Xss on blag

Google Wave - Make your friends logout gadget

Fri, 20 Nov 2009 04:04:14 +0000

Adding this gadget to any wave will make people log out when they see it:

The code:

<script type="text/javascript">
top.location="https://wave.google.com/wave/logout";
</script>

Gmail Cross Site Scripting

Sun, 04 May 2008 01:40:13 +0000

El dia de hoy les traigo un pequeño descubrimiento, una vulnerabilidad en el sistema de Presentaciones (para los burros, powerpoint) en linea de Google Mail. El problema es sencillo, y no le tomara mucho tiempo arreglar a los de Mountain View, pero hay algo que me preocupa más. Describire el problema de Gmail rapidamente para poder pasar al detalle del plugin de flash.

Google Slideshows no esta filtrando los hipervinculos de las presentaciones cuyo destino es una URI javascript:, con solo crear un simple enlace, colocarle como destino javascript:alert(1) e insertarlo en la presentacion, es posible ejecutar javascript en el contexto de mail.google.com. Para los que quieran verlo en funcionamiento he preparado un sencillo poc que envia las cookies a un sitio remoto (que no existe), tendrian que enviarse este archivo por correo, y luego verlo en modo de Presentacion desde Gmail.

Firefox 2.0.0.10 released

Tue, 27 Nov 2007 05:40:52 +0000

Mozilla Corporation just released Firefox 2.0.0.10 which includes fixes against JAR uri attacks. This issue affected browsers that used Gecko engine, a quick check showed me that only K-meleon browser was also updated, however there are several Gecko based web browsers that need to get fixed: Gecko-based browsers.

Update: Let’s make that, Firefox 2.0.0.11, which also fixes some regressions.

Google Gadgets XSS (IE6/Opera)

Sun, 25 Nov 2007 09:58:23 +0000

There is a recent discussion on ha.ckers.org regarding a possible CSRF that could allow an attacker to inject an evil gadget on someobdy else’s iGoogle page. After checking the format of the xml file used to define the gadgets properties, I noticed a couple of attributes that could be used as point of injections to active content, the thumbnail and screenshot attribute. Only one of them is vulnerable, the screenshot attribute, by using a javascript URI as value you can execute active content on certain browsers such as IE6. This is a poc that shows an alert with the current document.domain value:

Firefox jar: Protocol Vulnerability

Sat, 10 Nov 2007 10:47:45 +0000

I just came across pdp’s finding jar protocol vulnerability on Mozilla Firefox, I think its a big issue, and the fact that it has been on bugzilla (#369814) for way more than ten fuck*ng days is not a good thing.

According to pdp, this issue makes vulnerable to Cross-site scripting applications that allow users uploading compressed ZIP, and JAR files. After a couple of minutes messing around the poc’s, I figured out that sites with open redirect issues are vulnerable too. I’ve created this poc that attacks Gmail, it’s based on my previous post and it will only show your contacts list, it’s not being logged server side or anything (as some people thought that my previous poc did. Credit to tx for discovering the open redirect issue used to exploit Google / Firefox):

Google Vulnerability

Mon, 24 Sep 2007 03:29:26 +0000

Yesterday, I found a new Google.com XSS vulnerability that can be abused to steal information from Gmail accounts, I’ve done responsible disclosure of at least 3 vulns to Google, but since I haven’t got enough ‘motivation’, I’ll go full disclosure now.

The vulnerability exists in Blogspot polls feature, I had already disclosed a vulnerability on this system. The ‘font’ parameter was not being sanitized before being used inside an STYLE tag, so you could inject IE’s expression() and Mozilla’s -moz-binding. They fixed it, however they didn’t check enough the rest of the code, the new XSS is: