start > 2006-01-15 > 1

Hi5 and XSS Part II

Created by pabrantes. Last edited by pabrantes, 2 years and 190 days ago. Viewed 1,950 times. #4

[diff] [history] [edit] [rdf]

labels

Category:

security

attachments

Hi5 and XSS Part II

Well I've just written a proof of concept on

my hi5.com profile. You need a valid login! While loading my profile, you'll auto-magically be redirected to a spoofed hi5.com page at my webserver, I won't save the information you input, but I suggest you to enter only testing info to try it out!

For the interested the proof of concept is the following:

Since no image will be loaded an onError event will be generated, and automatically the user will be re-asked to relogin, but in the fake page! Since it's not unusual to be asked to relogin at hi5.com there's a potential danger for users to disclosure their information!

ras, 2 years and 167 days ago.

Hi there, I'm guessing I've been hacked on Hi5.com. When I try to view my own profile (Clicking on the 'My Profile' tab) after logging into Hi5 … I'm redirected to some random page with some obscene graphics! Friends who have viewed my page of late, have mentioned that they see the same obscene graphics and almost automatically they've been infected too i.e their profiles get redirected as well!

My page is getting redirected to - http://130n31.4t.com/l.htm

This is happening ever since,I got a request from an unknown person and I clicked on his profile named 'Raj' accompanied with an alien pic

I read your posts 'Hi5 Saga'and 'Hi5 and XSS' and this looks close to some kind of hacking. Could you help me on this? What do I need to do to get it back to normal?!

Thanks,

Ras

pabrantes, 2 years and 165 days ago.

Hello Ras,

I've sent you an email. But since people can find this post, I'll reply it here also.

The attack I've described was a XSS (cross site scripting) attack that you would deploy on your page and affect others that would look your profile. Having your profile changed due to seeing someone's profile, it's a bit more extreme because it would have to do the following:

identify your user well that might not be dificult
be able to submit some code of their own as you, this can be a problem. Since the submissions don't go stored in the URL but in the HTTP Header.

Although I'm not saying it's not possible, I'm gonna look into it a bit. Or could be another totally different problem.

But somehow if it was a script injection on your page here are the tips to see if you can get your profile back:

go to your web browsers preferences and disable javascript
enter your hi5 profile
select My profile and then edit
Check the fields who support HTML and look for strange things you haven't written there.

Also if you find anything please copy/paste and send them back via email or post it here. I would be interested in seeing that.

Best regards,
Paulo Abrantes

Please login to www.pabrantes.net.