Thursday, 23 July 2015

XSS, Extensions and Content-Types

In this post I'll look at which Content-Types and Extensions can actually be used for XSS in modern browsers.


Why does Content-Type and Extension matter?

Applications come in many different shapes and sizes and XSS can occur all over the place. It's easy to assume that just because an application returns you a response with unfiltered/unencoded output you've found an exploitable XSS issue but this is often not the case. Browsers render content based on a number of factors including content-type returned by the server, page content and page extension, without the correct combination XSS won't be possible.

To try and get a definitive answer of what works and what doesn't I thought I'd do some testing. I used multiple file types each containing their legitimate content however I also embedded a JavaScript alert payload in each. Each test case was ran against Chrome 43, IE 11 and Firefox 39. In the tables below "yes" means the payload rendered and "no" means it didn't.


Test #1 - Following Best Practice

In the first test I forced the server to return the correct extension and content-type for each test page.


Content-Type
Extension Chrome IE Firefox
None None yes yes yes
text/plain txt no no no
text/html html yes yes yes
application/javascript js no no no
application/json json no no no
application/xml xml yes yes yes
text/css css no no no
image/jpeg jpeg no no no

Following best practice modern browsers appeared to be pretty secure. The one exception appears to be XML, it seems odd that the browser would allow the rendering of JavaScript in an XML file.


Test #2 - Modifying Extension

In the second test I made the server return the correct content-type but forced a .html extension.

Content-Type
Extension Chrome IE Firefox
None html yes yes yes
text/plain html no no no
text/html html yes yes yes
application/javascript html no yes no
application/json html no no no
application/xml html yes yes yes
text/css html no no no
image/jpeg html no no no

This test seemed to show that browsers will prioritize the use of the content-type over the extension.


Test #3 - Using a text/html Content-Type

In the third test I used the correct extension for each file but made the server return a text/html content-type.

Content-Type
Extension Chrome IE Firefox
text/html None yes yes yes
text/html txt yes yes yes
text/html html yes yes yes
text/html js yes yes yes
text/html json yes yes yes
text/html xml yes yes yes
text/html css yes yes yes
text/html jpeg yes no yes

It looks like browsers rely heavily on the content-type returned by the server. It doesn't matter about the extension or contents of the file, the browser will blindly follow the content-type returned.


Test #4 - Using a text/plain Content-Type

Next I used the correct extension for each file but made the server return a text/plain content-type.

Content-Type
Extension Chrome IE Firefox
text/plain txt no no no
text/plain html no no no
text/plain js no no no
text/plain json no no no
text/plain xml no no no
text/plain css no no no
text/plain jpeg no no no

When using a content-type of text/plain none of the payloads executed. I can't remember for sure, but I believe in the past text/plain used to allow XSS? Looks like this is no longer possible.


Test #5 - MIME sniffing

In this last test case I accessed a page that had no extension and received no content-type header from the server. This should have caused the browser to fall back on mime sniffing to render the page.

MIME
Content-Type Extension Chrome IE Firefox
text/plain None None no yes no
text/html None None yes yes yes
application/javascriptNoneNone yes yes yes
application/json None None no yes no
application/xml None None no yes no
text/css None None no yes no
image/jpeg None None no no no

Both Chrome and Firefox refused to render pages that contained additional non-html content. IE however didn't seem to care what the page content was, if it contained HTML it rendered!

Conclusion

Performing application testing on a regular basis I find content-type and extension XSS issues arise quite a lot. This test showed that modern browsers are relatively secure as long as the correct content-type is returned. All browsers also seemed to implement the same analysis techniques aside from IE which seemed slightly more permissive.

Hopefully you guys have found this post useful, if anyone has any suggestions for bypasses to achieve XSS in any of the above, or if I've listed any findings incorrectly (quite possible) drop me a message below :)

Pwndizzle out.

107 comments:

  1. Thanks, very useful information!

    ReplyDelete
  2. By the way, this information will help you to write an abstract for a dissertation. It's important to know

    ReplyDelete
  3. Given article is very helpful and very useful for my admin, and pardon me permission to share articles here hopefully helped :

    Cara Mengobati BAB Berdarah Secara Alami
    Cara Menyembuhkan Syaraf Kejepit Secara Alami

    ReplyDelete
  4. Awesome! We’re looking forward your blog
    I have some suggestions. Here is a blog - Photo editing & photography tips.
    This may help you to find something useful

    ReplyDelete
  5. This comment has been removed by the author.

    ReplyDelete
  6. In this post I'll look at which Content-Types and Extensions can actually be used for XSS in modern browsers.
    Dissertation VS Thesis

    ReplyDelete
  7. A paper that determines or describes a specific term is called a definition essay. At first, it seems that there is nothing easier than creating such an academic work. However, you can always buy definition essay.

