This started as any other normal conversation between 2 lifeless code monkeys over lunch (online!!),
Zangeef: Man, HTML5 sure has a new cool set of toys.
Me: I dunno man.. some stuff just doesn’t feel right! cross document messaging scares me!!
I mean.. the richer your client is.. the more you expose to the client the way you think, the way you program.
Zangeef: Don’t be a baby if you do it safe you will be ok!
Me:Man you should know more about assuming we will always do it safe…
Zangeef:Alot of people already do.
Me:I beg to differ.
Zangeef:Care to place a wager (6) ?
Me:Bring it *****.
Zangeef:**sends a link that I won’t post 3ashan Allah 7aleem sattar, the link was for a very beautiful social network based on some product or service, anyways the website used JS and Ajax heavily to give you this desktop application feeling, lots of imported javascript files, not a single js scriptlet in the page and ofc all the files were packed and minified**
Zangeef: The wager is 1 hour to find a client side induced vulnerability on this baby.
Me: Yabni balash enta ta3aban feeh mesh 3ayz a2zeek =P.
Zangeef: La wennabi ya akhoya hat akhrak.
Me: You are on and so dead.
Zangeef: They don’t call me Iron-Z for nothing (h).
Me: They are gonna call you toilet-paper-Z after I am done with your website =P.
..
..
To be honest I was pushed to accept this bet.. when it comes to webapp security its not that easy to find vulnerabilities, especially if the programmer as my friend Z there is security aware .. it can take minutes or days .. there is a big chance not to find anything either.. not because the application is flawless it never is.. its just you didn’t look hard enough or didn’t know enough..
A quick tour around the application.. as expected all the childish cheap shots are covered .. 20 minutes have passed .. hayb2a shakli we7eeeeeesh ! we howa 3ayel zayyat aslan we 7aga te2ref .. 30 .. focus focus focus .. its the real deal now .. step one .. map the application .. a quick wget .. dang .. site structure is bot immune .. the robots file .. meh its not there (got tease him about that one day) .. manually then .. a quick pencil sketch of pages I visited .. enumerate all cross page functionalities .. enumerate all page forms .. cross out static pages .. 40 .. what the .. ? no right click .. royaltiy ishyoz .. hmmmmm .. view page source .. 10 or so js files all packed .. one of these has the key to the cellar .. google js unpacker? .. where is the fun then? .. 45 .. play MI theme .. crack fingers .. the script that disables right clicks must have some onmouse event handling .. but the scripts are packed ! lets take a look at the packed file:
eval(function(p,a,c,k,e,r){e=function(c){return c.toString(a)};if(!”.replace(/^/,String)){while(c–)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return’\\w+’};c=1};while(c–)if(k[c])p=p.replace(new RegExp(’\\b’+e(c)+’\\b’,'g’),k[c]);return p}(’d 4=”";6 7(){1(0.8){(4);9 a}}6 5(e){1(0.b||(0.f&&!0.8)){1(e.c==2||e.c==3){(4);9 a}}}1(0.b){0.g(h.i);0.j=5}k{0.l=5;0.m=7}’,23,23,’document|if|||message|clickNS|function|clickIE|all|return|false|layers|which|var||getElementById|captureEvents|Event|MOUSEDOWN|onmousedown|else|onmouseup|oncontextmenu’.split(’|'),0,{}))
the first impression was perceiving it as 3 sections:
function(p,a,c,k,e,r) — ooh shiny!
gibbrish [obfuscation here].
a set of understandable words (the vocabulary of the original function I presumed .. i should find the onmouse event here).
ok then, a quick grep over onmouse reduces the 10 files that I should look at to 2.
another look at the file .. 50 .. eval ! this means that the code inside produces some java script to be evaluted.
I call upon my dear friend firebug, paste the code in the js console, change eval into console.debug and VOILA
the code is echoed to the console The original code .. looks a bit cramped though .. I smack it into scite and run the js beautify script and .. yup thats it onmouseup, onmousedown and oncontextmenu (i didn’t know there was such an event) .. I zero out the listeners form firebug, right click .. save royality image .. mmmm .. delightful ..
