10 ms·
Rook to XSS: How I hacked chess.com with a rookie exploit
- jjbinx007 3y agoHmm, I don't think this is related but I've personally witnessed (and even recorded) other people making MY moves in chess.com games and also I've been served up a game in progress and I've been able to make moves when I shouldn't have been able to. There are plenty of threads about this too if you Google it. No idea if chess.com have fixed this in the last few months, but they didn't want to listen when I tried to report it. All these games were when I was not logged into the site. It's never happened to me whilst logged in, but I don't play chess that often as it's no good for my blood pressure!
- TowerTall 3y agoHow can you tell that they are making your moves?
- rendall 3y agoSorry, I don't understand. When you wrote people are "making your moves" do you mean they are substituting your moves with their own in a game? Or that they are mirroring moves from one of your games into their own game? Or something else?
- magpi3 3y agoI think he means they were literally moving his pieces.
- JyB 3y agoMy moves? What do you even mean
- dfreire 3y agoI understood it as when it was his turn to play, his piece moved without him moving it
- Uptrenda 3y agoI was expecting this to be more nooby based on the title. But instead they built an exploit that bypassed multiple input validation stages with clever hacks. Even going as far as to setup sub-domains to resemble the base domain. I'd not have expected this to work and found it neat in itself. But I guess seeing how complex domains are to parse with regex makes it easy to miss things (or maybe it was just something like a: '... in variable' check, idk.) Author knows their stuff. I admire how much dedication that kind of craft takes. Spending so much time to get further along. Would make for an interesting career.
- gnrlst 3y agoAlso very young making it even more impressive, considering they were born > 2005 according to the author's passing mention in the post.
- hot_gril 3y agoThe first exploit of friending profile visitors was pretty simple at least, and also the title is a pun. But then it got very complex going for a full XSS.
- orenlindsey 3y agoVery cool. I love seeing bug bounty write-ups, especially XSS. They always seem so easy to find (but that's just confirmation bias, I don't get to see the hours of testing and rabbit trails that go nowhere).
- sureglymop 3y agoIn my experience they are usually found after finding something weird by accident. Then the real challenge is to exploit that flaw (in this case with the text editor).
- fuomag9 3y agoI can confirm this, I've found a lot of stuff by accident during my years doing bug bounty
- tiffanyh 3y agohttps://lichess.org/ https://lichess.org/ The best I’ve found. It’s also crowd funded and they talk about their interest tech as well.
- j0hnyl 3y agoI love lichess, their mobile app is such a pleasure to use compared to chess.com.
- edgyquant 3y agoI do use lichess on my iPhone, mostly because the pieces don’t even show up on chess.com. If I’m at my laptop though it’s chess.com
- edgyquant 3y agoI and many others find the UX to be worse, the tutorials/lessons definitely way less interactive (usually consist of just a text dump) and the sheer number of games where the opponent doesn’t make a single move to be extremely frustrating. It’s also impossible to discuss anything related to chess.com on here or Reddit because lichess people tend to downvote and brigade anyone who doesn’t praise it.
- kthxb 3y agoUX is probably a matter of habit, I for one find the chesscom UI unintuitive and I can never find what I'm looking for, but Lichess certainly also has its problems. The free and (to me) intuitive analysis tools on Lichess are the killer feature for me.
- phyzome 3y agoWhat does "OSRF" stand for? Is this like CSRF, but... "Own-Site Request Forgery", maybe?
- lkbm 3y agoYeah, pretty close: "On-site request forgery"[0] [0] https://github.com/daffainfo/AllAboutBugBounty/blob/master/On%20Site%20Request%20Forgery.md https://github.com/daffainfo/AllAboutBugBounty/blob/master/O...
- cortesoft 3y ago> This feature reminded me of the MySpace worm in ~2005 (heck, I wasn't even alive then!) Well damn, I get older every day
- dhosek 3y agoMy ex-wife managed the security team at MySpace from about 2006 to 2008. The really wild part was when she went online to the MySpace hacker forums to see how the days’ work had gone. The insistence on allowing users to put HTML onto the site was a huge problem. These days, I think the solution would be to do a proper parse of the HTML input and remove forbidden attributes and tags, but back then it was handled via insanity with regexes.
