So lately I have been reading "ASP.NET MVC Pro" and when I read the chapter about security (written by Rob Conery ) I was intrigued by the XSS examples that were in the book and thought to myself that I should give XSS a try.
Wikipedia has the following excerpt about Cross-site scripting
"The term "cross-site scripting" originated from the fact that a malicious web site could load another web site into another frame or window, then use JavaScript to read/write data on the other web site. Over time the definition changed to mean the injection of HTML/JavaScript into a web page, which may be confusing because the name is no longer an accurate description of the current definition."
Now I am not a malicious person so I didn't have any desire to inject JavaScript into some existing site but I was a bit curious as to how easy it is to manipulate one website via JavaScript from another web site. As I like to use DotNetKicks (I also check DotNetShoutOut but was on DotNetKicks when the idea came to me) I decided to see just how easy it would be to Kick my story from my own website rather than having a user leave my site to go to DotNetKicks to kick my story.
Step 1 Inspect the Request and Response.
So the first step would be to see what the site expected when a story was kicked. As I was already at DotNetKicks I read a couple stories and found one that I liked and kicked it. Inspecting the response with FireBug I saw the following.
And for the Headers I saw the following
Looking at the Headers and the Post values it is very evident that they are using an Ajax request with a response type of Json. As they are using Ajax it is very easy to see what JavaScript they are using to create the request.
Now if you look at the headers the "Referer" does have me a bit worried as they might be able to see where the request is coming from but hey I would really like a lot of Kicks so I decided to press on with my quest.
Step 2 Writing some JavaScript to see if it works.
Trial 1.
I first decided to see if I could just make an ajax post request passing in the same variables. The following is the write up in the simplest form.
<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
<title></title>
<script type="text/javascript"
src="http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js"></script>
<script type="text/javascript">
$.post('http://dotnetkicks.com/services/ajax/ajaxservices.ashx',
{ id: 1, method: 'kickStory', params: [41965, true] },
function(response) { alert(response); },'json');
</script>
</head>
<body>
<form id="form1" runat="server">
<div>
</div>
</form>
</body>
</html>
Okay so what was the response?? Well it ends up that Firefox and other browsers see this request to a different domain namely dotnetkicks.com as a security threat and issue the following warning.
Access to restricted URI denied (NS_ERROR_DOM_BAD_URI)
Okay so that doesn't work what about loading dotnetkicks in an iframe on the page (I could use some css to hide it or something).
Trial 2
Here is an iframe example in its simplest
<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
<title></title>
</head>
<body onload="javascript:kick();">
<form id="form1" runat="server">
<div>
<iframe id="dnk" name="dnk" src="http://www.dotnetkicks.com" ></iframe>
</div>
</form>
<script type="text/javascript">
function kick() {
var dnk = window.frames.dnk;
dnk.KickIt(41977, true);
}
</script>
</body>
</html>
Okay so I thought this time it might work a little better but once again I got a security warning in Firefox and IE.
Permission denied to get property Window.KickIt
Once again the error is due to the fact that the iframe does not share the same domain. After some more testing the only cross site request that I was able to perform was a get request with a data type of jsonp using jQuery.
Moral of the story
XSS is not as easy as it sounds, that and you should always differentiate between a get and post request.
Feedback
If you know how I could have gotten it to work shoot me an Email or leave a comment and I will give it a try and update the post