December
2005
and
the
vulnerabilities
allowed
an
attacker
to
impersonate
legitimate
members
of
Google
services
or
mount
like
phishing
attacks
and
whatnot
and
basically
the way
they
did
that
is
they
bypassed
common
cross-site
scripting
countermeasures
by using
UTF
encoded
payloads
and
I'll
get
into
that
a
little
bit
later
on
but
it's
how
browsers
actually
interpret
Unicode
if they
properly
interpret
Unicode
you can
go
through
and
alternately
encode
information
so
that
it's
launched
I'm
sorry
I was
going to
say
since
you
mentioned
that
that's
actually
something
we
probably
should
do
an
episode
on
just
talking
about
different
encoding
and
how
it
relates
to
navigation
on
the
global
interweb
and
stuff
because
there
are
a lot
of
nuances
and
interesting
things
there
yeah
I'd
be
happy
to
go
into
something
like
that
at
a
later
date
because
I've
dealt
with
that
a
few
different
times
like
when
I
went
to
my
SQL
injection
presentation
a while
ago
we
got
into
canonical
names
and what
not
a little
bit
but
like I
said
I just
wanted to
go over
essentially
what
the first
type
would be
it's not
seen that
much
I haven't
really found
a use
for doing
something
like that
but
it exists
so I
just felt
I had
to go
over
that
the second
type
which is
pretty much
the most
common
one
is
non-persistent
or reflected
vulnerability
and
that
basically
injects
code
on a
URL
to a
third
party
site
and
you
embed
it
for instance
you could
go through
and send
somebody
a URL
encoded
or standard
script
tag
embedded
in
I mean
like
it doesn't
have to
be
URL
encoded
you could
encode
it
through
a couple
different
mechanisms
but
essentially
you just
send the
link
to somebody
say
you know
Citibank
password
change
or whatever
like that
and they
show you
the link
and even
if you
look at
the location
of the
link
it shows
that it's
Citibank
so it
really looks
legit
and along
with
you know
forging
mail headers
and what
not like
that
I remember
back in
the day
when I
used to
send
emails
from
Christina
Aguilera
dot com
or Brittany
at Brittany
Spears
dot com
to some
of my
friends
so it's
fairly easy
to actually
forge emails
and you go
through and
say here's a
link from Citibank
to change your
password
it's actually
really the
Citibank
change password
page
but it's
loading your
script at
the end
grabbing the
cookie
and doing
other malicious
things
right
and you
actually gave
an example
here that
I'm going
to read
for the
audience
to look
at
and we
put it
I actually
tinyurled it
tinyurled.com
Y
U
G
M
3
G
so if you
want to do
that
that's a
simple
example
but it
shows you
that basically
you are
simply
going up
to the
URL box
up there
your navigation
bar
and you
are putting
in
an HTTP
request
to the
site
but you
are slipping
in some
code
injecting
some code
in there
that's going
to in
this case
just pop
up a little
message
but it's
using the
same
formatting
well using
the proper
formatting
I should
say
it could
be a lot
more
damaging
I guess
for lack
of a better
word
yeah
that's
one thing
that I
did want
to stress
this tiny
URL link
is just
going to
exploit one
I mean
one of the
most common
examples
is using
a search
engine
you know
like hey
I searched
for this
and most
of the time
most of
the search
data is
URL encoded
anyways
people use
spaces and
special characters
and everything
so it doesn't
really look out
of place
it's especially
prevalent in that
so in this
case I went
through and
actually Google
and Yahoo
strip it out
now and I
tried a couple
different attacks
and I mean
not attacks
I was playing
don't sue me
but
or put me
in prison
I want to
go to
federal prison
but basically
I went through
and somebody
recently turned
me on to
that particular
search engine
and the
search assistants
are less
than helpful
so I
on a whim
decided to
check out
that one
and wonder
of wonders
the poorly
formatted
search engine
actually ended
up exploiting
my code
or my code
exploited it
so that
was just
one example
it's all
over the place
if you
play around
with different
search engines
you can probably
find a lot
and use some
of the examples
that we go
into later on
but yeah
this is probably
the most common
like phishing
attack
in that you
know they can
go through
and spam this
to like a
gazillion people
and the five
that click
on it
it's not even
and this is
like the next
step
one of the
you know
more popular
ones that's
already out there
that a lot
of people
know of
is they'll
send you
you know
you need
to change
your paypal
account
or something
else
and it'll
be like
xyz.biz
you know
like Sank
was saying
earlier
you know
you're going
to think
oh of course
this is a
phishing attack
well and there's
other indicators
I mean first
of all any
long url
you should be
phishing about
anyway
if it's got
a bunch
of what
appears to
be gibberish
you know
different hex
codes
or different
offsets
for different
characters
that you
can't really
put into
well anyway
it goes back
to encoding
which we're
not going
to go to
that again
but if you
see a long
url is what
I'm getting
at you
should be
suspicious
because you
don't know
what all
it's going
to be doing
so anytime
you see a
long url
from anywhere
whether it's
Citibank
PayPal
or whatever
you should all
be
it doesn't
matter where
it's from
like if you
see a long
url
go to the
actual you
know specific
url yourself
and check it
out if it's a
url that you
trust but don't
trust any link
even if the
email looks
legit even if
the root domain
is your actual
