Re: Recent Application Test

[Jon McClintock <jammer () weak org>]

On Wed, Aug 18, 2004 at 08:05:09AM -0000, ramatkal () hotmail com wrote:
> During a recent Application pen test I came across a url of the form:
>  
> http://www.vulnsite.com/cgi-bin/vulnscript.jsp?url=www.website.com&id=12345
>  
> I changed the url parameter to something like url=www.google.com and google appeared in my browser. Next, i changed 
> the url to url=www.whatismyip.com, hoping that the ip address of the webserver would be displayed, however, only my 
> ip address was displayed.
>
> This means that my browser is loading the url parameter as opposed to the webserver script fethching the url and then 
> displaying it for me in my browser right? Is this a security issue?

Take a closer look at the HTTP traffic between your browser and the web 
server. My bet is that the server script is issuing a browser redirect.

> Assuming that it was the actual webserver script fetching the url parameter and then displaying it for me, I've come 
> up with a few vulnerabilities (listed below) and was hoping that people might like to share some of their ideas.
>    
> 1) Can use vulnsite as a proxy (& hack other sites)
> 2) Can port scan using the vuln site by changing url=www.website.com to url=www.sitetoscan.com:port
> 3) Can connect to & port scan machines behind the firewall.

4) Any of the problems associated with cross site scripting, including:
a) Cookie theft
b) Phishing
c) Fraud and misrepresentation

-Jon

------------------------------------------------------------------------------
Ethical Hacking at the InfoSec Institute. All of our class sizes are
guaranteed to be 12 students or less to facilitate one-on-one interaction
with one of our expert instructors. Check out our Advanced Hacking course,
learn to write exploits and attack security infrastructure. Attend a course
taught by an expert instructor with years of in-the-field pen testing
experience in our state of the art hacking lab. Master the skills of an
Ethical Hacker to better assess the security of your organization.

http://www.securityfocus.com/sponsor/InfoSecInstitute_pen-test_040817
-------------------------------------------------------------------------------