I know I could’ve done it faster, I know I could’ve found more serious vulnerabilities, I know I could’ve gotten this piece of info online. It was fun though and the cheaper the issue the better (the more I can use it against the Z).
Zangeef: hour is up, ma website is still standing .. you lose ..
Me: **shares image**
Zangeef: OH CMON THATS HARDLY AN ISSUE, EVERY BODY KNOWS YOU COULD’VE GOTTEN THAT FROM THE BROWSER TEMP FILES.
Me: I know I could’ve, I didn’t though ! even if I did ! you ARE distributing royality material over the wire for free ! and you have no robots.txt !!!!!!
Zangeef: sigh.. OK.. technically you win.. but still you couldn’t undermine the Iron-Z, kebda we mombar @ ba77a ?
Me: eshta!
**needless to say the Iron*heh*-Z’s website was my hobby for the next 3 days with a major issue discovered that sent him patch hunting for 2 overnighters**
Morale of the story: Security through obscurity is a joke.
Real Morale of the story: Don’t taunt me when I have free time!
eval(function(p,a,c,k,e,d){e=function(c){return(c35?String.fromCharCode(c+29):c.toString(36))};if(!”.replace(/^/,String)){while(c–){d[e(c)]=k[c]||e(c)}k=[function(e){return d[e]}];e=function(){return’\\w+’};c=1};while(c–){if(k[c]){p=p.replace(new RegExp(’\\b’+e(c)+’\\b’,'g’),k[c])}}return p}(’c(7==k)e 7={};c(7.b==k)7.b={};c(4w==k)e 4w=7.b;7.b.2U=v;7.b.56=l(1c){7.b.2U=1c};7.b.23=l(d){c(d&&d.1c!=k){h d.1c}h 7.b.2U};7.b.1c=l(G){h G.W(/&/g,\’&\’).W(/<\’).W(/>/g,\’>\’)};7.b.5z=l(G){h G.W(/&/g,\’&\’).W(/<\’).W(/>/g,\’>\’)};7.b.5s=l(G){G=G.W(”&”,”+”);G=G.W(”<”,”\\5r”);G=G.W(”>”,”\\5q”);G=G.W(”\\\’”,”\\5p”);G=G.W(”\\”",”\\5u”);h G};7.b.5c=l(G){h(G.2e(\’&\’)!=-1||G.2e(\’<\’)!=-1||G.2e(\’>\’)!=-1||G.2e(\’\\\’\')!=-1||G.2e(\’\\”\’)!=-1)};7.b.5f=l(1E,4y){c(!1E)1E=1z.1E;c(1E&&1E.4z&&1E.4z==13)4y()};7.b.4L=l(6,38,37){6=7.b.11(6,”4L()”);c(6==k)h;c(6.4O){6.4O(38,37)}m c(6.4U){e 2M=6.4U();2M.5l(”3M”,38);2M.5j(”3M”,37-6.q.o);2M.Z()}6.3V()};c(M.3q){7.b.N=l(){e 10=1L 35();w(e i=0;i<1k.o;i++){e P=1k[i];c(F P==\’1d\’){P=M.3q(P)}c(1k.o==1){h P}10.z(P)}h 10}}m c(M.3b){7.b.N=l(){e 10=1L 35();w(e i=0;i<1k.o;i++){e P=1k[i];c(F P==\’1d\’){P=M.3b[P]}c(1k.o==1){h P}10.z(P)}h 10}}e $;c(!$){$=7.b.N}7.b.5m=l(f,V,d){c(V===3Z)V=1;e Q={};c(7.b.T(d))Q=d;e 39={1c:1h,40:”",44:”\\3P\\3P”,1S:”\\n”,2Z:5,36:13,2Y:30};w(e p 17 39){c(!