you know bank
PayPal or
whatever else
because the
thing that I
wanted to drive
home is most
people will still
see this and
they'll go oh
well it must not
be a phishing
attack because
it's actually
from Citibank
right
you know
right
and the
there is a
limit of how
much you can
put in a
domain in a
string like
that it's
there's going
to be a
limit but the
example that
we're using
here is is
again very
simple just a
confirmation box
that pops up
but the point
being that's just
a simple
illustration that
could easily be
grabbing that
and doing a
remote insert into
meaflux's box or
someone else's box
somewhere else so
it could be doing a
whole lot more so
that's why you want
to worry the longer
it is the more it's
probably trying to do
now actually I have
a question for you
on this
I mean this is a
form of URL
manipulation which
I've written articles
about in the past
and I always love
just I love messing
with URLs when I go
to different sites to
see what I can get
into so my question
to this is okay
that's one form is a
get request well what
can I actually use
post parameters to do
the same thing can I
actually inject script
this same type of
script using a post to
a website yeah and I'm
going to get into that
a little bit later on
when I actually start
getting more into like
a cross-site request
forgery and stuff like
that some people will
try and avoid that by
actually doing you know
like moving away from a
get page and moving it
to post but what a lot
of people don't
understand is you can
actually change a form
from post to get to a
page so depending on
how the receiving page
handles it you can still
post all of those
variables you can scan
through you know like
the document document
element by ID and grab
through you know or like
just go through the
entire document grab all
the IDs and then post it
with that same data but
that's that's not going to
be the the type to attack
generally you're not going
to be doing that that's a
different type generally
through the URL exactly
exactly and that that
moves us on to pretty much
the third type which is
stored or persistent or
second order second order
vulnerabilities and that's
when the script is stored
permanently on the server
without being encoded using
HTML entities that that's
generally a lot of times
you'll find that on forums
and whatnot people have
their their footer image
or you know can make their
text read or make it bold
etc etc and a lot of these
sites allow users to go
through and and use HTML in
there unfortunately since
they're not really going
through and using HTML
entities you can use the same
attacks in the second one
but you can embed the script
directly so it'd be like if
somebody said you know you
know put your avatar here and
you do something like you know
like image source and then an
image that doesn't exist and then
you know what is it on air go
through and load your script right
something yeah something like you
know doesn't exist dot jpeg you
know and then a space you know
uh... single quote on air equals
quote you know alert document dot
cookie right right yeah look at
your document cookie like straight
there and anyone who goes through
there it wouldn't just be alert of
course you'd actually go through and
you'd uh... send the information you
could use the XML HTTP request object
uh... with that code to actually
remotely send anybody's cookie who
looked at your site and in cases
like orkit and stuff like that um
they actually went through and were
able to get into users accounts
um... there's a lot of different
types like there was a yahoo cross
site scripting worm that pretty much
as soon as the page loaded um it
would go through grab all of your
contacts and then send them all of
the mail and that was purely you know
cross site scripting that was all
javascript based they actually went
through grabbed all of the you know
uh... contacts in your account book
and emailed itself so it didn't infect
your computer but it certainly you know
sent the email and propagated itself to
all your friends and that's something
that you know spam uh... spam people
could actually go through and use to get
massive amounts of email you know you
go into your uh... you know uh hotmail
or yahoo accounts and boom somebody
has got all of your email and all of
your contacts emails so and since
you've got them saved they're more
likely to be valid emails they're not
just farmed emails that could be old or
expired they're probably active email
addresses but actually wasn't wasn't
this the same technique i'm sorry
wasn't this the same technique also
that was used on that big myspace thing
with the friends growing exponentially
which is i think a great story
the same type uh... that was used on the
myspace worm uh... this guy added like a
million friends to his friends list
and uh... i think he got legal action
taken against him i can't remember
specifically
there was uh... another company and i think
they mentioned it last week actually
or somebody did but there was actually a
group of people that had a number of
cross site scripting attacks and exploits
that they did like grabbing your
friends you know password etc etc and
those two people they were actually i
think selling them and they went
through and posed enough of a threat
that uh... myspace actually went to
them and went like you know like i
think they propositioned them and said
you know well you can hire us to do
