3 ms·

I miss these kinda posts, so rare now. I know XSS is dying due to CORS and DLL injection is mooted by ALSR, that API's are usually authenticated and authorized

I miss these kinda posts, so rare now. I know XSS is dying due to CORS and DLL injection is mooted by ALSR, that API's are usually authenticated and authorized, but damn... I wish there was a more collective place to showcase modern exploits, they just hit nice in the feelies.

deleted 3y ago
[deleted]
shitlord 3y ago
ASLR doesn't stop DLL injection.
- l33t7332273 3y ago
  I think GP confused DLL injection with return to libc. I see why; in return to libc, which is prevented by ASLR, you are injecting the control of flow into the middle of a DLL(that DLL is libc). The terminology is a little confusing.
  - Jerrrry 3y ago
    meant hooking functions statically or even dynamically with a minimal amount of codegolf'd asm instructions inserted via buffer overflow, and repairing the stack to sneak by stack smashing detecting, but yea, libc is implied in the linux environment
rainonmoon 3y ago
CORS doesn't prevent XSS and isn't designed to.
nullpt_rs 3y ago
I can sorta share this sentiment. Luckily (for us) tech seems to be moving in the direction of embedding Chromium everywhere which always leads to some fun exploits :)
mtlynch 3y ago
>I know XSS is dying due to CORS CORS isn't related to XSS. CORS actually isn't a security protection at all. It's a way for web apps to explicitly disable standard protections that browsers apply to enforce same origin policy. You might be thinking of Content Security Policy (CSP).[0] That's the most effective protection I'm aware of for XSS, but it's not very widely used because so few JavaScript libraries are compatible with it. [0] https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
- Jerrrry 3y ago
  yea, i meant CSP. >so few JavaScript libraries are compatible with it. is this because of the 'eval' function specifically, or is there other reasons?
  - mtlynch 3y ago
    Yeah, eval is the main culprit, but there's also Function, setTimeout, setInterval and friends.[0] The other gotcha is that with a secure CSP policy, you can no longer do things like <button onclick="handleClick"> because that's inline JS, so that's kind of a bummer. [0] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src#unsafe_eval_expressions https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...

deleted 3y ago

[deleted]

shitlord 3y ago

ASLR doesn't stop DLL injection.

l33t7332273 3y ago
I think GP confused DLL injection with return to libc. I see why; in return to libc, which is prevented by ASLR, you are injecting the control of flow into the middle of a DLL(that DLL is libc). The terminology is a little confusing.
- Jerrrry 3y ago
  meant hooking functions statically or even dynamically with a minimal amount of codegolf'd asm instructions inserted via buffer overflow, and repairing the stack to sneak by stack smashing detecting, but yea, libc is implied in the linux environment

rainonmoon 3y ago

CORS doesn't prevent XSS and isn't designed to.

nullpt_rs 3y ago

I can sorta share this sentiment. Luckily (for us) tech seems to be moving in the direction of embedding Chromium everywhere which always leads to some fun exploits :)

mtlynch 3y ago

>I know XSS is dying due to CORS CORS isn't related to XSS. CORS actually isn't a security protection at all. It's a way for web apps to explicitly disable standard protections that browsers apply to enforce same origin policy. You might be thinking of Content Security Policy (CSP).[0] That's the most effective protection I'm aware of for XSS, but it's not very widely used because so few JavaScript libraries are compatible with it. [0] https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

Jerrrry 3y ago
yea, i meant CSP. >so few JavaScript libraries are compatible with it. is this because of the 'eval' function specifically, or is there other reasons?
- mtlynch 3y ago
  Yeah, eval is the main culprit, but there's also Function, setTimeout, setInterval and friends.[0] The other gotcha is that with a secure CSP policy, you can no longer do things like <button onclick="handleClick"> because that's inline JS, so that's kind of a bummer. [0] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src#unsafe_eval_expressions https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...