HackTricks Press
Search K

Appearance

SOME - Same Origin Method Execution ​

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

WhiteIntel ​

WhiteIntel is a dark-web fueled search engine that offers free functionalities to check if a company or its customers have been compromised by stealer malwares.

Their primary goal of WhiteIntel is to combat account takeovers and ransomware attacks resulting from information-stealing malware.

You can check their website and try their engine for free at:

⛓️ External Link
https://whiteintel.io

Same Origin Method Execution ​

There will be occasions where you can execute some limited javascript in a page. For example, in the case where you cancontrol a callback value that will be executed.

In those case, one of the best things that you could do is to access the DOM to call whatever sensitive action you can find in there (like clicking a button). However, usually you will find this vulnerability in small endpoints without any interesting thing in the DOM.

In those scenarios, this attack will be very useful, because its goal is to be able to abuse the limited JS execution inside a DOM from a different page from the same domain with much interesting actions.

Basically, the attack flow is the following:

  • Find a callback that you can abuse (potentially limited to [\w\._]).
    • If it's not limited and you can execute any JS, you could just abuse this as a regular XSS
  • Make the victim open a page controlled by the attacker
  • The page will open itself in a different window (the new window will have the object opener referencing the initial one)
  • The initial page will load the page where the interesting DOM is located.
  • The second page will load the vulnerable page abusing the callback and using the opener object to access and execute some action in the initial page (which now contains the interesting DOM).

❌

Note that even if the initial page access to a new URL after having created the second page, the opener object of the second page is still a valid reference to the first page in the new DOM.

Moreover, in order for the second page to be able to use the opener object both pages must be in the same origin. This is the reason why, in order to abuse this vulnerability, you need to find some sort of XSS in the same origin.

Exploitation ​

Example ​

  • You can find a vulnerable example in https://www.someattack.com/Playground/
    • Note that in this example the server is generating javascript code and adding it to the HTML based on the content of the callback parameter: <script>opener.{callbacl_content}</script> . Thats why in this example you don't need to indicate the use of opener explicitly.
  • Also check this CTF writeup: https://ctftime.org/writeup/36068

References ​

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!