Thursday, 23 July 2015

XSS, Extensions and Content-Types

In this post I'll look at which Content-Types and Extensions can actually be used for XSS in modern browsers.


Why does Content-Type and Extension matter?

Applications come in many different shapes and sizes and XSS can occur all over the place. It's easy to assume that just because an application returns you a response with unfiltered/unencoded output you've found an exploitable XSS issue but this is often not the case. Browsers render content based on a number of factors including content-type returned by the server, page content and page extension, without the correct combination XSS won't be possible.

To try and get a definitive answer of what works and what doesn't I thought I'd do some testing. I used multiple file types each containing their legitimate content however I also embedded a JavaScript alert payload in each. Each test case was ran against Chrome 43, IE 11 and Firefox 39. In the tables below "yes" means the payload rendered and "no" means it didn't.


Test #1 - Following Best Practice

In the first test I forced the server to return the correct extension and content-type for each test page.


Content-Type
Extension Chrome IE Firefox
None None yes yes yes
text/plain txt no no no
text/html html yes yes yes
application/javascript js no no no
application/json json no no no
application/xml xml yes yes yes
text/css css no no no
image/jpeg jpeg no no no

Following best practice modern browsers appeared to be pretty secure. The one exception appears to be XML, it seems odd that the browser would allow the rendering of JavaScript in an XML file.


Test #2 - Modifying Extension

In the second test I made the server return the correct content-type but forced a .html extension.

Content-Type
Extension Chrome IE Firefox
None html yes yes yes
text/plain html no no no
text/html html yes yes yes
application/javascript html no yes no
application/json html no no no
application/xml html yes yes yes
text/css html no no no
image/jpeg html no no no

This test seemed to show that browsers will prioritize the use of the content-type over the extension.


Test #3 - Using a text/html Content-Type

In the third test I used the correct extension for each file but made the server return a text/html content-type.

Content-Type
Extension Chrome IE Firefox
text/html None yes yes yes
text/html txt yes yes yes
text/html html yes yes yes
text/html js yes yes yes
text/html json yes yes yes
text/html xml yes yes yes
text/html css yes yes yes
text/html jpeg yes no yes

It looks like browsers rely heavily on the content-type returned by the server. It doesn't matter about the extension or contents of the file, the browser will blindly follow the content-type returned.


Test #4 - Using a text/plain Content-Type

Next I used the correct extension for each file but made the server return a text/plain content-type.

Content-Type
Extension Chrome IE Firefox
text/plain txt no no no
text/plain html no no no
text/plain js no no no
text/plain json no no no
text/plain xml no no no
text/plain css no no no
text/plain jpeg no no no

When using a content-type of text/plain none of the payloads executed. I can't remember for sure, but I believe in the past text/plain used to allow XSS? Looks like this is no longer possible.


Test #5 - MIME sniffing

In this last test case I accessed a page that had no extension and received no content-type header from the server. This should have caused the browser to fall back on mime sniffing to render the page.

MIME
Content-Type Extension Chrome IE Firefox
text/plain None None no yes no
text/html None None yes yes yes
application/javascriptNoneNone yes yes yes
application/json None None no yes no
application/xml None None no yes no
text/css None None no yes no
image/jpeg None None no no no

Both Chrome and Firefox refused to render pages that contained additional non-html content. IE however didn't seem to care what the page content was, if it contained HTML it rendered!

Conclusion

Performing application testing on a regular basis I find content-type and extension XSS issues arise quite a lot. This test showed that modern browsers are relatively secure as long as the correct content-type is returned. All browsers also seemed to implement the same analysis techniques aside from IE which seemed slightly more permissive.

Hopefully you guys have found this post useful, if anyone has any suggestions for bypasses to achieve XSS in any of the above, or if I've listed any findings incorrectly (quite possible) drop me a message below :)

Pwndizzle out.