- paulpauper 3y agoPpl were coding up xss back in the day on Myspace to spread ringtone offers
- deleted 3y ago[deleted]
- hot_gril 3y agoInnocent users getting pwned aside, that sounds fun, an anarchy website in Windows XP days.
- orenlindsey 3y agoThey seriously tried to parse HTML with regex? That's crazy.
- charcircuit 3y agoThey were using regex to block bad input without needing to parse HTML.
- samatman 3y ago
- atdt 3y agoCould someone explain how re-directing from a subdomain (chess.com.foo.bar) somehow got past some same-origin check?
- fnimick 3y agoIt wasn't a proper same-origin check - the server code was checking to see if the image was hosted elsewhere, and if so, it would download and self-host it. The code to check if it was on `chess.com` probably just checked to see if the domain included that string, because laziness.
- semitones 3y agoif it's happening server side they might have had a bug where they are doing naive substring comparison instead of actual domain evaluation
- DistractionRect 3y agoClearly chess.com was using something like "starts with" to process the re-upload. Basically don't re-upload if it starts with https://chess.com https://chess.com, but filter out if it starts with https://chess.com/registration-invite https://chess.com/registration-invite Typically same origin policies are relaxed for things like images by default [0]. So they came up with a trampoline, they created a chess.com.theirDomain.tld to get past the re-upload filter, which in turn returned a redirect, which the browser followed. [0] https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy#cross-origin_network_access https://developer.mozilla.org/en-US/docs/Web/Security/Same-o...
- betenoire 3y agoit sounded server side code allow-list the source, so it was probably just doing a string prefix check. the code to make the friend relation doesn't happen in the browser
- JakeSkii 3y agoOP Here - Like the others have said, it wasn't a proper same-origin check. We'll never know for sure how it was handled beacuse it was all done server-side but I'm guessing it was something like an if in statement on the FQDN, hence why I was able to get away with pointing it to my own domain.
- bbno4 3y agoWow! This is so cool, love the pun in the title hehe
- JakeSkii 3y agoThank you!
- JakeSkii 3y agoHi, OP here! Thank you all so much for the positive commments. To give some background: I'm a 17 year old student in the UK doing my A-Levels, still deciding what uni to go to and looking for degree apprenticeship options! You can checkout my github profile here -> https://github.com/Jayy001 https://github.com/Jayy001 (I'm one of the core members behind HashPals, creating Search-That-Hash as well as being a maintainer for the open-source repository of free software for the ReMarkable tablet)
- tehlike 3y agoI am going to try referring you for Meta. Can you send me your resume/email/etc to tehlike gmail com?
- 1over137 3y agoWhy would you want to punish the lad with working at Meta?! He seems like a nice chap.
- tehlike 3y agoI want to hire good people to the company i work for. Is that wrong?
- endofreach 3y agoYes, facebook is an evil corporation. Also: stop calling it meta everyone. Don't let them get away with such a poor away to hide their past & also claim a powerful word like that.
- mewpmewp2 3y agoWhy are they evil? And if someone wants to do good for the World, why not join an evil corp to inflict change from within?
- consumer451 3y ago
- hot_gril 3y agoThe part about the rich text editor being a "holy grail" is funny. Chess.com is a big website, but I always see those editors and other extra fancy features on random old forums and wonder if the site is Swiss cheese. Anyway, great writeup!
- lovasoa 3y ago> This feature reminded me of the MySpace worm in ~2005 (heck, I wasn't even alive then!) I instantly felt old.
- consumer451 3y agoDon't worry about this too much. It gets worse. My question to OP about this event: how did you learn about this? Darknet Diaries, or via something else?
- JakeSkii 3y agoA video by WIRED came up in my YouTube feed about it.
- consumer451 3y agoThanks for taking the time to reply! I am old enough to have a fuzzy memory of it happening at the time, but here is the podcast with Samy that cemented it in my brain: https://darknetdiaries.com/episode/61/ https://darknetdiaries.com/episode/61/
- consumer451 3y agoBTW, since you just got here... I find this useful: http://www.hnreplies.com/ http://www.hnreplies.com/
- djha-skin 3y agoI don't know this required a lot of thought. Didn't really feel like a rookie exploit.
- plugin-baby 3y agoGreat write-up! Why isn’t the PHPSESSID cookie HttpOnly? And why if the XSS was already known had they not fixed it?!