your security or pay us money and my
space goes okay you know we'll hire you
at some exorbitant some they go into
going to the interview and there's like
fbi agents waiting there to take him
to jail
so i thought that was funny i mean you
know like uh... i i've never been a
malicious person so when i've played
with most of this stuff i've had you
know my own servers i've you know
infected my own computers etc etc
because i don't necessarily need the
money or want to follow you know
malicious uh... steps to get ahead you
know right it doesn't make sense to me
but i've always been interested in the
security aspect so i'd say i'm probably
like white or gray hat probably at
worst right and uh... this this actually
to me is i know the other one may be
the most common i i i don't know me i
whatever most common but the one i
think that people are most familiar with
is this style of attack this is the kind
of thing that is most common and most
interesting in my opinion just personal
opinion and this is the kind of thing
though that i mean it helps to have
your own server to run this from right
yeah i mean it that it's not something
you're going to be running if you have
cookies and other information like that
of course you need to actually send the
information somewhere so most of the
time this third attack is is used or
even the second attack second and third
type of attacks are used with an
external server to record the
information so at that point you
actually use the xml http request
object to send all that data that you
just grabbed from javascript and you
just log it on to your server so
whether it's a botnet or you know
some right but ironically of a proxy
server and that's that's just a thing
is ironically you don't want this
trace back to your server most likely
what you're doing with this kind of
stuff so you're doing something stupid
definitely don't like send all the
information to your home machine right
things like that are where you know
you start to end up getting uh you
know technically FBI and right
technically it would work i mean if
you got a static ip or or you're
running your own website but i mean
it's so easy to find where it's going
and that's where you know all these
botnets or previously exploited box
and come into play is you know it's
someone else's box that you're
launching these attacks from so you've
got that extra layer of obfuscation
in there that extra layer separation in
between you and and the victim i guess
for lack of a better word also and
actually this is kind of funny i don't
know if this is let me let me bounce
this off you what if isn't it
possible then by the nature of this
type of attack to use some sort of
injection vulnerability on site a on
one site inject some code in there
that actually launches a cross-site
scripting attack to a second site site
b like neither not even your site they
don't even have to be your sites like
site a you go and put some code in
there that code goes over to site b
looking for a particular string or
looking for a particular script over
there and you put your script on box b
which in turn goes back to a so you
could actually have this funny
scenario where you've got an infinite
loop between two different box and
performing cross-site scripting
attacks on each other and each one
subsequently sets off a trigger
causing it to attack the first one so
it goes back and forth you could
actually have this weird infinite loop
theoretically i mean is am i on is it
isn't that possible no no yeah
definitely it's possible and uh i mean
you know but even even more
probable i would say is that we're
going to start seeing a lot of worms a
lot of the you know fishers and
spammers moving away from directly
exploiting the machines i mean that's
still going to be a huge thing but i'm
saying because of cross-site scripting
the fact that you can go into you know
a central repository of all of this
information that's normally considered
secure and be able to crack it so
easily makes it a much better target
than say one person's computer with
their outlook contacts you know right
well we've got i mean what i would see
in the future probably more likely
than just you know looping each other
to death or something like that would
be like uh you know one site going
through and say grabbing other links
you know that are that are on the page
or um you know uh browser history and
exploiting them and seeing if they have
the vulnerabilities and then installing
themselves on them what i mean is you
know going through and actually exploiting
multiple other websites but you could
use it for obfuscation and that end of
going through and you know upload this
some you know minor site and have it go
through and do your other attacks for
you but you're still going to need a
couple of hops between you and the
first injection point if you actually
want to do it that way right now we've
got like i don't know about 20 minutes
or so left in the show so i think we
should probably mention also another
point that you made earlier and that is
the there's a relationship between
cross-site scripting attack and cross-site
request forgery so you want to
differentiate a little bit on that
yeah basically what it is is um you're
using the same types of uh you're using
the same tools but for a different
effect now where those first three were
primarily targeting users machines the
fourth type well i would still classify
