XSS found in Linkbucks.com

Linkbucks.com website was found to be vulnerable to Cross Site Scripting(XSS) vulnerability, which could be exploited using malicious scripts.


Vulnerability Description:
==================
Linkbucks.com is a famous advertising network site that brings web users, websites and marketers together. The XSS vulnerability is found in the Default.aspx page. Script can be injected to the Message and Returnurl parameters. This can be exploited by injecting arbitrary HTML and malicious script code, which will execute in a user's browser session. Unvalidated redirection and forwarding is also possible.

Vulnerability testing:
===============
Vulnerable URL: http://www.linkbucks.com/Default.aspx?
Tested with: Firefox 3.5 and Internet Explorer 7 on Windows XP SP3

A simple "alert("You are hACked by w01f")" script was injected to the "Default" page. It was executed and display on the web browser. Malicious script could be executed using this method.



Exploit Code using "alert": Download

- Update on 19 Aug

Below is the video demonstration on exploiting the XSS vulnerability using redirection. It will redirect to my blog. Hacker can redirect to a spoofed Linkbucks site with malicious code.



Exploit Code using redirection: Download

Remediation:
==========
The Message and ReturnURL parameters need to be properly sanitized after a user's logging out. The Linksbuck support team was contacted on the vulnerability. The support ticket is "#KHT-97974-227" but so far no fixed was done.

Reverse Engineering Flash games

Majority of online games uses Adobe Flash these days. While trying out this online games, i was surprised find out that there are still many unsecured flash games. Some are still sending the score in clear text (shown below). I think it is the basic for all online games to protect the score (or data) while submitting back to the server. I even created a simple Web challenge (Data Manipulation attacks for Web applications) on this flaw several months back, to teach and share this knowleadge.



Hashing, good enough?
But there are others that try to protect the score that is transmit back to the server using hashing. They hash the score with a secret key or "Salt". It look safe to many by protecting the data transmission. But they did not protect the Flash itself. It can be easily decompiled to extract the key (shown below) or change the code. Flash code should be obfuscated so that decompiling could not be easily done.



Below is the example of the unsecured Flash game that i came across recently. I had inform their administrator about the possible hacking on their game but they never reply to find out more. So i decided to share some of my finding and show how easy it can be reverse engineered.



Below is function that calls the hashing and submit the user's info and score.


Below shows the "key" or "Salt" that is use for the hashing.


-Update on 19 Jul

After the programmer of the game (that i previously mentioned) tried to secure their code, they were hacked again. This time it looks like an Indonesian hacker, which uses the name "Rank 1 to 10 all cheated" in Bahasa Indonesia, put himself on the top of the score table (with obvious reason).

Looks like the programmer don't understand malay language at all as the name was listed for a few days and was not removed. Time for me to send them a note again.

DOS vulnerability on Internet Browser

While contributing to the OSVDB. I notice about the recent DoS (Denial of Service) vulnerability on the Internet Browser and decided to research on it.

Internet Browser such as IE and Firefox contains a flaw that may allow a remote denial of service. The vulnerability can be triggered when processing a web page with a large number of various invalid request such as NNTP, NEWS and Mailto. This may cause the system to crash due to high resources consumption.

I have tested on some of these exploits. Test at your own risk.

Affected Browser: Internet Explorer, FireFox, Chrome, Opera, etc
OSVDB: 65110
Exploit Code: Download

Wing FTP Server - Cross Site Scripting Vulnerability

The Wing FTP Server was found to be vulnerable to Cross Site Scripting(XSS) vulnerability, which could be exploited using malicious scripts.

Discovered Date: May 31, 2010
System affected: Wing FTP Server for Windows, Version 3.5.0 and prior version
Discovered by: w01f

Vulnerability Description:
==================
Wing FTP server is a multi-protocol file server, which support such as HTTP and FTP. It comes with a Web-based "Administrator" Console. The XSS vulnerability is found in the "Administrator" Web interface . It is accessible using the server IP with default port 5366 (Eg. http://192.168.0.1:5466). Script can be injected to the "POST" command. This can be exploited by injecting arbitrary HTML and malicious script code, which will execute in a user's browser session.

Vulnerability testing:
===============
Vulnerable URL: http://192.168.41.137:5466/admin_loginok.html
Tested with: Firefox 3.5 and Internet Explorer 7 on Windows XP SP3
with Web proxy

In the "Administrator" web interface, from the login page, a simple "alert("You are HACKed!")" script was injected to the "POST" command. It was executed and display on the web browser. Malicious script could be executed using this method.

Remediation:
==========
Discussion with the wftpserver.com support. This vulnerability was not consider critical as it requires authenticated login to exploit. But it will be fixed on the next release in about a month time.

Updated 10 Jun 2010:
The flaw was fixed on version 3.5.1.

References:
- Common Vulnerabilities and Exposures: CVE-2010-2428
- National Vulnerability Database (CVE-2010-2428)
- ISS X-Force Database: wingftpserver-adminloginok-xss (59094)
- SecurityFocus: Wing FTP Server 'admin_loginok.html' HTML Injection Vulnerability
- OSVDB 65444 : Wing FTP Server Admin Interface admin_loginok.html XSS
- SANS: @RISK: The Consensus Security Vulnerability Alert
- Bugtraq: Wing FTP Server - Cross Site Scripting Vulnerability
- Packet Storm: wingftp-xss.txt

XSS vulnerability found on D-Link Router

Cross Site Scripting (XSS) vulnerability was found on the D-Link DI-724P+ Router, which can be exploited by conducting a cross-site scripting attacks.

Discovered Date: May 14, 2010
System affected: D-Link DI-724P+ Router, Firmware Version: v1.03
Discovered by: w01f

Vulnerability Description:
==================
The XSS vulnerability is found in the Admin Web interface. It is accessible using http://192.168.0.1 (by default). Script can be injected from the GET string. This can be exploited by injecting arbitrary HTML and malicious script code, which will execute in a user's browser session.

Vulnerability testing:
===============
Vulnerable URL: http://192.168.0.1/wlap.htm
Tested with: Windows XP with Internet Explorer 7, using Web proxy

In the Admin web interface, under the "wireless" tab, i injected a simple "alert("You are hack!")" script in the GET string. It was executed and display on the web browser.

Remediation:
==========
According to D-Link, the router is out of support and will not be releasing any patches. Continue using on your own risk.

References:
- SecurityFocus: D-Link DI-724P+ Router 'wlap.htm' HTML Injection Vulnerability
- OSVDB 65002 : D-Link DI-724P+ Admin Interface wlap.htm GET String XSS
- SANS: @RISK: The Consensus Security Vulnerability Alert
- Packet Storm: dlinkdi724p-xss.txt
- Full Disclosure: D-Link DI-724P+ Router - Cross Site Scripting Vulnerability