Comments on: Frame Injection Fun http://www.gnucitizen.org/blog/frame-injection-fun/ Information Security Think Tank Mon, 12 Dec 2011 19:56:03 +0000 hourly 1 http://wordpress.org/?v=3.1.2 By: JD http://www.gnucitizen.org/blog/frame-injection-fun/comment-page-1/#comment-129668 JD Thu, 20 Jan 2011 14:52:44 +0000 https://www.gnucitizen.org/?p=1568#comment-129668 Filtering is not the best defense against XSS and HTMLi. Encoding output is. Filtering must prevent all possible combinations of mallicious input. Encoding encodes all output. Encoding is simpler and covers more of the threat domain naturally. Filtering is not the best defense against XSS and HTMLi. Encoding output is. Filtering must prevent all possible combinations of mallicious input. Encoding encodes all output. Encoding is simpler and covers more of the threat domain naturally.

]]> By: .:[ d4 n3wS ]:. » Blog Archive » Frame injection PoC: gmail phishing.. http://www.gnucitizen.org/blog/frame-injection-fun/comment-page-1/#comment-128752 .:[ d4 n3wS ]:. » Blog Archive » Frame injection PoC: gmail phishing.. Wed, 25 Aug 2010 04:18:45 +0000 https://www.gnucitizen.org/?p=1568#comment-128752 [...] Origine de l’article : http://www.gnucitizen.org/blog/frame-injection-fun/ [...] [...] Origine de l’article : http://www.gnucitizen.org/blog.....ction-fun/ [...]

]]> By: What’s new in web hacking techniques of 2008 http://www.gnucitizen.org/blog/frame-injection-fun/comment-page-1/#comment-128136 What’s new in web hacking techniques of 2008 Tue, 09 Feb 2010 05:35:59 +0000 https://www.gnucitizen.org/?p=1568#comment-128136 [...] Frame Injection Fun [...] [...] Frame Injection Fun [...]

]]> By: GigA: Todo es seguro ~~: iFrame Injection « El camello, el León y el niño. O la evolución del perro al lobo. http://www.gnucitizen.org/blog/frame-injection-fun/comment-page-1/#comment-127597 GigA: Todo es seguro ~~: iFrame Injection « El camello, el León y el niño. O la evolución del perro al lobo. Mon, 06 Jul 2009 07:35:30 +0000 https://www.gnucitizen.org/?p=1568#comment-127597 [...] Leer más. Mi comentario: La evolución de los sistemas es análogo al de las especies. Solo sobreviven los fuertes. Con lo que redunda en mejores sistemas. Las víctimas solo son efectos colaterales de la evolución. Jo, menudo punto de vista, un tanto fascista creo que me ha salido. Lo voy a meditar [...] [...] Leer más. Mi comentario: La evolución de los sistemas es análogo al de las especies. Solo sobreviven los fuertes. Con lo que redunda en mejores sistemas. Las víctimas solo son efectos colaterales de la evolución. Jo, menudo punto de vista, un tanto fascista creo que me ha salido. Lo voy a meditar [...]

]]> By: LightningでThunderbirdにToDoやカレンダーを統合しよう | my96soft-集合知のすばらしさを求めて- http://www.gnucitizen.org/blog/frame-injection-fun/comment-page-1/#comment-127001 LightningでThunderbirdにToDoやカレンダーを統合しよう | my96soft-集合知のすばらしさを求めて- Tue, 12 May 2009 09:44:05 +0000 https://www.gnucitizen.org/?p=1568#comment-127001 [...] 実際にGmailのログイン画面（偽）作りたかったらこちらのコードを参考に作ってみてよ。 Frame Injection Fun | GNUCITIZEN [...] [...] 実際にGmailのログイン画面（偽）作りたかったらこちらのコードを参考に作ってみてよ。 Frame Injection Fun | GNUCITIZEN [...]