- jpc0 3y agoI've had arguments with people storing session tokens in local storage and claiming it is perfectly safe. Not marking the cookie httpOnly ironically doesn't surprise me. TLDR: if you aren't going to look up the very basics of security just use a trusted library
- JakeSkii 3y agoJust to clarify, the PHPSESSID cookie was HttpOnly - I could extract the new value because I had overwritten it. Most of the cookies were set correctly (thankfully) however there was a lot of SPII stored in JS variables which I was able to get.
- mmsc 3y agoCool bug. Google did not like me setting up a chess.com subdomain, and a couple of weeks later, my domain got flagged for "phishing." - I had to contact them to explain and manually remove it as it affected my whole domain. What? Google’s domain registrar will close your account if you have a subdomain which just happens to be named another website?
- JakeSkii 3y agoOP - I'm honestly not sure what happened, it could be just based on the naming or something else to do with it. Either way, when I visited it, Googles Safe Browsing alert popped up with "Deceptive site ahead - recentley detected phishing".
- lobsterthief 3y agoThis is a newish _Chrome_ feature (within the past 2 years) that Google rolled out. Any subdomain that looks like a domain (especially ending in a common TLD) will trigger that warning. I learned that because, at work, I architected a system for serving certain assets for customer sites at a subdomain off a shared root domain, keyed by their full domain (like example.com.example.org—where example.com is the customer’s site domain). We ended up changing to example-com.example.org which is far better anyways since this feature started breaking stuff once it rolled out. But this is a Chrome feature and should not affect your rankings themselves. But couldn’t hurt to take it down just in case.
- JakeSkii 3y agoInteresting, thanks for the insight!
- Jerrrry 3y agoBack when my sole internet experience was playing (losing) every match on Chess.com as a "volunteer librarian", I'd often inject awkwardly escaped characters, closing tags, common quirky control strings, and even OLE objects into the live Chess.com games. Eric (founder) had politely asked me for a more formal audit (to which I declined, not wanting to out myself as an 11 year old script kiddie) but I did explain the RegExp needed for the chat room censor and we tackled the ultimate problem; how to detect cheaters in asynchronous environments. After consideration I informed him the only way to possibly detect cheaters is to compare every (game-significant/high-mu) move made against the known optimal moves from engines, and use statistical inference to discriminate good humans from cheaters. Of course, at the time, this was laughably unfeasible - which was the answer we had concluded on. But for a barely out of elementary kid to discuss those kinda nuances with a legit webmaster (Hello Eric!), it is one of my more favorable internet memories.
- pprotas 3y ago[flagged]
- leoff 3y ago> the only way to possibly detect cheaters why would this be the only way? I can think of many different things you can do to detect cheaters
- MereInterest 3y agoAny detection scheme based on extra information from the client could be defeated by running the chess engine on a separate computer. A human typing in their next move is indistinguishable from a human copying a move from an airgapped chess engine. Therefore, the only information that can be used to tag cheaters is the moves themselves.
- leoff 3y ago> Any detection scheme based on extra information from the client could be defeated by running the chess engine on a separate computer Response time and strength consistency could be detected regardless of having another computer. If a person is always playing fast moves, or playing very consistently or very inconsistently good moves, they could be detected.
- wycliffb 3y agoNo such thing as a rookie exploit
- olliej 3y ago“ This feature reminded me of the MySpace worm in ~2005 (heck, I wasn't even alive then!)” Goddammit young people :D
- deleted 3y ago[deleted]
- rainonmoon 3y agoGreat writeup OP! And good luck on your hacking journey. Just in case you haven't come across this yet, when you find parentheses being filtered/encoded in a payload like alert(1), try alert`1` using backticks. Some great resources if you want to take your JavaScript injection to the next level: Brute Logic's XSS cheat sheet and Gareth Heyes's Javascript for Hackers. Some people roll their eyes at cross-site scripting but it's still very powerful and very widespread (and as plugin-baby pointed out, especially when session cookies aren't flagged as HttpOnly, eek.)
- JakeSkii 3y agoThank you, will take a look!
- nnevatie 3y agoSome typos in the URL: htttps://chesss.com/registration-invite?hash=XXX
- JakeSkii 3y agoOP - Wow, can't believe I missed that! Thanks!
- cube00 3y ago> During the bug-bounty report & triage, the developers tried to implement a block because when I tried to reproduce it again for them, it came up with the following error message ... Hardly in the spirit of a bug-bountry program.