it as xss but it's generally referred to
xsrf and uh it's specifically going
through and using that client ran code to
exploit the web server now i talked about
this before in like my uh sequel injection
uh script about how you could go through
and automatically use you know like
curl to go through and uh post to pages
and check if their form fields like if you
have javascript validation and you say like
you know uh max width is 40 or whatever
like that and your back end isn't going
through and limiting it to 40 characters
you can still go through and post with the
script from your machine and put that code
into it so if you're stripping out you know
like uh javascript tags and other stuff like
that on the front end on the back end you can
still uh attack it and this makes it a lot
easier and that you know most of the security is
definitely through obscurity for ajax apps
there's a lot of sensitive information uh and
just poking around a little bit you see how
much is like just sort of hung out there
because a lot of people haven't put the proper
effort into security in their applications
that's one thing that i'm always you know pissed
off about is i can understand you know like a
500,000 line you know desktop application or like
oh wow like a 500 million line desktop application
or something like that you know there's going to
be some flaws in there but people really don't
pay attention to security even in simple you know
web applications and uh you can go through and uh
you know like i said before people going through and
storing in the cookie uh user ids user passwords other
sensitive user information and that's on the client end
but on the server end you could go through and um and
post to a page and use it for additional injection
vectors so you could do you know sql injection you'd
actually do direct code injection or try and uh do
buffer overflow attack on the actual web server all
from your javascript you know so you could have this
script go through load your local page on your
machine then load another page within it it grabs it it at
that point has access to all of the actual javascript
functions all of the actual um uh objects that are embedded in
it like all the new stuff that's pulled back via the xml
http request object so even if you have an ajax application like
google mail you can have it go through and normally i guess what i
should make a little bit clearer is you go into gmail or you go into
google maps or anything like that and you right click and you save view source
all of the updated information from the point from which you've logged in
and probably hit a couple of things on their menus has been changing and you're
not going to see that on view source but you can access that information with
your javascript so you can go through and look at all of the different
information in the page and build an attack based on that and then try code
injection and sql injection so it's really like the same old hat but with a new
vector right so uh yeah i don't i don't know if that's uh
very interesting to a lot of people but i've had a lot more fun with that
especially since i write ajax applications to see where the vulnerabilities are
and how i can better design that code right right now that's i think that's
really interesting i don't i bet a lot of people don't realize that
yeah i mean i've seen stuff uh i've seen stuff on other applications and
sources that people have posted where they go through and they essentially
have like an inline query and it's an ajax app and they go you know oh it's not a
direct form you know whatever whatever i'm doing javascript validation and they
can't see the javascript so i'm okay well no you can't just bypass all those
you know security methods you had before just because nobody can see it now
because for you know the intelligent user for all intents and purposes i can see
everything that you have there you're not hiding anything from me as an
intelligent user if i want to go through and for some reason be malicious
right so i mean you know in this case the first three you you know you're
dealing with a lot more users that you can potentially infect
but with this one you can actually go through and say get access to somebody's
database you know what i mean so even if the first three types of attacks aren't
useful for some black hat person their next step would probably be using cross-site
request forgery to actually get direct access to that data right you know if
you can add a million friends you might find a way to actually exploit the server
so that you can add a million friends on the back end
what i'm saying yeah right right right well um i tell you what we're we're running
down to like about 10 minutes or so
so did you want to go into some more detail about this or would you rather talk
about mitigating mitigation and and some stuff that can be done about it or how do
you want to how do you want to wrap this up or how do you want to what do you want to
make sure we cover well just uh i guess i'll just do a quick run through on on you know like
some different vectors and then uh and then sort of tie it up and go into security
but um you know i'd already talked about um you know using the on-air tag uh you can
actually use onload in iframes bodies uh windows and uh images and images are the most common
way of that so that's a very common way to actually go through for uh for the third type
