XSS through Exif headers - Printable Version

XSS through Exif headers - Printable Version

+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.li/Forum-Tutorials)
+--- Thread: XSS through Exif headers (/Thread-XSS-through-Exif-headers)

XSS through Exif headers - RogueCoder - 11-22-2013

XSS through Exif headers

So, cross-site scripting is nothing new to people, but most people think that just because a website doesn't have any visible xss vulnerabilities through forms, or url parameters doesn't mean that it's not vulnerable. In this tutorial I'm going to explain how you can take advantage of Exif headers to inject xss payloads.

What is Exif?

Quote:Exchangeable image file format (Exif, often incorrectly EXIF) is a standard that specifies the formats for images, sound, and ancillary tags used by digital cameras (including smartphones), scanners and other systems handling image and sound files recorded by digital cameras.

Source: http://en.wikipedia.org/wiki/Exif

Through the Exif headers we can get and display information like camera model, make, arbitrary comments, shutter speed, date, and much much more.

So, how do we hack sites using these headers?

It's really a very easy process. The first thing to do is to find a website that actually display information from these headers. You then need to gather some information about which Exif headers it display's. This can be done by looking at other pictures on the site. When this is done it's time to rock and roll.

In this tutorial I will use the camera model header

Get a tool that can modify the Exif headers. I'm using Linux, so I'm using the exiftool from the terminal. To modify the header I do this

Code:
exiftool "-model=NIKON D80<script>alert('xss')</script>" image.jpg

which produces the output

Code:
1 image files updated

Now to verify that the malicious content actually made it into the header I do this

Code:
strings image.jpg | grep alert

which will output

Code:
NIKON D80<script>alert('xss')</script>

Now that you have your infected image you need to get i onto the site. Either you can upload it yourself, or you will need to do some social engineering to get a person with upload permission to upload your image.

When someone now visits the infected image, and the developer haven't done his job properly sanitizing and filtering input/output, your payload will execute.

Conclusion

This is a reminder that anything that comes from a user can be tampered with. As long as the user controls the data, the application must never trust it.

I hope you found this useful
- Happy hacking Smile

XSS through Exif headers - RogueCoder - 11-22-2013

XSS through Exif headers

Quote:Exchangeable image file format (Exif, often incorrectly EXIF) is a standard that specifies the formats for images, sound, and ancillary tags used by digital cameras (including smartphones), scanners and other systems handling image and sound files recorded by digital cameras.

Code:
exiftool "-model=NIKON D80<script>alert('xss')</script>" image.jpg

which produces the output

Code:
1 image files updated

Now to verify that the malicious content actually made it into the header I do this

Code:
strings image.jpg | grep alert

which will output

Code:
NIKON D80<script>alert('xss')</script>

RE: XSS through Exif headers - behehe hacked - 11-22-2013

you should add csrf Biggrin

RE: XSS through Exif headers - RogueCoder - 11-23-2013

(11-22-2013, 11:44 PM)behehe hacked Wrote: you should add csrf

And why would I do that? It doesn't at all fit the scope of this tutorial. XSS through CSRF is nothing special. It's just like regular XSS except that you get someone else to submit the form

RE: XSS through Exif headers - Deque - 11-23-2013

I didn't know that this was possible (actually I never dealt with XSS). Thanks for this little tutorial.

RE: XSS through Exif headers - RogueCoder - 11-23-2013

(11-23-2013, 10:01 AM)Deque Wrote: I didn't know that this was possible (actually I never dealt with XSS). Thanks for this little tutorial.

You're welcome, I'm glad you liked it. These headers can be used for any form of web app vulnerability as long as the conditions are correct.

I'm currently working on PoC's on sql injection using this method

RE: XSS through Exif headers - RogueCoder - 11-23-2013

(11-23-2013, 10:01 AM)Deque Wrote: I didn't know that this was possible (actually I never dealt with XSS). Thanks for this little tutorial.