4 ms·

There's an info now at the top of the post > To stir up your interest - check any google service e.g. gmail, you are logged out. Great hook btw. Even more imp

There's an info now at the top of the post > To stir up your interest - check any google service e.g. gmail, you are logged out. Great hook btw. Even more impressively, I have all js on his blog blocked through NoScript and it still worked.

homakov 15y ago
I don't run any JS. It's just an image:D
- jiggy2011 15y ago
  If the target site treats GET and POST identically then that could still be a problem. Just have <img src="http://targetsite.php/form?submit=1&data=gjoprgrger http://targetsite.php/form?submit=1&data=gjoprgrger />
- Roboprog 15y ago
  Have some more nightmare fuel: http://ha.ckers.org/xss.html http://ha.ckers.org/xss.html You can inject the things above into somebody else's data, or hide them in your own page from the beginning, I suppose. As a site developer, you can mitigate some mischief a bit by having any destructive update be a two step process: first get a form (or an "are you sure" page, if no real input is required), and add a nonce to the form, which is submitted back with the "request for destruction and subversion". Of course, the attacker can still request the form, harvest the nonce, and send it back with the attacking request, but now his attack has to be 2 steps instead of just 1. Also, if the nonce has a variable name, he has to know to grab everything off of the setup form, and not just resubmit a hard-coded name. Obviously, this won't stop everybody, but it does force them to try a little harder.
- kaonashi 15y ago
  The internet must be a very dark place for you.
tomjen3 15y ago
Well no, it is illegally accessing a computer system, which i do believe is a felony.
- nitrogen 15y ago
  But he didn't access Google's systems, your browser did. You requested the page, and your browser dutifully loaded the cross-site request image.
  - Cushman 15y ago
    He provided instructions to my browser without my consent, the exact same way he would have if he had done it from his computer. How far are we willing to take the semantics here? I guess a lot of people disagree with this? To clarify, I don't think this guy's guilty of a felony-- to my knowledge computer fraud requires at least some malicious intent or damage. But you seriously think if somebody used CSRF to drain your bank balance that wouldn't count as hacking because it was your browser? That's absurd.
    - andypants 15y ago
      He provided instructions to your browser to include an image. If that is considered 'without your consent', then so is every site that is embedding external plugins, images, and videos. How are you supposed to 'give your consent'? Must you be given a list of all the content on the website before the browser will be allowed to display it? When you requested the page, you gave your consent to load whatever was on that page. If you don't want that, then you should use wget instead of a browser.
      - Cushman 15y ago
        I don't understand this argument. If I buy a box of cereal, and open it to find it contains a live rattlesnake, have I consented to be bitten by the snake because I knowingly purchased the box? Of course I don't know everything that's in cereal -- I trust the manufacturers to provide me with the product I paid for, whatever that involves. But I know for sure that that doesn't involve snakes, and had I had reason to believe that there might be a snake in there, I wouldn't have bought it. And the rational response to this is definitely not "If you didn't want snakes, you should have x-rayed the cereal before you bought it." Arguing that my ignorance of something which I wouldn't have wanted had I been aware of it constitutes consent is severely shaky. (Again, I'm not saying that logging me out of Google is like getting bit by a snake, and I do think it was a decently harmless demonstration of the issue with CSRF for anyone who was unaware. I'm just speaking hypothetically here.)
harshreality 15y ago
I have this catch-all ABE (Application Boundaries Enforcer) rule (in NoScript config, advanced tab, abe subtab, USER rules). The blog didn't log me out of google. Site ALL Accept INCLUSION(XHR, SUBDOC) from SELF++ Anon INCLUSION http://noscript.net/abe/ http://noscript.net/abe/

homakov 15y ago

I don't run any JS. It's just an image:D

jiggy2011 15y ago
If the target site treats GET and POST identically then that could still be a problem. Just have <img src="http://targetsite.php/form?submit=1&data=gjoprgrger http://targetsite.php/form?submit=1&data=gjoprgrger />
Roboprog 15y ago
Have some more nightmare fuel: http://ha.ckers.org/xss.html http://ha.ckers.org/xss.html You can inject the things above into somebody else's data, or hide them in your own page from the beginning, I suppose. As a site developer, you can mitigate some mischief a bit by having any destructive update be a two step process: first get a form (or an "are you sure" page, if no real input is required), and add a nonce to the form, which is submitted back with the "request for destruction and subversion". Of course, the attacker can still request the form, harvest the nonce, and send it back with the attacking request, but now his attack has to be 2 steps instead of just 1. Also, if the nonce has a variable name, he has to know to grab everything off of the setup form, and not just resubmit a hard-coded name. Obviously, this won't stop everybody, but it does force them to try a little harder.
kaonashi 15y ago
The internet must be a very dark place for you.

tomjen3 15y ago

Well no, it is illegally accessing a computer system, which i do believe is a felony.

nitrogen 15y ago
But he didn't access Google's systems, your browser did. You requested the page, and your browser dutifully loaded the cross-site request image.
- Cushman 15y ago
  He provided instructions to my browser without my consent, the exact same way he would have if he had done it from his computer. How far are we willing to take the semantics here? I guess a lot of people disagree with this? To clarify, I don't think this guy's guilty of a felony-- to my knowledge computer fraud requires at least some malicious intent or damage. But you seriously think if somebody used CSRF to drain your bank balance that wouldn't count as hacking because it was your browser? That's absurd.
  - andypants 15y ago
    He provided instructions to your browser to include an image. If that is considered 'without your consent', then so is every site that is embedding external plugins, images, and videos. How are you supposed to 'give your consent'? Must you be given a list of all the content on the website before the browser will be allowed to display it? When you requested the page, you gave your consent to load whatever was on that page. If you don't want that, then you should use wget instead of a browser.
    - Cushman 15y ago
      I don't understand this argument. If I buy a box of cereal, and open it to find it contains a live rattlesnake, have I consented to be bitten by the snake because I knowingly purchased the box? Of course I don't know everything that's in cereal -- I trust the manufacturers to provide me with the product I paid for, whatever that involves. But I know for sure that that doesn't involve snakes, and had I had reason to believe that there might be a snake in there, I wouldn't have bought it. And the rational response to this is definitely not "If you didn't want snakes, you should have x-rayed the cereal before you bought it." Arguing that my ignorance of something which I wouldn't have wanted had I been aware of it constitutes consent is severely shaky. (Again, I'm not saying that logging me out of Google is like getting bit by a snake, and I do think it was a decently harmless demonstration of the issue with CSRF for anyone who was unaware. I'm just speaking hypothetically here.)

harshreality 15y ago

I have this catch-all ABE (Application Boundaries Enforcer) rule (in NoScript config, advanced tab, abe subtab, USER rules). The blog didn't log me out of google. Site ALL Accept INCLUSION(XHR, SUBDOC) from SELF++ Anon INCLUSION http://noscript.net/abe/ http://noscript.net/abe/