of attack and uh um a lot of data is not encrypted or obfuscated on the client side
you know like i said there's too much trust so you got to lock it down and leave as little
data on the front end as you can as possible uh you can change the form.method specifically
if you look uh in javascript uh for dom it's called form.method and you can change it to post
or get with javascript so if you're playing with a new page like you go through and you
scrape any urls in javascript uh to see what pages they're interact or interacting with if they if
they're not like a regular get you can go through and try posting some of the ids with your own data
right see i really like that that one is really cool to me i like that i think that's a really cool
concept yeah and i mean you know make certain mechanisms like you know https completely vulnerable
because although you're not being able to like sniff on uh on on the actual traffic between the user
and the site this is running from the site so even if you have https directly in and you're being
exploited like they can still grab all the information from the client and all of that you
know data that they're pulling all the html all the javascript code etc etc you could probably make you
know a playback that would pretty much give you all the information that somebody hit on a site from
beginning to end depending on how advanced your attack was so um but i guess basically i'll go
lightly into what can be done you know from a developer and administrator and uh for mitigating
these uh injection vectors and um you know basically it's a hard road to a certain extent you know uh it
gained popularity and people are just cracking down on it now but browsers are going to have you know
trouble tightening the entity controls because with the advent and popularity of mashups you know
going through and using the xml htp request object to gain information from a bunch of different sites
and put a new front on it like uh i think there was a mashup a mashup that actually took uh crime rates
and new york city and actually made it so it displayed an image with an overlay that would show
you all the most dangerous areas of say chicago or new york etc etc right and a lot of those are
really useful so they go through and use you know an api from a specific site and with cases like that
if you go through and you limit um execution of javascript to that site only and make it so xml htp
requests only works within that same domain then you're going to completely kill uh a very popular
line of web 2.0 type uh uh applications these mashups are huge uh if you're been following any
of the web 2.0 stuff yeah and it's and it's only going to get bigger it's only going to get bigger
exactly and that's that's the big problem is what i'm saying is they can't really lock down xml htp
request to the same url because the usefulness of it is sort of the crux of it too right it's going
it outweighs the the dangers yeah or in the developer's mind it does anyway yeah for the
most part but like i said most people never even think about you know security until uh oops uh we've
got a major problem there's a million friends added to somebody or uh yeah we're orcut and somebody
stole like uh 5 000 users uh email addresses and you know like uh login ids and passwords and shit like
uh you know right but um basically um any javascript validation there's something um web form underscore
callback is used in all of the icallbacks with uh with dot net so dot net has what they call an icallback
which is sort of a higher level xml htp request and they generate all of that actual script and make
it quote unquote secure but you can still use the web uh web form underscore underscore callback
javascript function to inject your own information into the callback so it's still possible to
actually attack even if they're using icallbacks other higher level things because on the lower level
it's still an xml htp request object um it's like i said before that's a definite vector i mean i
specifically do a lot of dot net development you know uh i like writing you know in uh open source
software very much but uh unfortunately i have to uh do a lot of uh dot net programming too
well it's not bad c sharp is a bad but um yeah html quoting algorithms uh also are particularly
thwarted by uh or potentially thwarted by browsers that correctly interpret unicode so if you go through
and and you say you know okay i won't allow html encoding if somebody goes through and let's say
you're stripping uh stripping out script tags and then you're going through and you say okay i'm
going to take out you know url encoded uh data to from this text box where people can put in html
and you go through and do a couple other things well you know like they said before with the utf-7 you
know encoding uh you are able to get away away from it there's so many different ways of encoding it that
you know just doing like a blacklist for the most part is not likely to catch everything
um yes input sanitize you know sanitizing input is just one of the biggest ways you can mitigate a
lot of stuff is to just not allow a lot of the tags don't allow the greater than less than you know
if it's not don't allow anything yeah don't avoid it have something that you know lets you let
them mark a box with text in it and use a drop down to say it's red or something like that
