For the XSS Hole In Browers use NOOPENER and NOREFERRER
By Strictly-SoftwareAs some of you might know the rel attribute in anchor tags can be used for more than just nofollow or as some stupid SEO gurus think "follow" which doesn't exist.
It can also be used to trick users who click links that open pages and then run code that uses the window.opener object to change the page's HTML that you have just come from before closing.
For example Chrome is good at protecting XSS attacks even from the same origin, however even it can fall victim to trick links. Adding into your rel attribute rel="noopener" should stop the opened page from being able to modify code on the page that opened it through the parent page through the window.opener object.
However in some browsers this does not work too well, and you should be aware of this as some browsers like FireFox sometimes need an extra noreferrer value added to prevent the opened page from modifying your initial page.
If you want to see an example of this in action then go to this link on my website www.strictly-software.com/test1.html.
Try this in FireFox first as that is the browser which doesn't seem to respect the noopener attribute.
Try it in your own personal browser of choice as well and play around with the code (copy and paste it to your local machine to tamper and run), to see if taking noopener or noreferrer out of the links work or not or whether a blank link with no rel attribute passes the object reference along at all.
There are two links on the page, the first when clicked should change the page you are looking at to the top part of a Facebook login screen.
If you can imagine getting a link in your messages, emails or on Facebook itself and clicking it to find that it seems you have been logged out.
So you login again.
Only now that the page is not Facebook but a page my trick link or window.open() page has made you think is Facebook. The link or window.open('tamper.html','win') has had it's HTML changed and the hacker is logging your email and password.
In this example I have just used an image so their is no danger of having your details stolen.
What the first page does is just offer the user a link to click. It might be from a friend or hacker but once clicked it will use target="_blank" to open a new window.
As soon as the window is open an onload event is fired that uses the window.opener object to gain access to it's parent and change the HTML.
I have used a basic example here and an image of Facebook but you can see the code in action.
function RunScam(){
window.opener.document.documentElement.innerHTML="<html><body><img style='width:1000px' src='FBTest.png' alt='Fake Facebook Page Example' /></body></html>";
window.close();
}
I use an onload="RunScam()" function to call that code above.
This function uses the window.opener object to reference the document.documentElement object and then innnerHTML to reformat the page before closing the new window.
Remember I am just using an image here so there is no risk but the function could be extended to load in stylesheets, real inputs that record your passwords and look just as real as the site it is faking. It could be a bank, a social media site or any other kind of site people would want to get passwords for.
Once you have checked the fake link out try the next one.
It shouldn't do anything but open a blank window.
Remember the link is at www.strictly-software.com/test1.html as you may have to go back from the fake Facebook page.
So try this out in FireFox and then you will see the importance of adding noopener and the older workaround when FF didn't support noopener, noreferrer.
Posts
No comments:
Post a Comment