78 comments:

  1. Thanks, very useful information!

    ReplyDelete
    Replies
    1. Pwndizzle: Xss, Extensions And Content-Types >>>>> Download Now

      >>>>> Download Full

      Pwndizzle: Xss, Extensions And Content-Types >>>>> Download LINK

      >>>>> Download Now

      Pwndizzle: Xss, Extensions And Content-Types >>>>> Download Full

      >>>>> Download LINK o3

      Delete
  2. it was useful for me

    ReplyDelete
  3. By the way, this information will help you to write an abstract for a dissertation. It's important to know

    ReplyDelete
  4. Awesome! We’re looking forward your blog
    I have some suggestions. Here is a blog - Photo editing & photography tips.
    This may help you to find something useful

    ReplyDelete
  5. This comment has been removed by the author.

    ReplyDelete
  6. In this post I'll look at which Content-Types and Extensions can actually be used for XSS in modern browsers.
    Dissertation VS Thesis

    ReplyDelete
  7. A paper that determines or describes a specific term is called a definition essay. At first, it seems that there is nothing easier than creating such an academic work. However, you can always buy definition essay.

    ReplyDelete
  8. Thanks for sharing this nice post. I am surprised to see your work. You shared an informative post. I appreciate you for your good work. Carry on your journey of hard work. Get help from dissertation proposal writing services, a distinctive writing company UK

    ReplyDelete
  9. What a nice blog! I have enjoyed reading through the article although I landed on this site while I was looking for research paper writing, which to which speech time calculator concluded. I will be visiting this site occasionally to read more interesting and intriguing articles. I hope the writer will continually keep us updated with new information.

    ReplyDelete
  10. Very nice blog,
    Thanks for sharing grate information.

    From: Laptop Technicians

    ReplyDelete
  11. Looking for academic assistance? click this link now It is a place where you’ll get great papers for a reasonable price.

    ReplyDelete
  12. Sometimes it's a great idea to check some interesting blogs. As well, people can help each other. For example, I prepare some samples of interview paper. It can be a beneficial item for students.

    ReplyDelete
  13. If you're looking to lose fat then you certainly need to try this totally brand new custom keto meal plan.

    To produce this keto diet service, licenced nutritionists, personal trainers, and cooks joined together to provide keto meal plans that are useful, convenient, cost-efficient, and enjoyable.

    From their first launch in early 2019, hundreds of individuals have already remodeled their body and well-being with the benefits a good keto meal plan can offer.

    Speaking of benefits; in this link, you'll discover 8 scientifically-tested ones offered by the keto meal plan.

    ReplyDelete
  14. best boho dresses and jewelry at amazing price @bohemian land
    feel

    ReplyDelete
  15. pep up look of your car by these super elegant car accessories @ auto x tools
    good

    ReplyDelete
  16. Hello! I know that more and more people look for a writing help. Some of them can find such help at the essay wring service. There people can find such information what are the three theoretical approaches to ethics

    ReplyDelete
  17. Quickbooks is the advanced accounting software to track and manage business data conveniently. The software is enriched with multiple accounting features.
    Quickbooks data Transfer

    ReplyDelete
  18. This comment has been removed by the author.

    ReplyDelete
  19. Good afternoon! Liked this post. Wanna read similar articles? Visit a service https://essays-writer.net/health-care-research-topics-for-argumentative-essay-best-ideas.html. There are plenty of enlightening articles.

    ReplyDelete
  20. A failure to compose a decent article review or any other piece of writing can often result due to the lack of necessary skills, time, experience, as well as knowledgeable article review writing service is there to help you.

    ReplyDelete
  21. Custom application development solutions is meant for designing a software specially for an organization. The advantage of custom application over standard applications is that standard applications were designed with a general set of features to be used by different verticals and organization.

    ReplyDelete
  22. Best Hospital management system. It including Hospital billing, Hospital appointments, Hospital scheduling, Hospital regulatory compliance and Hospital financial auditing within healthcare management software by Accurate Infosoft

    ReplyDelete
  23. Leather fashion jacket never runs out of style and if you’re looking for best articles regarding Harley Davidson leather Jackets, you’re just at the right place.
    JnJ is a registered firm that deals with all kinds of leather jackets, including motorbike racing suits, motorbike leather jackets and leather vests, leather gloves, for both men and women.