but don't allow like any type of special characters whatsoever you know like if you can if you can
lock it down as tight as you can do that you know don't just hope that somebody's not going to do it
because eventually somebody probably will right and actually that's a one of the reasons a lot of
people probably don't know this but will relate to this when i explain it is in most forum software
packages forums you know a lot of this people post different things in forums over the years and that's
where a lot of these things have been seen and tested and implemented as people posting being
able to post html if most forums these days if you notice they're using something that's become
commonly called bb code which is basically another way for you to put a url instead of allowing you to
put an anchor in there or an image tag they will have a set of code it's like usually square brackets
or at least it is in envision power board but most of them are pretty universal with this and you'll put
a bracket called bracket img close bracket then the link to your image and then the open bracket
slash img it's very close to the same syntax but it doesn't allow you to put that greater than less
than it doesn't allow you to insert any kind of html or any kind of code like that so you know you
prevent a lot of that stuff by sanitizing your input yeah and another thing is um you know like uh
tying session cookies to a particular ip address so you make sure that um the ip address of the user
is the only one that has access to that cookie so if you go through and something else tries to request
that cookie even with the same data you don't allow that um if the ip address is different but the
session is the same because somebody could hijack your session and you go through and and uh you know
they grab your cookie from another location well if you have it tied to the ip address you can say
uh-uh there's one open session right now it's tied to this ip address and this other ip address is
asking for this with the same session data i don't think so right and session hijacking is another
topic too that we could go into more detail about on another show as well but point certainly well taken
and uh you can use different stuff to uh make sure that any html you have on your site is uh is well
formed so you can use stuff like uh there's a program called html tidy and that'll go through
and make sure that all of your actual html is well formed um some of the other uh ways that you can
mitigate these uh attacks is there's a different one for ie and firefox there's the http only flag for the
browser if it's ie and uh if i remember correctly that keeps um any uh javascript executed on that page
from executing uh javascript on another page and the firefox equivalent of that is what they call the
same origin policy the same origin policy prevents a document or script loaded from one uh ip address
or domain from getting or setting properties of a document from a different uh domain so the
policy is pretty much there since like netscape navigator like 2.0 um mozilla considers two pages
um that have the same uh domain if the host is basically the same so they have to have the same
base url in order to actually execute so that's very handy um and i'd highly recommend it using both of
those both the http only flag and the um and the uh same origin policy if you can on your ajax application
um there's some other stuff on uh the web server apache you can go through and set it to use only one
character set um you can look at it you can add uh explicit card set you know to the specific iso i
think it's uh 8859-1 um and well there's a bunch of other information but you can you can google you
know setting apache to use only one character set and make sure that you know you won't potentially be
exploited by uh a user going through it and coding the data in a different way different character
set that it that evaluates to the exact same things you're trying to avoid them from using
exactly and that's the thing with the spread of you know so many different languages and and you know
moving towards unicode so that uh people from multiple nations can use the same web page
you know they get into it but the crux of that is that there's so many different ways to encode the
data that you know it's insane right right yeah so like why and and i'm i'm not i'm going to make up
an example because i'm not sure if that translates well to the listener so um i'm going to make this
up as a bad example but you know what equates to the open bracket or to a less than greater than symbol
and your standard character set you can block that from the iso 8859-1 that we're talking about but
if you've got another character set support somebody could send the code for the less than
greater than equal which of course are the open and closed tags through another character set and if
your apache setup will allow that to happen it's going to translate them it is going to allow the
less than greater than because it bypassed your character set using a different character set it is
going to let you do the same thing by basically doing kind of another language if you will pretend that
it supports let's say english and i don't know let's say spanish and spanish character set has a
letter that's a less than sign and a greater than sign you're actually bypassing in english you don't