]]> By: p3lo http://www.gnucitizen.org/blog/frame-injection-fun/comment-page-1/#comment-126528 p3lo Wed, 15 Apr 2009 15:20:19 +0000 https://www.gnucitizen.org/?p=1568#comment-126528 I have worked to developp this technique, and i have constated that we can break the frame with: <pre><code>if (top.frames.length!=0) top.location=self.document.location;</code></pre> and <pre><code>document.location="http://evil.foo/login.php";</code></pre> The first script can be used to secure the page framed... I have worked to developp this technique, and i have constated that we can break the frame with:

if (top.frames.length!=0) top.location=self.document.location;

and

document.location="http://evil.foo/login.php";

The first script can be used to secure the page framed…

]]> By: Le migliori tecniche di Web Hacking del 2008 | lonerunners.net http://www.gnucitizen.org/blog/frame-injection-fun/comment-page-1/#comment-126312 Le migliori tecniche di Web Hacking del 2008 | lonerunners.net Sun, 15 Mar 2009 17:19:08 +0000 https://www.gnucitizen.org/?p=1568#comment-126312 [...] Frame Injection Fun [...] [...] Frame Injection Fun [...]

]]> By: Heuristic Delta :: Top 70 Hacking Methods :: http://blogs.heuristicdelta.com http://www.gnucitizen.org/blog/frame-injection-fun/comment-page-1/#comment-126130 Heuristic Delta :: Top 70 Hacking Methods :: http://blogs.heuristicdelta.com Wed, 25 Feb 2009 07:47:20 +0000 https://www.gnucitizen.org/?p=1568#comment-126130 [...] Frame Injection Fun [...] [...] Frame Injection Fun [...]

]]> By: Submit Your Top Web Hacking Techniques for 2008 | GNUCITIZEN http://www.gnucitizen.org/blog/frame-injection-fun/comment-page-1/#comment-125697 Submit Your Top Web Hacking Techniques for 2008 | GNUCITIZEN Fri, 30 Jan 2009 00:04:19 +0000 https://www.gnucitizen.org/?p=1568#comment-125697 [...] Frame Injection Fun [...] [...] Frame Injection Fun [...]

]]> By: GUYA.NET » Blog Archive » Google Hackathon was hacked http://www.gnucitizen.org/blog/frame-injection-fun/comment-page-1/#comment-124264 GUYA.NET » Blog Archive » Google Hackathon was hacked Wed, 05 Nov 2008 00:45:13 +0000 https://www.gnucitizen.org/?p=1568#comment-124264 [...] I got was that I should report this somewhere in the GMail website. But, it’s already been reported, I [...] [...] I got was that I should report this somewhere in the GMail website. But, it’s already been reported, I [...]

]]> By: Adrian 'pagvac' Pastor http://www.gnucitizen.org/blog/frame-injection-fun/comment-page-1/#comment-124113 Adrian 'pagvac' Pastor Tue, 21 Oct 2008 07:07:13 +0000 https://www.gnucitizen.org/?p=1568#comment-124113 @Chintan: this is a problem of semantics, we could talk about it forever. It doesn't matter what you call it, the issue is still the same: you can insert third-party content while still showing mail.google.com in the address bar. We did NOT come up with the term "frame injection" (just do a Google search), neither did we claim we came up with a new technique. The only reason why there has been some media interest is because Google is something everyone can relate to. Thanks a lot for your feedback again btw. @Chintan: this is a problem of semantics, we could talk about it forever. It doesn’t matter what you call it, the issue is still the same: you can insert third-party content while still showing mail.google.com in the address bar.

We did NOT come up with the term “frame injection” (just do a Google search), neither did we claim we came up with a new technique. The only reason why there has been some media interest is because Google is something everyone can relate to.

Thanks a lot for your feedback again btw.

]]> By: Chintan http://www.gnucitizen.org/blog/frame-injection-fun/comment-page-1/#comment-124104 Chintan Sun, 19 Oct 2008 16:32:33 +0000 https://www.gnucitizen.org/?p=1568#comment-124104 @Adrian - I appreciate your explanation. But i still think an attacker is not adding any frame into victim's page. I think it can be termed as url redirection via frames. The reason the address bar reflects new url in a traditional url redirection attack is because the redirection is direct one (i.e. @page level). Since in this case the the functionality of the frame is to load an external url- which is abused to load an arbitrary page inside that frame, it will never show up in address bar (not even for the legitimate page). I repeat, an attacker is not injecting any frame into victim's webpage. Only the content of the existing frame changes as the domain is not restricted. Then how can one call it frame "Injection"? I think the debate may be endless. Instead i give it up here. Feel free to call it anything you want. None the less, not a bad catch (just that it has been overhyped to reflect as a new kind of attack). I have always appreciated GNU Citizen for their innovations, but i cannot give credit for this one atleast. @Adrian – I appreciate your explanation. But i still think an attacker is not adding any frame into victim’s page. I think it can be termed as url redirection via frames.