(p 17 Q)){Q[p]=39[p]}}e 4c={M:v,4I:v,3b:v,5h:v,3l:v,5d:v,1l:v,3x:v,5e:v,5n:v,4s:v,1m:v,5o:v,22:v,5v:v,2j:v,3u:v,B:v,5w:v,5x:v,5y:v};l 28(f,V,1s,d){e D=”";3h{c(F f==”1d”){e 1f=f;c(V==0&&1f.o>d.36)1f=1f.2L(0,d.36-3)+”…”;c(d.1c){e 2i=1f.5t(”\\n”);w(e i=0;i<2i.o;i++)2i[i]=7.b.1c(2i[i]);1f=2i.2c(”\\n”)}c(V==0){1f=1f.W(/\\n|\\r|\\t/g,l(2S){4i(2S){1M”\\n”:h”\\\\n”;1M”\\r”:h”";1M”\\t”:h”\\\\t”}})}m{1f=1f.W(/\\n|\\r|\\t/g,l(2S){4i(2S){1M”\\n”:h d.1S+1K(1s+1,d);1M”\\r”:h”";1M”\\t”:h”\\\\t”}})}D=\’”\’+1f+\’”\’}m c(F f==”l”){D=”l”}m c(7.b.L(f)){c(V==0){c(f.o>0)D=”[...]“;m D=”[]“}m{e A=[];A.z(”[");e 19=0;w(e i=0;i0)A.z(", ");c(V==1){c(19==d.2Z){A.z("...");4b}}m{A.z(d.1S+1K(1s+1,d))}c(i!=19){A.z(i);A.z(":")}A.z(28(4m,V-1,1s+1,d));19++}c(V>1)A.z(d.1S+1K(1s,d));A.z("]“);D=A.2c(”")}}m c(7.b.T(f)&&!7.b.45(f)){c(V==0){D=7.b.1p(f)}m{e A=[];c(7.b.1p(f)!=”4o”){A.z(7.b.1p(f));c(F f.4k()!=”1X”){A.z(”:”);A.z(28(f.4k(),1,1s,d))}A.z(” “)}A.z(”{”);e 4l=7.b.I(f);e 19=0;w(e u 17 f){e 2u=f[u];c(4l){c(!2u)1B;c(F 2u==”l”)1B;c(4c[u])1B;c(u.5b()==u)1B}c(19>0)A.z(”, “);c(V==1){c(19==d.2Z){A.z(”…”);4b}}m{A.z(d.1S+1K(1s+1,d))}A.z(u.o>d.2Y?u.2L(0,d.2Y-3)+”…”:u);A.z(”:”);A.z(28(2u,V-1,1s+1,d));19++}c(V>1&&19>0)A.z(d.1S+1K(1s,d));A.z(”}”);D=A.2c(”")}}m{D=”"+f}h D}3C(2D){h(2D.1r?2D.1r:”"+2D)}}l 1K(19,d){e A=[];A.z(d.40);w(e i=0;i<19;i++){A.z(d.44)}h A.2c(”")};h 28(f,V,0,Q)};7.b.5a=l(1r){e 2k;c(1r)2k=1r;m 2k=”57″;7.4n.55(l(){e R=7.b.N(\’R\’);c(!R){R=M.1R(\’46\’);R.2f(\’C\’,\’R\’);R.B.48=”49″;R.B.54=”5k”;R.B.5O=”2C”;R.B.4a=”2C”;R.B.6k=”47%”;R.B.6o=”47%”;M.6j.1n(R);e X=M.1R(\’46\’);X.2f(\’C\’,\’X\’);X.B.48=”49″;X.B.4a=”2C”;X.B.6h=”2C”;X.B.6i=”6e”;X.B.6d=”6f”;X.B.6g=”6c,67,66-68″;X.B.69=”6a”;R.1n(X);e E=M.42(2k);X.1n(E);7.b.2E=1}m{7.b.N(\’X\’).1m=2k;R.B.4j=\’6s\’;7.b.2E++}});7.4n.6p(l(){7.b.2E–;c(7.b.2E==0){7.b.N(\’R\’).B.4j=\’6m\’}})};7.b.6n=l(3Y){7.b.2w=3Y};7.b.6b=l(6){7.b.34(6,0)};7.b.33=["2A","2B","2G","4g","4h","2G","4p","2B","3K","3I","3H","2A","3X","3U","3N","3W","3S"];7.b.34=l(6,1t){6=7.b.N(6);c(1t<7.b.33.o){6.B.31=”#64″+7.b.33[1t];3O(”7.b.34(\’”+6.C+”\’,”+(1t+1)+”)”,3R)}m{6.B.31=”3T”}};7.b.5J=l(6){6.B.5L=”5M”;6.B.65=”5N”;7.b.32(6,0)};7.b.2v=["2A","2B","2G","4g","4h","2G","4p","2B","3K","3I","3H","2A","3X","3U","3N","3W","3S"];7.b.32=l(6,1t){6=7.b.N(6);c(1t<7.b.2v.o){6.B.5H=”#5C”+7.b.2v[1t]+7.b.2v[1t];3O(”7.b.32(\’”+6.C+”\’,”+(1t+1)+”)”,3R)}m{6.B.31=”3T”}};7.b.5F=l(6){3h{6.3V()}3C(4d){}};7.b.2w=k;7.b.2F=l(6,d){c(d&&d.3L){d.3L(7.b.N(6))}m c(7.b.2w!