    ReplyDelete
  8. Thanks for sharing this nice post. I am surprised to see your work. You shared an informative post. I appreciate you for your good work. Carry on your journey of hard work. Get help from dissertation proposal writing services, a distinctive writing company UK

    ReplyDelete
  9. We support all types of HP printer troubleshooting and service. Just enter the model number of your printer in 123.hp.com/setup to identify the software and drivers your printer requires. Download and install it in your mac and 'Run' the file. The process is easy however if you have any doubts or queries regarding HP printers contact us.

    ReplyDelete
  10. What a nice blog! I have enjoyed reading through the article although I landed on this site while I was looking for research paper writing, which to which speech time calculator concluded. I will be visiting this site occasionally to read more interesting and intriguing articles. I hope the writer will continually keep us updated with new information.

    ReplyDelete
  11. Very nice blog,
    Thanks for sharing grate information.

    From: Laptop Technicians

    ReplyDelete
  12. Looking for academic assistance? click this link now It is a place where you’ll get great papers for a reasonable price.

    ReplyDelete
  13. Sometimes it's a great idea to check some interesting blogs. As well, people can help each other. For example, I prepare some samples of interview paper. It can be a beneficial item for students.

    ReplyDelete
  14. If you're looking to lose fat then you certainly need to try this totally brand new custom keto meal plan.

    To produce this keto diet service, licenced nutritionists, personal trainers, and cooks joined together to provide keto meal plans that are useful, convenient, cost-efficient, and enjoyable.

    From their first launch in early 2019, hundreds of individuals have already remodeled their body and well-being with the benefits a good keto meal plan can offer.

    Speaking of benefits; in this link, you'll discover 8 scientifically-tested ones offered by the keto meal plan.

    ReplyDelete
  15. Thanks for all the tips mentioned in this article! it???s always good to read things you have heard before and are implementing, but from a different perspective, always pick up some extra bits of information. Visit@:- mcafee.com/activate | office.com/setup | adviser for you || Webroot.com/safe | mcafee.com/activate | norton.com/setup

    ReplyDelete
  16. If you are looking for the law assignment help then in this case you can opt for our Law Assignments help .we provide the best Online law assignment help.We also provide Criminal Law Assignment Help for students across the globe. for more information contact us +16692714848.

    ReplyDelete
  17. Zic Info (Health & Fitness)
    Thanks For Sharing This Brilliant Article... I have you bookmarked to check your new posts

    ReplyDelete
  18. we appreciate you for this article. if you are interested in bitcoin and want to buy in India then you should know "Is Bitcoin legal in India" and "Is BItcoin allowed in India". here we provide you all about bitcoin and crypto news that's encourage you to invest in.

    ReplyDelete
  19. Thanks for writing this! It’s exactly how I feel about it! It’s extremely annoying how so many people cheat just to make themselves “look good” .

    Free WordPress Themes
    Free WordPress Portfolio Themes
    WebFreeThemes

    ReplyDelete
  20. best boho dresses and jewelry at amazing price @bohemian land
    feel

    ReplyDelete
  21. pep up look of your car by these super elegant car accessories @ auto x tools
    good

    ReplyDelete
  22. Hello! I know that more and more people look for a writing help. Some of them can find such help at the essay wring service. There people can find such information what are the three theoretical approaches to ethics

    ReplyDelete
  23. Quickbooks is the advanced accounting software to track and manage business data conveniently. The software is enriched with multiple accounting features.
    Quickbooks data Transfer

    ReplyDelete
  24. This comment has been removed by the author.

    ReplyDelete
  25. Good afternoon! Liked this post. Wanna read similar articles? Visit a service https://essays-writer.net/health-care-research-topics-for-argumentative-essay-best-ideas.html. There are plenty of enlightening articles.

    ReplyDelete
  26. I am very thankful for share this post. Buy real leather jackets with worldwide free shipping.
    Harley Davidson Jackets
    Superhero Leather Jackets
    Aviator Leather Jacket
    Motogp Leather Jacket

    ReplyDelete
  27. Plantation shutters are always form royal look to the property with choice of varieties in the material from real wood, PVC to Faux wood materials that providing premium quality compared to other blinds and especially great when that comes from Australian Window Covering, Victoria.
    plantation shutters

    ReplyDelete
  28. A failure to compose a decent article review or any other piece of writing can often result due to the lack of necessary skills, time, experience, as well as knowledgeable article review writing service is there to help you.

    ReplyDelete
  29. Custom application development solutions is meant for designing a software specially for an organization. The advantage of custom application over standard applications is that standard applications were designed with a general set of features to be used by different verticals and organization.

