XSS - not as easy as it used to be

I am preparing a lecture about web site security and was starting with good old XSS. I did a very similar lecture two and a half years ago and demonstrated some of the OWASP top 10 on a very big Israeli community site. As it happens the guys from this site finally realized that their site was much like Swiss cheese so the plugged most of the holes.
I thought it would be fun to create a simple asp.net site that will demonstrate the flaws I found back then in the community site. However it seems that with the new age of browsers (all major browsers) and with the new asp.net runtime it is very hard to perform even a simple XSS. I am not a big Microsoft fan (nor a fan of any other big corporate) but I must say that Microsoft did hell of a job making the asp.net almost completely idiot proof for newbie web developers. It checks query string for XSS and throws exceptions at you, it encodes stuff, it validates http request parts – it ruins all the fun :)

But don't worry – I already made the first page demonstrating some ways to perform XSS attacks. I will upload it to this blog sometime in the near future.

Microsoft's ie8 InPrivate browsing & google chrome "Incognito" - not as private as you think...

I was thrilled to find out about the new "InPrivate" feature latly introducted in internet explorer 8. This feature is very usefull when you want to buy flowers to your wife or when you accidently roam into transexual midget snuff p0rn. People suppose that when using this feature no one can know where they surfed (nor the sites themselves or other users on the PC).

Actually, google already had this on Chrome with a feature called "incognito"...

however, something poped into my mind - every site can save (without asking anything) a nice file with extention ".SOL" on your machine. these files are located on -> C:\Documents and Settings\{user-name}\Application Data\Macromedia\Flash Player\#SharedObjects\{some-hash-code}\{ site domain name}\{SOL file}

These ".SOL" files are used by macromedia flash movies for user traking and configuration storage. in this folder you can actually see all sites that has this feature (for example "youtube.com" or "dailymotion.com".

I though that the "InPrivate" thingy or "Incognito" takes care of this but I was surprised to see it doesn't. when browsing in "InPrivate" mode I went to both youtube and dailymotion and found that both sites happily written their SOL files on my machine. So, sites can track my actions even on so called private modes and my wife can find where I was buying her flowers...

so, next time you are "buying flowers to the wife" make sure to cover your tracks (Microsft and google only covers some of them).

Tools for debugging/analyzing web sites

I've found out a couple of weeks ago a nice Firefox add-on, "tamper data", that allows tampering with out coming http requests (POST, GET). The add-on captures even captures requests coming out of Flash which I honestly did not expect.

This little tool can help debugging web pages on development/production and help testing web sites for security issues.

https://addons.mozilla.org/en-US/firefox/addon/966

I can also recommend great tool called HttpWatch which helps analyze the way your web pages load. This is usually the tool for finding out performance related issues. This is much like the freeware "fiddler" only much faster and intuitive imho.


http://www.httpwatch.com
http://www.fiddlertool.com/fiddler/

XSS in Imperva :) I found it

funny stuff:
http://www.securityfocus.com/bid/28279