#Learn365 Day-6: Cross-Site Leaks

Goldmine to Learn: https://t.co/TsqGRWxPq7

Cross-Site Leaks/XS-Leaks is a less explored security issue that usually comes from Side-Channel Attacks. I found this an interesting vector but unusual.

(1/n)

#BugBountyTips #infosec #AppSec

(2/n)
This basically utilizes the web's core principle of composability in order to determine & extract useful information.

XS-Leaks take advantage of small pieces of information that are exposed during interactions between websites.
(3/n)
Cross-Site Oracle.

This can be considered as a querying mechanism. The information used for this attack is of binary form and called Oracles. It usually has an answer of "Yes" or "No". You can say True or False.
(4/n)
For Example: Does User Harsh Exists in the Application. Yes, means that the user is there in the application.
- An attacker requires to smartly form queries in order to successfully execute this attack and gain hold of sensitive information.
(5/n)
Some of the Attacks using Cross-Site leaks are:

1. XS-Search: An attacker try to abuse the query mechanism such as search functionality to leak and get hold of the user's information.

Remediation
- Same Site Lax Cookies
(6/n)
Usual Exploitation Workflow:

1. Define a timeline when there is a Hit vs Miss
2. Start attacking the Querying Endpoint.
3. For Example: ?search=h (Throws a Hit)
search for the next word appended to `h` i.e. ?search=ha otherwise change the word i.e. ?search=b
(7/n)
2. Error Events

Based on the Error Message returned by the application, it may be possible to enumerate sensitive information. This is similar to user enumeration techniques.

Reference: https://t.co/2iIVT0xei2
(8/n)
3. Frame Counting
The window.length provides the number of frames in the window. This attribute can provide valuable information about a page to an attacker.

References: https://t.co/XjOZL3yiZF
(9/n)
3. Navigation Attacks
Reference: https://t.co/lS3LT80Foa

4. Cache Probing
- Workes based on detecting whether the web page was cached or not.
Ref: https://t.co/ejAdOHaIFG

5. ID Attribute
Ref: https://t.co/11lwLzE2DD
(10/n)

6. Post Message Broadcasts
a. Sharing Sensitive message with untrusted origins
b. Leaking information based on varying content or on the presence of a broadcast

7. Abusing Browser Features
- CORB (Cross-Origin Read Blocking)
- CORP (Cross-Origin Resource Policy)
(n/n)

8. Timing Attacks
- Clock Based
- Network Timing
- Execution Timing
- Hybrid Timing
- Connection Pool

# Referneces
1. https://t.co/byryqh3bql
2. https://t.co/khunvHYDga
3. https://t.co/ssQ39okO55

I'll revisit this attack in near future & will try to find.

More from For later read

There is some valuable analysis in this report, but on the defense front this report is deeply flawed. There are other sections of value in report but, candidly, I don't think it helps us think through critical question of Taiwan defense issues in clear & well-grounded way. 1/


Normally as it might seem churlish to be so critical, but @cfr is so high-profile & the co-authors so distinguished I think it’s key to be clear. If not, people - including in Beijing - could get the wrong idea & this report could do real harm if influential on defense issues. 2/

BLUF: The defense discussion in this report does not engage at the depth needed to add to this critical debate. Accordingly conclusions in report are ill-founded - & in key parts harmful/misleading, esp that US shldnt be prepared defend Taiwan directly (alongside own efforts). 3/

The root of the problem is that report doesn't engage w the real debate on TWN defense issues or, frankly, the facts as knowable in public. Perhaps the most direct proof of this: The citations. There is nothing in the citations to @DeptofDefense China Military Power Report...4/

Nor to vast majority of leading informed sources on this like Ochmanek, the @RANDCorporation Scorecard, @CNAS, etc. This is esp salient b/c co-authors by their own admission have v little insight into contemporary military issues. & both last served in govt in Bush 43. 5/

You May Also Like