    ReplyDelete
  30. Best Hospital management system. It including Hospital billing, Hospital appointments, Hospital scheduling, Hospital regulatory compliance and Hospital financial auditing within healthcare management software by Accurate Infosoft

    ReplyDelete
  31. DevilSon has been producing high-quality motogp leather jackets, aprilia motogp clothing, dainese motogp collection, kawasaki motogp apparel, ktm motogp clothing for its customers for a long time. The main aim that we pursue is to deliver quality. Every step that goes into the making of a leather jacket, from collecting the raw material to making the finished products, involves the hard work of our highly trained staff.

    ReplyDelete
  32. We will like to introduce our Firm as manufacturer and exporter of high quality Garments, Sports Wear Garments, school wear garments /blazer. We have gained excellent reputation among our clients worldwide. We are delivering our excellent quality American football Uniform, baseball uniform, soccer uniforms, track suits, hoddies, worldwide towards entire satisfaction of our valued customers.

    ReplyDelete
  33. Leather fashion jacket never runs out of style and if you’re looking for best articles regarding Harley Davidson leather Jackets, you’re just at the right place.
    JnJ is a registered firm that deals with all kinds of leather jackets, including motorbike racing suits, motorbike leather jackets and leather vests, leather gloves, for both men and women.

    ReplyDelete
  34. Established in 1997, PunjabStar had a clear focus, to be involved in the sporting and active lifestyle community by offering great custom Team Uniform and athletic Athletic Apparel. Our focus is making Sportswear we love and giving our customer a positive holistic experience through design to delivery.

    ReplyDelete
  35. It is shown in the Gurgaon and Noida dlf cyber cities list of manufacturing companies in Noida where they have numerous career growth opportunities. The large scale and availability of many amenities have enabled these cities to be a magnet for companies that want to build their reputations and make a living.

    ReplyDelete
  36. Hey admin, I am second time visits your website articles and trust me its really so beneficial for all readers. I definitely enjoying every little bit of it. It is a really superb website for new readers, I want to thank you so much for your efforts. Good job! You guys do a very best blogs. Essay Help - statistics homework help - college homework help

    ReplyDelete
  37. It is really helpful for readers who are looking for online assignment help. I also work in the same area and provide assignment help to students for various subjects. Most of my students are from parts of the UK, USA, India, and Singapore. Our team of professors are from reputed Colleges. Visit our website to know our areas of expertise and let us know if we can be of help. Also Read:
    how many pages is 1000 words,
    how many pages is 2000 words,
    how many pages is 1500 words,
    informative speech subjects.

    ReplyDelete
  38. it is in reality a correctly-researched content material and high-quality wording.
    I got correspondingly engaged in this fabric that I couldnt wait analyzing. i am impressed in the end your positioned it on and skillability. thank you

    amazon quiz
    gk quiz
    quiz games
    english stories
    bedtime stories
    short stories
    short bedtime stories
    english stories collection

    ReplyDelete
  39. If you want to progress in academic writing, you need to count every single step. Ensure to follow the right path and add essential qualities to your writing curve. Asking the Assignment Help of someone to write my assignment may sound instant solution but it can help you to boost your learning exposure. Write my assignment | Homework Help | Accounting Assignment Help

    ReplyDelete
  40. B3 Bomber Jacket For Sale - Free Shipping and Best Deal
    Men consistently partial to skins and hides due to the fact the start of timethey utilized it to insure by themselves and safeguard them by your cold temperatures.
    Now shearling coats, Real Leather Bomber Jackets, Buy Harley Davidson Leather Motorcycle Jackets holds probably the best legacy , masculinity along with ruggedness to get a guys outer wear.

    ReplyDelete
  41. For getting instant Assignment Help , you can check our website and order assistance. Assignments are written on a priority basis and delivered to you without any delay. If you choose our writing services then you will have thousands of other advantages as well.

    ReplyDelete
  42. Students have multiple types of problems related to college assignments. So My Assignment Experts
    have a well-educated expert for writing assignments. If you have any obstacles with writing assignments. then Don’t worry because My Assignment Experts provide the most reliable online assignment help and free plagiarism assignment.

    ReplyDelete
  43. Thanks for such informative post. I have written an article about how to write synopsis for project Please visit us to read this.

    ReplyDelete
  44. If you have trouble with the writing essay about yourself, I would recommend you to use special services, such as DigitalEssay.net

    ReplyDelete
  45. If you are planning to get human based language translation in Singapore for academic assignment then you should consult Singapore translators,Our experts are avail 24*7 to deliver you well precise academic translation into desired languages.