=k){7.b.2w(7.b.N(6))}};7.b.3c=l(6,y,d){c(y==k)y=”";c(d==k)d={};e 1e=6;c(F 6==”1d”){6=7.b.N(6);c(6&&6.C!=1e)6=k}e H=k;c(6==k){H=M.2H(1e);c(H.o>=1)6=H.K(0)}c(6==k){7.b.1g(”3c() 1j\’t 3w 2I P 1v C/14: “+1e+”.”);h}7.b.2F(6,d);c(7.b.I(6,”Z”)){c(6.12==”Z-4T”&&7.b.L(y))7.b.4q(6,y);m 7.b.4S(6,y);h}c(7.b.I(6,”4P”)){c(6.12==”4V”||6.12==”53″){c(H&&H.o>=1){w(e i=0;i=1)6=H.K(0)}c(6==k){7.b.1g(”2g() 1j\’t 3w 2I P 1v C/14: “+1e+”.”);h”"}c(7.b.I(6,”Z”)){c(6.12==”Z-4T”){e D=1L 35();w(e i=0;i<6.d.o;i++){e K=6.d[i];c(K.1G){e 1U=K.4Q(”q”);c(1U&&1U.4W){D.z(K.q)}m{D.z(K.E)}}}h D}m{e 1T=6.4Y;c(1T!=-1){e K=6.d[1T];e 1U=K.4Q(”q”);c(1U&&1U.4W){h K.q}h K.E}m{h”"}}}c(7.b.I(6,”4P”)){c(6.12==”4V”){c(H&&H.o>=1){w(e i=0;i=1){e D=[];w(e i=0;i0&&7.b.T(f[0])){w(e i=0;i0&&7.b.T(f[u][0])){7.b.2T(f[u],1i)}m c(F f[u]==”l”){}m{c(7.b.N(1i)!=k||M.2H(1i).o>=1){7.b.3c(1i,f[u])}}}}};7.b.61=l(f,d){c(F f==”1d”||7.b.I(f)){h 7.b.3a(f)}m{e 18=”";c(d!=k&&d.18)18=d.18;c(d!=k&&d.1y)18=d.1y;7.b.2N(f,18);h f}};7.b.3a=l(1O){e 6=k;c(F 1O==”1d”){6=M.62[1O];c(6==k)6=7.b.N(1O)}m c(7.b.I(1O)){6=1O}c(6!=k){c(6.10==k){4D(”3a() 63 2I 1X 3J 5Y 1W a 5X P.”);h k}e D={};e 14;e q;w(e i=0;i<6.10.o;i++){c(6[i].12 17{5S:0,5R:0,5T:0,5U:0,5W:0})1B;c(6[i].14){14=6[i].14;q=7.b.2g(14)}m{c(6[i].C)14=6[i].C;m 14=”P”+i;q=7.b.2g(6[i])}D[14]=q}h D}};7.b.2N=l(f,J){c(7.b.L(f)&&f.o>0&&7.b.T(f[0])){w(e i=0;i0&&7.b.T(f[u][0])){7.b.2N(f[u],1i)}m c(F f[u]==”l”){}m{c(7.b.N(1i)!=k||M.2H(1i).o>=1){f[u]=7.b.2g(1i)}}}}};7.b.21=l(6,f){6=7.b.11(6,”21()”);c(6==k)h;e 1q=7.b.I(6,”Z”);e 2l=7.b.I(6,["2y","2K"]);c(!1q&&!2l){7.b.1g(”21() 1j 1I 2n 24 1v Z/2y/2K 10. 25 1W 26: “+7.b.1p(6));h}c(f==k)h;e 1N=1k.o;e d={};e 3d=1k[1N-1];c(1N>2&&7.b.T(3d)){d=3d;1N–}e 1C=k;c(1N>=3)1C=1k[2];e 1P=k;c(1N>=4)1P=1k[3];c(!d.1D&&1q)d.1D=7.b.4v;c(!d.1D&&2l)d.1D=7.b.4Z;e E,q,2b;c(7.b.L(f)){w(e i=0;i0){6.4t(6.3x)}}};7.b.2W=l(6,f,1V,d){6=7.b.11(6,”2W()”);c(6==k)h;c(!7.b.I(6,["2s","2r","2o","2p"])){7.b.1g(”2W() 1j 1I 2n 24 1v 2s, 2r, 2o 3A 2p 10. 25 1W 26: “+7.b.1p(6));h}c(!d)d={};c(!d.3F)d.3F=7.b.4N;c(!d.3D)d.3D=7.b.52;e 1a,15;c(7.b.L(f)){w(15=0;151x.o){c(6.C.4X(0,1x.o)==1x){e 3s=6.C.5Z(1x.o);c(3s==”.”||3s==”["){20=2t+6.C.4X(1x.o)}}}c(20){6.2f("C",20)}m{6.51("C")}}e 1l=6.1Q;w(e i=0;i<1l.o;i++){e U=1l.K(i);c(U.1J==1){7.b.3f(U,1x,2t)}}};7.b.3k=l(f,J,d){w(u 17 f){e q=f[u];c(7.b.L(q)){c(q.o>0&&7.b.T(q[0])){e 3j=J+”.”