5 ms·
Can not contain "script". I hacked a big social platform in my early teens (Nettby.no), since they just did a removal of all banned words, including <script>.
by matsemann 3y ago
Can not contain "script".
I hacked a big social platform in my early teens (Nettby.no), since they just did a removal of all banned words, including <script>. I instead wrote <scr<script>ipt> in my profile bio, and after their removal I had a valid html tag injected into the webpage and full control of anyone visiting my page..
- i_k_k 3y agoWell, duh: they needed to make sure to run the script twice.
- ht85 3y agoMake it 3 times, you never know how clever those hackers folks could be!
- matheusmoreira 3y agoMake it infinite times and stop after the output stabilizes to a constant string!
- kevincox 3y agoI think this is actually a correct solution. Although not particularly elegant or efficient. If as long as if the string is unsafe the string will be modified. Then looping infinitely will never return an unsafe string. If it is also true that the modifications only delete characters then you will eventually arrive at a safe (or empty) string.
- qingcharles 3y agoLOL. I did the same thing with a Coca-Cola site and their MD wrote me a nasty letter and removed my account.
- alanfranz 3y agooldest injection trick ever :-)
- account-5 3y agoThat's easy, they should have just removed the angle brackets, job done.
- matsemann 3y agoThey allowed some html, though, which is why they didn't safely print your bio as a plain (html escaped) string.
- mtlmtlmtlmtl 3y agoHah, I hacked Nettby in school too, good days. Nettby had no HTTPS, so I did an ARP poisoning MITM and stole everybody's passwords. Then I posted random nonsense from people's accounts and watched the chaos ensue(did no snooping, even 14yo me had a semblance of ethics somehow).
- coolThingsFirst 3y agoEli5 this attack pla
- jcul 3y agoI've no idea what nettby is. But ARP is how computers figure out what IP address is associated with a hardware / ethernet address, so they know what ethernet address to use for sending packets to a specific IP. ARP poisoning means you flood the network with fake ARP packets saying your ethernet address has the gateway IP or whatever IP. So then the other devices will forward packets to your machine instead of the intended destination. As nettby didn't use HTTPS it would then be trivial to capture / read the packets and figure out everyones' passwords. I.e. the messages would be plain text, unencrypted. Not exactly Eli5, but hope it helps.
- mtlmtlmtlmtl 3y agoThis is pretty much the reply I'd write, so I'll just add my endorsement. Couple more tidbits of information: Nettby was a Norwegian Myspace clone and it was all the rage back when I was in middle school(around 2007-2009 or thereabouts). ARP stands for Address Resolution Protocol. ARP has no security built in by default. This combined with the plaintext passwords made the attack trivial.
- coolThingsFirst 3y agoYes but isnt this possible only on LANs?
- mtlmtlmtlmtl 3y ago
- counterpartyrsk 3y agoInteresting, can you explain 'full control'?
- crazygringo 3y agoYou can run any JavaScript. So you can show a popup saying the user needs to log in again, and then log their credentials on your own server instead.
- paledot 3y agoOr exfiltrate their session cookie, or post spam/phishing links on their behalf...
- sillysaurusx 3y agoSession cookies are generally not available to javascript. The latter is true though.
- None4U 3y agoPerhaps HttpOnly wasn't as prevalent back then?
- matsemann 3y agoYup, no CORS either, all protections relied on having proper CSRF-tokens, but with JS access one could read that token as well. My "hack" was mostly pretty harmless. Just did some layout changes to make my profile cooler. But the door was wide open for anything.