have the less than or greater than but in another language or another character set which is i'm trying
to make the equivalent there it will allow those characters so that's what the difference is i'm i'm not
sure if that's going to come across over radio but that's the best i can come up with to explain
well here's an easy one for anyone that has a browser they can put in this javascript here's just
a quick little example you can do uh alert uh parens uh string dot from char code 88 comma 83 comma 83
you know end parens end parens from char code as a function itself so you go through and do that right
you have the direct character encoding the numeric encoding for the actual uh character and what
that'll do is it'll actually give you an alert that says xss you know one very easy way of saying
that you know so even though it's uh even though it's just numbers it's correctly interpreted by the
browser as xss right it's it's illustrating the bypassing or the character the characters being
translated correctly exactly there's an american canonical and these are just merely well many
different canonical forms of the same you know data right and you've actually done a little bit
of research here as we wrap this whole thing up and and i should probably mention that um of course
people can go to wikipedia.org and do a search for cross-site scripting and you'll find a lot of
information and links to a lot of other information from that page it's actually got some pretty decent
information there but um you've been doing some research on this too and and we had a code example
did you want to read this on the air the uh we have this let's see it's on pastebin right
yeah it's on pastebin okay so i'll read the url
there's actually a german german example of the exact exploit that was used on orca
to actually harvest all of the user's information okay i'll read they actually got passwords via this
method now it's all closed up now but it's a great example all right i'll read the url
then it's it's d e dot pastebin p-a-s-t-e-b-i-n dot c-a forward slash two five nine two three nine
i didn't tie in the url that because it's already pretty short so d e dot pastebin dot c-a slash two
five nine two three nine and that code doesn't want i'm sorry you you had said i think i interrupted
you while you were saying that oh um it's an example i mean uh aside from that what i'm i'm
currently in the process of writing an automated a uh automated uh ajax vulnerability scanner in
javascript and pearl and basically the pearl end of it is just to process the data and uh sort in a
database and you know manage it so but primarily um the javascript end of it is going through you know
uh any xmlhtp request you know object calls uh any urls etc etc the id and then it uh goes through
the entire list and goes through each url grabs any additional data and tries to test to see if it'll
accept script injection and then go back through and i'm gonna provide uh the new url if it gives it
on the pearl side and go through and see if the vulnerability worked so i'm working on that right
now um for my own applications but uh i may be releasing the source soon i i think it's it's actually
fairly easy to do with most of the pearl modules and the javascript is straightforward too if you look
at um you know most of the ajax uh programming tutorials i'm sure you can find a couple of things
out there on using the xmlhtp request object but um i mean the funny thing is this application could
probably be used uh or written entirely in javascript uh if you don't want logging the information and
you're just going to write it out to the page um that's one of the other things that i just wanted
to close on is that you know javascript is a lot more powerful than a lot of people give it credit
for there's a lot of things that you can do in javascript that would probably flip most you know
even web developers mind you know um probably a good source to just see the power of it
is to uh i think yahoo has their hackaday talks and whatnot they have a couple people go into advanced
uh javascript tutorials and they go into you know how well formed you know it's object oriented and
everything like that but with the advent of ajax you're starting to see people utilize it a lot more
and it's just as exploitable as you know any other application code but you can actually see
it on the client side you know so um i mean that's that's pretty much all i got to say on that uh if
there is significant interest i might go a little bit further down the rabbit hole but uh i guess
that's probably enough information for this show huh yeah yeah and and let's see you know i think we
actually did a pretty good job of not making this too awful dry and using some good examples of it
because again this is one of the topics that it's easier to look at the code and see the examples
so i think we gave enough you know that's why i was saying like with the security scanner i might uh
release that source soon or at least probably put up a couple of uh snippets on the forums i was
thinking because you know a lot of this is probably much easier to see in code than actually describe it
so i you know i tried to explain as much as possible but you know a function is worth a thousand words
right right and um we'll definitely keep everybody apprised when you give us that stuff but between