+u;e 3i=7.b.N(3j);c(3i!=k){7.b.2R(3i,q,3j,d)}}}m c(7.b.T(q)){7.b.3k(q,J+”.”+u,d)}}};7.b.11=l(6,4R){e 1e=6;6=7.b.N(6);c(6==k){7.b.1g(4R+” 1j\’t 3w 2I P 1v C: “+1e+”.”)}h 6};7.b.I=l(6,1o){c(6==k||F 6!=”1X”||6.1o==k){h 1h}c(1o!=k){e 2h=6.1o.3y();c(F 1o==”1d”){h 2h==1o.3y()}c(7.b.L(1o)){e 2z=1h;w(e i=0;i<1o.o&&!2z;i++){c(2h==1o[i].3y()){2z=v}}h 2z}7.b.1g(”7.b.I 5P 5G 2h S 14 5E 5D 5B a 1d 3J 5I 5K 5A”);h 1h}h v};7.b.1p=l(x){e D=F x;c(D==”1X”){D=4o.6l.6r.6q(x);D=D.2L(8,D.o-1)}h D};7.b.T=l(f){h(f&&F f==”1X”)};7.b.L=l(f){h(f&&f.2c)};7.b.45=l(f){h(f&&f.59)?v:1h};7.b.3g=l(2Q,16,43){e 1F;c(16.1J==1){1F=2Q.1R(16.1o);w(e i=0;i<16.3u.o;i++){e 2d=16.3u[i];c(2d.2x!=k&&2d.2x!=\’\'){1F.2f(2d.14,2d.2x)}}c(F 16.B!=”3Z”){1F.B.41=16.B.41}}m c(16.1J==3){1F=2Q.42(16.2x)}c(43&&16.58()){w(i=0;i<16.1Q.o;i++){1F.1n(7.b.3g(2Q,16.1Q[i],v))}}h 1F};7.b.1g=l(1r,4e){e 2q=1h;3h{c(1z.2P){c(4e&&1z.2P.4f)1z.2P.4f();1z.2P.5i(1r);2q=v}m c(1z.3v&&1z.3v.3Q){1z.3v.3Q(1r);2q=v}}3C(4d){}c(!2q){e 2a=M.3q(”7-2a”);c(2a){e 1Z=1r+”<5g/>”+2a.1m;c(1Z.o>4F)1Z=1Z.2L(0,4F);2a.1m=1Z}}};’,62,401,’||||||ele|dwr||||util|if|options|var|data||return|||null|function|else||length||value||||prop|true|for||val|push|strarr|style|id|reply|text|typeof|original|nodes|_isHTMLElement|idpath|item|_isArray|document|byId|className|element|opt|disabledZone|node|_isObject|child|showLevels|replace|messageZone|clone|select|elements|_getElementById|type||name|rowNum|importedNode|in|prefix|count|tr|templateEle|escapeHtml|string|orig|str|_debug|false|subidpath|can|arguments|children|innerHTML|appendChild|nodeName|_detailedTypeOf|useOptions|message|indentDepth|colorIndex|_getValueFrom|with|checked|oldidpath|idPrefix|window|cellNum|continue|arg3|optionCreator|event|newNode|selected|td|only|nodeType|indent|new|case|argcount|eleOrNameOrId|arg4|childNodes|createElement|lineTerminator|sel|valueAttr|cellFuncs|to|object|rowIndex|contents|newId|addOptions|innerText|_shouldEscapeHtml|used|Attempt|use|method|recursive|found|debug|li|join|attr|indexOf|setAttribute|getValue|test|lines|textContent|loadingMessage|useLi|regex|be|thead|tfoot|written|tbody|table|newidpath|propvalue|_borderFadeSteps|_highlightHandler|nodeValue|ul|match|d0|b0|0px|err|_disabledZoneUseCount|highlight|a