Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacking Github with Webkit

homakov.blogspot.com

Post reply on HN
Print view View original

71–80 of 82 posts

Re: Hacking Github with Webkit

#71

Post by yourcelf »

homakov wrote: post #63
yourcelf wrote: post #55

Earlier quoted context omitted.

Github only sets their cookie for "github.com". What I'm suggesting is that they set multiple http-only cookies: one for "github.com", one for ".github.com", another for every subdomain you access -- "pages.github.com", etc. If there's already an http-only _gh_sess cookie for every subdomain I can put scripts on, I won't be able to shadow it with my own _gh_sess cookie.

You can shadow other httponly cookies too. Any cookies.

Got it, thanks. More detail at [1] mentioned by gingerline above: "the secure flag does not prevent a cookie from being overwritten. In fact, a HTTP site can overwrite a cookie with a secure flag, as long as the domain names are related appropriately. The secure flag provides confidentiality protection but not integrity protection."

[1] http://security.stackexchange.com/questions/12412/what-cooki...

Re: Hacking Github with Webkit

#72

Post by homakov »

landr0id wrote: post #68
homakov wrote: post #65

Earlier quoted context omitted.

https://www.google.com/search?q=site%3Aheroku.com&aq=f&#... About 598,000 results (0.23 seconds)

Some do redirect to * .herokuapp.com, though. For instance: http://blacklistapp.heroku.com redirects to http://blacklistapp.herokuapp.com . I wonder if they switched it over for newer instances?

1) find or buy at least one heroku.com subdomain

2) PROFIT

3) MOAR PROFIT

4) EVEN MOAR PROFIT

Re: Hacking Github with Webkit

#73

Post by homakov »

losvedir wrote: post #70
homakov wrote: post #59

Earlier quoted context omitted.

RequestPolicy is OK, cookies off is better.. but how can you use the web !

Ha, well in some ways the web is better: I generally don't get ads or annoying pop-ups or social sharing widgets, etc. CSS is often on a separate domain so most pages are unstyled and ugly, but pretty easy to read (usually just black text on white background). But the downside is I had to open this page in a different browser to reply to you just now. And things like Gmail, GitHub, etc, I use in my other browser, but…

fair enough

Re: Hacking Github with Webkit

#74

Post by michaelt »

vecinu wrote: post #7
homakov wrote: post #4

Earlier quoted context omitted.

yeah. i don't sell exploits yet. Facebook, stripe, shopify, skrill - they treat a reporter nicely.

Any reason why you would even consider selling exploits? Do you not get compensated well from other ventures?

In negotiation theory your 'BATNA' or 'Best Alternative To Negotiated Agreement' is the second choice you'll go with if the current negotiation breaks down. Theoretically, neither party in a negotiation need accept less than their BATNA.

For example, when you negotiate your annual raise, your best alternative is the raise you could get by moving to another employer (adjusted for benefits, time spent commuting, how fun the job is etc). You don't have to explicitly say to your boss "give me a raise or I'll quit" - your boss just needs to know your options are open.

If homakov publicly says he'd never consider selling an exploit, he's saying his BATNA is $0 and some kudos on Hacker News. If he says he's undecided, his BATNA would be somewhere between a few thousand and a few hundred thousand dollars. Needless to say, the former statement closes off a lot of negotiation options while the latter leaves them open.

[0] http://www.forbes.com/sites/andygreenberg/2012/03/23/shoppin...

Re: Hacking Github with Webkit

#75

Post by eli »

ZoFreX wrote: post #66
homakov wrote: post #38

Earlier quoted context omitted.

JS CSS HTML are very mixed in each other. It is very hard to allow only CSS/HTML.

Alright... what if they could only change the CSS, and not the HTML and JS? (Obviously not a solution for Github pages, but workable in some scenarios)

Still sounds dangerous to me. It's possible to execute code from CSS! https://code.google.com/p/browsersec/wiki/Part1#Cascading_st...

Re: Hacking Github with Webkit

#76

Post by underwater »

tablatom wrote: post #11

> Custom JS on your subdomains is a bad idea What is the difference between allowing users to put custom JS on a subdomain, vs. someone just opening up the developer console and running whatever JS they like? Does JS loaded from the server have different privileges to JS entered at the console?

What you're referring to is a self-XSS. They were a lot more common back when you could run JavaScript from the address bar.

These days if you try and paste JavaScript to your address bar (try it with: javascript:alert(1);) then the browsers try and stop you. Firefox just won't execute any JavaScript, even if you've manually typed it. IE and Chrome strip the "javascript:" prefix (but Chrome is vunerable if you type "j" and paste the remainder).

More info here: https://www.facebook.com/photo.php?v=956977232793

Re: Hacking Github with Webkit

#77

Post by gingerlime »

homakov wrote: post #61
gingerlime wrote: post #56

This is not new[1], but interesting that github didn't think about this when they set-up gh-pages. It's hard to blame them though. Security is easy to miss. Myself and many other people who use github, and who understand those issues, don't really think about it until someone points this out... [1] http://security.stackexchange.com/q/12412/7306 - just an example of a discussion about this very same issue from about a…

did I say cookie tossing is something new? If I would consider it as a new attack I would call it Homakov Cookie Tossing Attack. Now it's just cookie tossing.

Saying that it's not new wasn't meant as a criticism for your discovery of this happening on github. Quite the opposite.

It's more of an observation on how even well-known security vulnerabilities can go overlooked. Even by companies with as big exposure and as many resources as github.

Re: Hacking Github with Webkit

#78

Post by zubentok »

I wonder why GitHub is so popular and TFS services are not. It's so much better than GitHub IMO, can someone explain?

Supports TFS and Git vestion-control

Free collaborative projects for up to 5 people

Can have closed-source projects

Re: Hacking Github with Webkit

#79

Post by Mahn »

zubentok wrote: post #78

I wonder why GitHub is so popular and TFS services are not. It's so much better than GitHub IMO, can someone explain? Supports TFS and Git vestion-control Free collaborative projects for up to 5 people Can have closed-source projects

Bitbucket supports private repos aswell and works with mercury and Git afaik. The main reason GitHub is popular is because it is popular; it just happened.

Re: Hacking Github with Webkit

#80

Post by duskwuff »

elbear wrote: post #37
xSwag wrote: post #5

Wow Homakov, other great write up! I'm really interested in what resources you used to learn all this stuff! Would you mind doing a "recommended books and blogs" post anytime soon?

A very well-known and recommended book in this space is "The Web Application Hacker's Handbook."

Also, "The Tangled Web".
Post reply on HN