the the tiny url example earlier the pastebin code we can give people a look at and by the way we're
going to i guess i'm going to use that for site of the week i'm going to be cheap cheap out use
pastebin.ca as the site of the week nice place to post some some code snippets if you need to
um and let's see what else to wrap up the show with any shouts so you got some shouts you want to
give out i'll do uh shouts to my co-workers because i think they might be listening to the show okay and
uh and probably shouts to the normal uh br561 group in uh florida 2600 yeah and uh let's see i'll give
shouts to uh let's see i was talking with living dead and irc earlier so i'll give him some shouts
and let's see i think last time i gave shouts to everybody whose handle begins with an e so this
week i'm going to say anybody whose handle begins with an m as in mia flux and if your handle begins
with an m you get shouts this week um yeah i got shots yeah i'm being so lazy on these days are you
just gonna go like the next round just be like this show has given shouts to the letter m the letter q
yeah like like sesame street yes this show has been sponsored by and made possible by listeners
like you email us if you have like a uh a contribution page for that yeah well that's
a whole nother topic i might just exploit like the BinRev page to add a paypal contribution to me
yeah yeah right we'll see we'll keep an eye on that but on the front page if you do have any feedback
of any kind for this episode or any episode of the show you can email us radio at BinRev.com
uh closing music this week is from beefy and dj snyder it's called twerp tww3rp it's the
elitized twerp from over at songflight.org what i find always find a lot of good music over there
so mia flux thank you for being on the show my friend and um thank you and i did want to add you
know just like the uh prior episode anyone who uh you know has special interest or uh want some more
information or help just wants to play me you can reach me at uh mia flux at gmail.com that's m-e-a-f-l-u-x
at uh gmail all right and um stick around after we're done recording because uh speaking of br561 we
got some plans to talk about for that but until then we will tell everybody that we will see them
next week same hack time same hack channel bitches
hey yo snyi i want to tell a story
the names and dates have been changed to protect the innocent
get out your motherfucking feet
dj snyder come on
come on
do it all
nickel played a nickel it's a nickel for short
the pleasing charming sort when we were kids we used to play fort
in our younger years when i was the green ranger in my mind's eye
monday night raws when my kind would rock the tie dye
nickel was a cool guy just after reading sci-fi
till some knucklehead popular types wanted to hurt my
this is best time forever
i had to use fits
i never promo violence but i will promote this
but i couldn't be around 24 hours of the day
and these bastards got their kicks in the most despicable ways
tell them to shoo away
but insects they keep swarming
like norman in the 90s was the way these kids were storming
and the principal did nothing man that dude was a jerk
he just called my fat ass lazy and my best friend a twerk
so it was work 40 plus ot
keeping nick bruce free and it's not like these kids didn't get off
while trying to bruise
crack conspiracy when i was guinea pulled out of class
helpless in iss while they were beating his ass
i wasn't thinking too fast
i was running my mouth with every syllable another hurtful night in his house
but i was younger and i was too dumb to figure it out
yeah i'm too stubborn and too stupid that's what i was about
but at night we meet up with internet and a coke
and even with a life so painful he was first to tell a joke
and you'll hear what you'll hear and you'll feel what you'll feel
but nick produced emotions that was harder to steal
and first purchase shooters was a way to escape
this isn't going where you're thinking i just ask you to wait
you see over the years my boy developed his dexterity
and race his gpa at the risk of his popularity
and his home situation wasn't ideal to say the least
so of course he was visited daily by the marines
and the recruiters they would grill him and they'd hassle his mom
talking about pride and honor in the hunt for saddam
and how he has him a bomb and how it's ready to launch
let's meet up and talk tomorrow and we'll buy you some lunch
and if you join with us you can do whatever you please
i was the first to tell nicole that this use wasn't worth the squeeze
and i said yo i'll protect it till the day i rock a tube set
to say i think those words are what drove him away
end of the day guess a guy's gotta be his own man
even if that means you're gonna get stationed in iran
but nicole he was smart and not afraid of some work
and after years of working out no one would call him a twerk
and i was reeling from the hurt when my friend put on the camo
and started making jokes about b'lawden with the camo
when he left it's like he was already dead in my eyes
a saluting middle finger when we said our goodbyes
and yo i have me this pride i won't admit that i cry
when i see the bumper stickers that i'll re-simplify
never wanted to die i may be weak but i'm stronger than that
i just want my motherfucking brother back
i may be weak but i'm stronger than that
i'm just waiting for the day that i can get my brother back
bye