    ReplyDelete
  24. It is shown in the Gurgaon and Noida dlf cyber cities list of manufacturing companies in Noida where they have numerous career growth opportunities. The large scale and availability of many amenities have enabled these cities to be a magnet for companies that want to build their reputations and make a living.

    ReplyDelete
  25. Hey admin, I am second time visits your website articles and trust me its really so beneficial for all readers. I definitely enjoying every little bit of it. It is a really superb website for new readers, I want to thank you so much for your efforts. Good job! You guys do a very best blogs. Essay Help - statistics homework help - college homework help

    ReplyDelete
  26. Students have multiple types of problems related to college assignments. So My Assignment Experts
    have a well-educated expert for writing assignments. If you have any obstacles with writing assignments. then Don’t worry because My Assignment Experts provide the most reliable online assignment help and free plagiarism assignment.

    ReplyDelete
  27. Thanks for such informative post. I have written an article about how to write synopsis for project Please visit us to read this.

    ReplyDelete
  28. If you are planning to get human based language translation in Singapore for academic assignment then you should consult Singapore translators,Our experts are avail 24*7 to deliver you well precise academic translation into desired languages.

    ReplyDelete
  29. Write down all the important points or information that you find useful. Also, even after taking notes, if you find any topic or concept difficult to understand, then you can go for assignment help online as well for clarifying your concepts.
    Assignment help online
    assignment help online 
    take my online class for me
    management assignment help
    marketing assignment help

    ReplyDelete
  30. Your blog is very informative and nice to read such high-quality content. There is lots of information on your blog, thank you for sharing with us. I want to share some important information with you regarding UNIDEL post utme question

    ReplyDelete
  31. I’m extremely impressed with your article contents and also with the layout on your blog. Thanks for sharing your useful thought.

    IObit Driver Booster Pro 9

    IObit Driver Booster Pro Key

    Driver Booster Pro 9

    IObit Driver Booster Pro

    IObit Driver Booster Pro

    Driver Booster Pro 9 Key

    ReplyDelete
  32. Great Assignment Help offers online dissertation help services to the students around the globe. We provide reasonable assistance to the students in dissertation help online writing without missing the deadline.

    ReplyDelete
  33. This post is very good I am very happy to see this post. Thanks for sharing such a great article. Keep up the work... your site is great, and it's helping us a lot.
    It really Great Article, Please Upload Daily Posts.
    These Are My Aps Please Check Out.
    Video Player App ๐Ÿ˜
    " Ad-Free Video Player"
    Good Morning Images

    ReplyDelete
  34. Hi...
    This topic lists most common MIME types, with corresponding document types, ordered by their common extensions.
    You are also read more Instant Loan Online

    ReplyDelete
  35. esign zoned is a web design company that provides logo design, graphic design, Website design. We offer fully optimized, up-to-date designs of the website at an affordable price.

    ReplyDelete
  36. Succeed! It has the potential to be one of the most useful and valuable articles ever written. Excellent information! I'm also a specialist in this field, therefore I fully appreciate your efforts. Thank you so much for your assistance, and believe me when I say that you are a master in this sector and that you can achieve much more goals with this. Best of luck in your search for new information.
    international relations assignment help

    ReplyDelete
  37. Fantastic and useful information.
    I'm glad to hear you're doing well.
    Thanks for providing this useful information! Please keep us posted.
    Here you go. Thanks for sharing.
    wondershare pdfelement crack key
    360 total security crack
    r drive image crack
    4k video downloader crack

    ReplyDelete
  38. My first choice seems like a useful program at first glance.
    In short, depending on the location of the user, loading and storing your information is supported.
    I really appreciate your smart writing, like the design of your blog.
    Problems with payment or did you pick it up yourself?
    Either way, it's best to keep a record.
    nero burning rom 2021 crack
    bzzt image editor pro crack
    anydvd hd crack
    mailbird pro crack