    ReplyDelete
  46. Write down all the important points or information that you find useful. Also, even after taking notes, if you find any topic or concept difficult to understand, then you can go for assignment help online as well for clarifying your concepts.
    Assignment help online
    assignment help online 
    take my online class for me
    management assignment help
    marketing assignment help

    ReplyDelete
  47. It is extremely nice to see the greatest details presented in an easy and understanding manner. Get Digital Marketing Services At Affordable Price At JeewanGarg.Com (SEO Services in Delhi)

    ReplyDelete
  48. Matrimonials India is one of the most reliable and trusted Australia Muslim Matrimony
    that provides services for millions of Indian worldwide. This portal is the largest Australia Muslim Matrimony with several successful marriages and that comprises an extensive database of NRI Muslims from Australia. Matrimonials India has already helped several people in finding their Australia Muslim life partners.

    ReplyDelete
  49. cutting corrugated plastic not only have these wonderful qualities but also are super easy to cut. With the right kind of tools, You can quickly cut these sheets using the following Corrugated Plastic sheets comprise of three layers- two flat plastic sheets with a wave-like ribbed center layer. The two flat plastic sheets are generally referred to as twinwall plastic. The Corrugated Plastic sheets may also be like sheets of plastic that have a wave-like structure that might have chopped glass fiber reinforced in it

    ReplyDelete
  50. Iressa Gefitinib 250 mg tablet price in India
    is found to be the best with Emedkit. Emedkit is the exporter of all the generic medicine that also specializes in all the Cancer, HIV’s medicines at the lowest price along with the free delivery at your doorstep in India and worldwide. Hence, if you are looking to buy Iressa 250 mg tablet then there is no better place than the Emedkit. Gefitinib 250 mg is used to treat people with non-small cell lung cancer (NSCLC) that has spread to other parts of the body.

    ReplyDelete
  51. Exotic Luxury Camp provides the jaisalmer desert camp and the best luxury tents in Jaisalmer at affordable tariff. Exotic Luxury Camps is home to 26 specious tents with comfortable and unique stone beds. With us you will surely enjoy the jaisalmer tent stay in Jaisalmer as our camp cartels conveniences, comforts and ultra-modern facilities with the affection and personal attention of traditional Indian Rajasthani hospitality.

    ReplyDelete
  52. Your blog is very informative and nice to read such high-quality content. There is lots of information on your blog, thank you for sharing with us. I want to share some important information with you regarding UNIDEL post utme question

    ReplyDelete
  53. I just visit your website and I found it very informative. Please share more content just like that. I want to read more content so please upload more articles. Thanks in advanced.

    Packaging Host

    Die Cut Stickers

    Static Cling

    Cheap Latest Products

    Property Saga

    Lahore Smart City

    Nova City Islamabad

    Park View City Islamabad

    Al Noor Orchard Lahore

    ReplyDelete
  54. I’m extremely impressed with your article contents and also with the layout on your blog. Thanks for sharing your useful thought.

    IObit Driver Booster Pro 9

    IObit Driver Booster Pro Key

    Driver Booster Pro 9

    IObit Driver Booster Pro

    IObit Driver Booster Pro

    Driver Booster Pro 9 Key

    ReplyDelete
  55. Hello everyone! Persuasive essays are somewhat like argument essays and persuasive speeches, but they are a bit kinder and polite. Argumentative essays require you to discuss and attack an alternative point of view, while persuasive essays attempt to convince the reader that you have a credible argument. Learning to write persuasive speech topics is an essential skill that people use every day in everything from business to law to media and entertainment. English students can start writing persuasive essays at any skill level.

    ReplyDelete
  56. Having read your post, I am compelled to give thumps up to your post and let you to take betterment in academic with Assignment Help Service. You have completed the half journey of your assignment completion.

    ReplyDelete
  57. I feel great with this uploaded post and avail online to read out all information in this. Hey admin! I urge you to carry on this information as much as possible. Many teams I do not get the sufficient time to read out as I am surrounded with the accountability to do assignment instructed by the Qatar university expert. In the most suitable condition, you can rely on Qatar Assignment Help team for better performance. But, you have to continue for information sharing.

    ReplyDelete
  58. Great Assignment Help offers online dissertation help services to the students around the globe. We provide reasonable assistance to the students in dissertation help online writing without missing the deadline.

    ReplyDelete
  59. This post is very good I am very happy to see this post. Thanks for sharing such a great article. Keep up the work... your site is great, and it's helping us a lot.
    It really Great Article, Please Upload Daily Posts.
    These Are My Aps Please Check Out.
    Video Player App 😍
    " Ad-Free Video Player"
    Good Morning Images

    ReplyDelete
  60. Thanks for sharing, information is really useful, keep posting.
    Best Hospital Management Software in India

    ReplyDelete