The reason the address bar reflects new url in a traditional url redirection attack is because the redirection is direct one (i.e. @page level).

Since in this case the the functionality of the frame is to load an external url- which is abused to load an arbitrary page inside that frame, it will never show up in address bar (not even for the legitimate page).

I repeat, an attacker is not injecting any frame into victim’s webpage. Only the content of the existing frame changes as the domain is not restricted. Then how can one call it frame “Injection”?

I think the debate may be endless. Instead i give it up here. Feel free to call it anything you want.

None the less, not a bad catch (just that it has been overhyped to reflect as a new kind of attack). I have always appreciated GNU Citizen for their innovations, but i cannot give credit for this one atleast.

]]> By: Diversas vulnerabilidades en Google | El blog de José Luís Zayas http://www.gnucitizen.org/blog/frame-injection-fun/comment-page-1/#comment-124094 Diversas vulnerabilidades en Google | El blog de José Luís Zayas Sat, 18 Oct 2008 14:33:50 +0000 https://www.gnucitizen.org/?p=1568#comment-124094 [...] La primera de ellas se trata de un Cross Domain Frame http://mail.google.com/imgres?imgurl=http://SecureGoogleMail&imgrefurl=http%3a%2f%2fsnipurl.com/482f3 según podemos ver, un usuario que entrara en dicho link podría ser engañado y capturar sus credenciales de su cuenta Google, más información aquí. [...] [...] La primera de ellas se trata de un Cross Domain Frame http://mail.google.com/imgres?......com/482f3 según podemos ver, un usuario que entrara en dicho link podría ser engañado y capturar sus credenciales de su cuenta Google, más información aquí. [...]

]]> By: Frame injection exploits Google flaw | Information Systems Security http://www.gnucitizen.org/blog/frame-injection-fun/comment-page-1/#comment-124085 Frame injection exploits Google flaw | Information Systems Security Fri, 17 Oct 2008 17:55:01 +0000 https://www.gnucitizen.org/?p=1568#comment-124085 [...] posted the frame-injection PoC example against Google on the GNUCitizen blog. He explained that frame injection works by inserting the URL of a third-party website into the [...] [...] posted the frame-injection PoC example against Google on the GNUCitizen blog. He explained that frame injection works by inserting the URL of a third-party website into the [...]

]]> By: Ethical Hackers » Google Gmail, Other Apps, Vulnerable To Attack http://www.gnucitizen.org/blog/frame-injection-fun/comment-page-1/#comment-124082 Ethical Hackers » Google Gmail, Other Apps, Vulnerable To Attack Fri, 17 Oct 2008 03:13:59 +0000 https://www.gnucitizen.org/?p=1568#comment-124082 [...] ‘pagvac’ Pastor, a security researcher with GNUCitizen.org, on Friday posted proof-of-concept code that can inject a third-party page — a fake login page in Pastor’s example — while the [...] [...] ‘pagvac’ Pastor, a security researcher with GNUCitizen.org, on Friday posted proof-of-concept code that can inject a third-party page — a fake login page in Pastor’s example — while the [...]

]]> By: Adrian 'pagvac' Pastor http://www.gnucitizen.org/blog/frame-injection-fun/comment-page-1/#comment-124066 Adrian 'pagvac' Pastor Thu, 16 Oct 2008 07:10:09 +0000 https://www.gnucitizen.org/?p=1568#comment-124066 @Chintan: sure it IS different. In a redirection attack, the URL in the browser's address bar changes to a non-trusted third-party site once the "evil" URL is visited. In a frame injection attack, the address bar remains showing the legitimate domain after the "evil" URL is visited. It is called frame injection because the third-party content is inserted via a dynamically generated frame. Check the 'frame' tags in the source code for more info. @Daniel: I'm actually against creating new vulnerability names, it just complicates things. The only reason I mentioned the term "frame injection" is because: 1) it's NOT a new term. 2) the filtering solution needed is different to the one required for "pure" XSS/HTMLi vulnerabilities as the attacker doesn't need to inject "dangerous" characters. At least generally speaking. @Chintan: sure it IS different. In a redirection attack, the URL in the browser’s address bar changes to a non-trusted third-party site once the “evil” URL is visited. In a frame injection attack, the address bar remains showing the legitimate domain after the “evil” URL is visited.