    ReplyDelete
  39. It's fascinating to visit this website and read all of your friends' opinions.
    While I am interested in the subject of this piece of writing, I am also excited to
    acquire familiarity
    magix vegas movie studio crack
    graphics converter pro crack
    express vpn crack
    windows 7 ultimate crack

    ReplyDelete
  40. I bet I won't be so disappointed with a blog post in the future that I won't read it.
    So the bottom line is that I'm really looking forward to this, but I hope you can say something interesting.
    In case you weren't paying attention, I just heard you complaining about things that could have been fixed if you weren't so desperate.
    outbyte driver updater license key
    driver fix license key
    fabfilter pro q key

    ReplyDelete

  41. If you want our writer to assist you in achieving excellent grades in , we can make that wish a reality. It's time to excel in Psychology Homework Help Online your academic career by utilizing our expert educational services, which guarantee 100 percent original documents that are unique, interesting, and error-free.

    ReplyDelete
  42. I like your all post. You Have Done really good Work On This Site. Thank you For The Information You provided. It helps Ma a Lot.
    it Is Very Informative Thanks For Sharing. I have also Paid This sharing. I am ImPressed For With your Post Because This post is very beneficial for me and provides new knowledge to me. This is a cleverly written article. Good work with the hard work you have done I appreciate your work thanks for sharing it. It Is a very Wounder Full Post.

    ccleaner professional crack
    ccleaner professional crack
    ccleaner professional crack
    ccleaner professional crack
    ccleaner professional crack
    ccleaner professional crack
    ccleaner professional crack
    ccleaner professional crack
    ccleaner professional crack
    ccleaner professional crack

    ReplyDelete


  43. You have a great site, but I wanted to know if you know.
    Any community forum dedicated to these topics.
    What was discussed in this article? I really want to be a part of it.
    A society in which I can obtain information from others with knowledge and interest.
    Let us know if you have any suggestions. I appreciate this!

    ransomware defender crack
    ransomware defender crack
    ransomware defender crack
    ransomware defender crack
    ransomware defender crack
    ransomware defender crack
    ransomware defender crack
    ransomware defender crack
    ransomware defender crack

    ReplyDelete
  44. Our Learn to Swim kids program gives uninterrupted learning for your children all year round. Baby Swimming Lessons Cranbourne are accompanied 49 weeks of the year to support for consistent training and to present students with the possibility to grow through levels at a quicker rate. The Star Swim Schools provides you peace of mind that your kid will receive a high-quality swimming education.
    Women's Private Swimming Lessons

    ReplyDelete
  45. I would like to thank you for the effort you put into writing this page.
    I also hope that you will be able to check the same high-quality content later.
    Really, your creative writing skills have inspired me to create my own blog now๐Ÿ˜‰
    anno1800 pc game with crack
    anno1800 crack
    anno1800 crack
    anno1800 crack

    ReplyDelete
  46. Team Designs is the best 3D architectural rendering services provider in Australia. We offer the latest 3d designs according to customer expectations and requirements. We provide a large variety of 3d rendering, interior designs and 3d floor plans for homes, residential apartments, office and industrial designs, etc.3d rendering

    ReplyDelete
  47. It was very easy to find my way around and very user friendly Good job to your designer and dev of your site. I hope your rate was doing well.
    ํ† ํ† ์‚ฌ์ดํŠธ
    ์˜จ๋ผ์ธ๊ฒฝ๋งˆ

    ReplyDelete
  48. People should know these tips because you have great content! Thanks anyway!
    ๋ฐ”์นด๋ผ
    ํ† ํ† 

    ReplyDelete
  49. Hi....
    The file extension and MIME type can describe an image file, but the file content can be text/javascript or text/html resulting in script execution.
    If any issue then contact the margin trading meaning

    ReplyDelete
  50. Always delicious food, easy to order take out indisk mad and very friendly and polite delivery man :)
    Wholesale T-shirts, cheap polo shirts & other high quality blank hoodies wholesale blank apparel Blank T Shirts we continually strive to bring you the best selection in wholesale blank t-shirts.