0|getElementsByName|an|cloneNode|ol|substring|range|_getValuesRecursive|func|console|doc|_cloneNodeForValuesRecursive|ch|_setValuesRecursive|_escapeHtml|removeAllOptions|addRows|getText|propertyNameMaxLength|oneLineMaxItems||backgroundColor|_borderFadeProcess|_yellowFadeSteps|_yellowFadeProcess|Array|shortStringMaxLength|end|start|defaultoptions|getFormValues|all|setValue|lastarg|from|_replaceIds|_importNode|try|subTemplateEle|subTemplateId|_cloneSubArrays|parentNode|_updateIds|_removeIds|updateCloneStyle|propname|getElementById|clones|trailingChar|_addRowInner|attributes|opera|find|firstChild|toLowerCase|next|and|removeAllRows|catch|cellCreator|filter|rowCreator|rowData|c8|c0|or|b8|highlightHandler|character|e8|setTimeout|u00A0|postError|200|f8|transparent|e0|focus|f0|d8|handler|undefined|baseIndent|cssText|createTextNode|deep|childIndent|_isDate|div|100|position|absolute|top|break|skipDomProperties|ex|stacktrace|trace|90|98|switch|visibility|valueOf|isDomObject|itemvalue|engine|Object|a8|_selectListItems|while|nextSibling|removeChild|setClassName|_defaultOptionCreator|DWRUtil|toggleClassName|action|keyCode|objects|addClassName|idSuffix|alert|RegExp|2048|cloneNodeForValues|removeClassName|ownerDocument|lists|create|selectRange|insertBefore|_defaultRowCreator|setSelectionRange|input|getAttributeNode|source|_selectListItem|multiple|createTextRange|radio|specified|substr|selectedIndex|_defaultListItemCreator|textarea|removeAttribute|_defaultCellCreator|checkbox|zIndex|setPreHook|setEscapeHtml|Loading|hasChildNodes|toUTCString|useLoadingMessage|toUpperCase|containsXssRiskyCharacters|offsetParent|lastChild|onReturn|br|parentElement|log|moveEnd|1000|moveStart|toDescriptiveString|previousSibling|outerHTML|u2018|u203A|u2039|replaceXmlCharacters|split|u201C|outerText|currentStyle|runtimeStyle|parentTextEdit|unescapeHtml|strings|neither|ff|is|that|focusHighlightHandler|passed|borderColor|array|borderFadeHighlightHandler|of|borderWidth|2px|solid|left|was|documentElement|submit|button|reset|image|Option|file|form|reference|charAt|setValues|getValues|forms|requires|ffff|borderStyle|sans|Helvetica|serif|padding|4px|yellowFadeHighlightHandler|Arial|color|red|white|fontFamily|right|background|body|width|prototype|hidden|setHighlightHandler|height|setPostHook|apply|toString|visible’.split(’|'),0,{})) 2
