Security Bookmarklets

Mon, 28 Jan 2008 23:47:57 +0000

I took a couple of days from my school vacation to write 3 bookmarklets that will help me when auditing web sites, I’d like to share them here because I know that they’ll help some of my friends, and probably one of the two readers of this blog.

[Text2SQLChar](javascript:(function(){ x=prompt(‘Input text:’,’’);l=x.length;t=x.charCodeAt(0);for (i = 1;i<l;i++) t = t +’,’+x.charCodeAt(i);prompt(‘Output: ‘, ‘Char(’+t+’)’); })();) Converts an string into a CHAR() mysql, usefull when magic_quotes is on.
[SQLIncrement](javascript:(function(){url=decodeURI(location);if (url.indexOf(‘select 1’)==-1) { alert(‘Inject a simple 'union select 1' first.’);return; }max=url.substring(url.indexOf(‘select 1’)).split(’,’).length;if (max>1) zx = (max-1)+’,’+max; else zx = ‘select 1’;tmp=url.indexOf(zx);location=encodeURI(url.substring(0, tmp+zx.length)+’,’+(max+1)+url.substring(tmp+zx.length));})()) Increments automatically the number of columns of the injected select query.
[SQLDecrement](javascript:(function(){url=decodeURI(location);if (url.indexOf(‘select 1’)==-1) { alert(‘Inject a simple 'union select 1' first.’);return; }max=url.substring(url.indexOf(‘select 1’)).split(’,’).length;if (max>2) zx = (max-2)+’,’+(max-1); else { if (max==2) zx=‘select 1’; else return; } tmp=url.indexOf(zx);dx = ‘,’+max;location=encodeURI(url.substring(0, tmp+zx.length)+url.substring(tmp+zx.length+dx.length));})()) Decrements automatically the number of columns of the injected select query.
[Increment](javascript:(function(){ var e,s; IB=1; function isDigit(c) { return (‘0’ <= c && c <= ‘9’) } L = decodeURI(location.href); LL = L.length; for (e=LL-1; e>=0; –e) if (isDigit(L.charAt(e))) { for(s=e-1; s>=0; –s) if (!isDigit(L.charAt(s))) break; break; } ++s; if (e<0) return; oldNum = L.substring(s,e+1); newNum = ’’ + (parseInt(oldNum,10) + IB); while (newNum.length < oldNum.length) newNum = ‘0’ + newNum; location.href = L.substring(0,s) + newNum + L.slice(e+1); })();) Allows you to navigate up html files or images that have a number in them.
[Decrement](javascript:(function(){ var e,s; IB=-1; function isDigit(c) { return (‘0’ <= c && c <= ‘9’) } L = decodeURI(location.href); LL = L.length; for (e=LL-1; e>=0; –e) if (isDigit(L.charAt(e))) { for(s=e-1; s>=0; –s) if (!isDigit(L.charAt(s))) break; break; } ++s; if (e<0) return; oldNum = L.substring(s,e+1); newNum = ’’ + (parseInt(oldNum,10) + IB); while (newNum.length < oldNum.length) newNum = ‘0’ + newNum; location.href = L.substring(0,s) + newNum + L.slice(e+1); })();) Allows you to navigate down html files or images that have a number in them.
base64 Firefox only, base64 with no padding

Google Gadgets XSS (IE6/Opera)

Sun, 25 Nov 2007 09:58:23 +0000

There is a recent discussion on ha.ckers.org regarding a possible CSRF that could allow an attacker to inject an evil gadget on someobdy else’s iGoogle page. After checking the format of the xml file used to define the gadgets properties, I noticed a couple of attributes that could be used as point of injections to active content, the thumbnail and screenshot attribute. Only one of them is vulnerable, the screenshot attribute, by using a javascript URI as value you can execute active content on certain browsers such as IE6. This is a poc that shows an alert with the current document.domain value:

Ie on blag

Security Bookmarklets

Google Gadgets XSS (IE6/Opera)