    ReplyDelete
  51. I'm ecstatic to have come across this article. The author has a very creative mind; life is about creating yourself rather than finding yourself. Please pay a visit to my page because my post contains important information. https://cracksir.com/batchphoto-crack/

    ReplyDelete
  52. The delightful anxieties may very well have gone away, but I still recall the joy I felt torturing my pals when the deadline loomed and they hadn't accomplished their responsibilities.https://crackguru.net/download-accelerator-plus-crack/

    ReplyDelete
  53. Pwndizzle: Xss, Extensions And Content-Types >>>>> Download Now

    >>>>> Download Full

    Pwndizzle: Xss, Extensions And Content-Types >>>>> Download LINK

    >>>>> Download Now

    Pwndizzle: Xss, Extensions And Content-Types >>>>> Download Full

    >>>>> Download LINK IT

    ReplyDelete
  54. Thank you so much for all of your efforts! As long as you keep going, you'll receive what you deserve.
    https://keygenhere.com/articulate-storyline-3-crack/

    ReplyDelete
  55. The Great Assignment help provide unique and quality assignments for a content writer in the USA. Hire our most trusted professional for Bioinformatics Assignment Help Here. Great assignment help offers the best Bioinformatics Assignment Help at very reliable prices, Contact Us.

    ReplyDelete
  56. This comment has been removed by the author.

    ReplyDelete
  57. Dear author, This is very Nice Article and it's very helping us this post is unique and interesting paid guest posting. Thank you for sharing this awesome information.

    ReplyDelete
  58. Fantastic blog I have never ever read this type of amazing information. Golf Hoodie

    ReplyDelete
  59. Artikel yang sangat menarik, jangan lupa melihat Syair Sdy dari kami, kami juga memberikan Kode Syair Sdy di dalam Forum Syair Sdy

    ReplyDelete
  60. The great website and information shared are also very appreciable. Johanna Constantine Coat

    ReplyDelete
  61. Greetings to everyone i am olivia, Have you ever heard people saying that Physics is one of the most difficult subject? well i thought that same untill i found new assignment help australia, i am really satisfied with their Physics Assignment Help services which they provided me and because of them i archieved A+ grades in my exams, If you are looking for the best assignment help services you should definitely go with them !!!

    ReplyDelete
  62. Thanks for sharing, such a nice Blog.I like it.
    visite my website
    forum syair sdy
    syair sdy

    ReplyDelete
  63. This comment has been removed by the author.

    ReplyDelete
  64. Dissertations are very hard to write, and you might wonder way. This is actually a common concern with college students, many of whom go to extreme lengths just to get a passing grade in a subject. You can buy it here https://topdissertations.com/dissertation-for-sale/


    ReplyDelete
  65. Get the best Tort Law Assignment Help at australianlawassignmenthelp.com. Our team of expert writers and editors offers tailored solutions to meet your specific needs and requirements. Trust us for top-quality work that exceeds your expectations and leads to academic success. Rely on us for accurate and effective support, ensuring that you receive the best possible outcome.

    ReplyDelete
  66. Thanks for sharing this valuable information with us.
    Gothic EMO Pants

    ReplyDelete
  67. You have to follow some easy steps for hiring experts through GotoAssignmentHelp’s help with dissertation service. First, share your requirements and every detail about your assignments. Then make payment and you will get your complete solution paper. Before delivering, the assignments are checked many times by the proofreaders. They check spelling mistakes, grammatical errors, sentence formation, paragraph formation, etc. You can make payments via PayPal, VISA, MasterCard, Maestro, American Express, DISCOVER, etc. there are no hidden charges here. You can visit the official website of GotoAssignmentHelp if you want more information about this service.


    Read more – Transition Words for Essay

    ReplyDelete
  68. I read your Blogs and I also read Blog on this topic in several articles from other sources. I got a lot of information from your content. I am also a web blogger plz visit my site very impressive Recipe For Fried Green Tomatoes

    ReplyDelete

  69. Kinemaster Pro Crack Full Version
    Kinemaster Pro Crack has user-friendly design ensures fluid publishing experiences by making it simple to browse throughout program’s capabilities.

    ReplyDelete