It is called frame injection because the third-party content is inserted via a dynamically generated frame. Check the ‘frame’ tags in the source code for more info.

@Daniel: I’m actually against creating new vulnerability names, it just complicates things. The only reason I mentioned the term “frame injection” is because: 1) it’s NOT a new term. 2) the filtering solution needed is different to the one required for “pure” XSS/HTMLi vulnerabilities as the attacker doesn’t need to inject “dangerous” characters. At least generally speaking.

]]> By: Serviços do Google estão vulneráveis a Frame Injection | Elvis Fernandes http://www.gnucitizen.org/blog/frame-injection-fun/comment-page-1/#comment-124062 Serviços do Google estão vulneráveis a Frame Injection | Elvis Fernandes Wed, 15 Oct 2008 11:40:05 +0000 https://www.gnucitizen.org/?p=1568#comment-124062 [...] O Adrian ‘pagvac’ Pastor, da GNUCitizen, postou sua descoberta sobre a vulnerabilidade do google a ataques de Frame Injection. [...] [...] O Adrian ‘pagvac’ Pastor, da GNUCitizen, postou sua descoberta sobre a vulnerabilidade do google a ataques de Frame Injection. [...]

]]> By: Jim Manico http://www.gnucitizen.org/blog/frame-injection-fun/comment-page-1/#comment-124058 Jim Manico Tue, 14 Oct 2008 18:00:26 +0000 https://www.gnucitizen.org/?p=1568#comment-124058 RE: Comments about about input validation above : you do NOT defend against XSS by input validation - thats one of the biggest misnomers in AppSec. You solve it via ENCODING data before presenting it to your users. ESAPI, for example, provides a variety of data encoding functions depending on context: encodeForHTML, encodeForHTMLEntity, encodeForJavascript, etc. RE: Comments about about input validation above : you do NOT defend against XSS by input validation – thats one of the biggest misnomers in AppSec. You solve it via ENCODING data before presenting it to your users. ESAPI, for example, provides a variety of data encoding functions depending on context: encodeForHTML, encodeForHTMLEntity, encodeForJavascript, etc.

]]> By: Google Gmail, Other Apps, Vulnerable To Attackers , Hackers | Tech At Hand Dot Net | Philippines, Technology, SEO and Blogging http://www.gnucitizen.org/blog/frame-injection-fun/comment-page-1/#comment-124053 Google Gmail, Other Apps, Vulnerable To Attackers , Hackers | Tech At Hand Dot Net | Philippines, Technology, SEO and Blogging Tue, 14 Oct 2008 09:03:48 +0000 https://www.gnucitizen.org/?p=1568#comment-124053 [...] Adrian ‘pagvac’ Pastor, a security researcher with GNUCitizen.org, on Friday posted proof-of-concept code that can inject a third-party page — a fake login page in Pastor’s example — [...] [...] Adrian ‘pagvac’ Pastor, a security researcher with GNUCitizen.org, on Friday posted proof-of-concept code that can inject a third-party page — a fake login page in Pastor’s example — [...]

]]> By: Chintan http://www.gnucitizen.org/blog/frame-injection-fun/comment-page-1/#comment-124049 Chintan Tue, 14 Oct 2008 02:16:29 +0000 https://www.gnucitizen.org/?p=1568#comment-124049 Hi, I don't think its any thing different from URL Redirection (except that it is now wrapped with a new shiny marketing lingo). I still don't understand where the frame gets injected! It's just getting loaded from an external source. Instead of loading Fake Gmail page, you can load any page instead. The following loads yahoo :P http://mail.google.com/imgres?imgurl=http://yahoo.com&imgrefurl=http://yahoo.com Can some one please explain me the rationale for calling it a frame injection? Hi, I don’t think its any thing different from URL Redirection (except that it is now wrapped with a new shiny marketing lingo). I still don’t understand where the frame gets injected! It’s just getting loaded from an external source.

Instead of loading Fake Gmail page, you can load any page instead. The following loads yahoo :P

http://mail.google.com/imgres?...../yahoo.com

Can some one please explain me the rationale for calling it a frame injection?

]]>