I can see your local web servers • Hacker News Board

Re: I can see your local web servers

#141

Post by megous » Tue, May 28, 2019, 4:39 PM UTC

kapep wrote: post #99

megous wrote: post #39

Other approach is to create a useful extension like: https://addons.mozilla.org/en-US/firefox/addon/yt-adblock/reviews/ disguise that you're inserting an iframe linking to your web server into every single page user opens, by naming variables and your tracking domain incorrectly and by waiting for an hour after installation (this may also help avoid automatic tests mozilla is doing) and then just sit back and wait an…

Is there any way to get the source code of extensions from the Mozilla web site? I think some years ago you could look at the code in your browser from a link in the version history but I don't see any links at all now.

Right click "Add to Firefox" button and use "save as..". This will get you an xpi file which you can unzip and inspect.

Many addons will use some packing method, bundle all kinds of stuff into their content scripts (jQuery, etc.). It can be hard to review.

Some addons are quite horryfying (you see stuff like `${someText}`) (missing escaping, etc.). I'm quite sure there are some content scripts out there, that have XSS issues, that can be triggered from the page itself. This is great on pages like github, where there's quanta of user controlled content.

So if you want a suggestion for a clever attack:

1] make an extension for facebook or twitter or github that reorganizes the wall somewhat and make a `mistake` like assigning some user controlled content via innerHTML. This will probably pass review.

2] Suggest your addon to your target.

3] Post your payload as a message/tweet/whatever to your target. Now you have extension assisted XSS.

Pretty easy to add XSS to any page, with plausible deinability.

Re: I can see your local web servers

#142

Post by kyle-rb » Tue, May 28, 2019, 4:44 PM UTC

gambler wrote: post #135

When will software engineers finally understand that issues like these aren't problems with some random service you run on your computer, but with the (lack of) security model behind modern web browsing?

Modern web browsing provides for this with same-origin policy. Same-origin policy can be negated by the server if it sets an overly lax CORS directive.

So this is something that's secure by default, but can be broken if the "random service you run on your computer" decides to break it. I don't think that's an issue with the browser's security model.

Re: I can see your local web servers

#143

Post by [deleted] » Tue, May 28, 2019, 4:49 PM UTC

jschwartzi wrote: post #138

nostalgk wrote: post #106

Earlier quoted context omitted.

Yup, excited for the meeting. Haven't seen those guys in a while. Was expecting to learn some security techniques, instead got essentially port scanned :)

Whereas I'm learning that my network is fairly secure against this type of port scanning.

[deleted]

Re: I can see your local web servers

#144

Post by tomc1985 » Tue, May 28, 2019, 5:06 PM UTC

megous wrote: post #39

Other approach is to create a useful extension like: https://addons.mozilla.org/en-US/firefox/addon/yt-adblock/reviews/ disguise that you're inserting an iframe linking to your web server into every single page user opens, by naming variables and your tracking domain incorrectly and by waiting for an hour after installation (this may also help avoid automatic tests mozilla is doing) and then just sit back and wait an…

Hopefully that sort of shenanigans would fail AMO code reviews

Re: I can see your local web servers

#145

Post by jahewson » Tue, May 28, 2019, 5:09 PM UTC

mehrdadn wrote: post #35

Here's a question I've had for a while: WHY in the world do web browsers not block access to localhost? What exactly is the extremely compelling use case that has prevented them from blocking this?

They do...

[Error] Failed to load resource: Origin http://http.jameshfisher.com is not allowed by Access-Control-Allow-Origin. (localhost, line 0)

Re: I can see your local web servers

#146

Post by nothrabannosir » Tue, May 28, 2019, 5:17 PM UTC

tomc1985 wrote: post #144

megous wrote: post #39

Other approach is to create a useful extension like: https://addons.mozilla.org/en-US/firefox/addon/yt-adblock/reviews/ disguise that you're inserting an iframe linking to your web server into every single page user opens, by naming variables and your tracking domain incorrectly and by waiting for an hour after installation (this may also help avoid automatic tests mozilla is doing) and then just sit back and wait an…

Hopefully that sort of shenanigans would fail AMO code reviews

This is not a hypothetical but a smoking gun. That plugin really does those things.

Re: I can see your local web servers

#147

Post by nothrabannosir » Tue, May 28, 2019, 5:29 PM UTC

Anyone using uBlock origin can add these custom rules to protect localhost:

  * localhost * block
  localhost localhost * allow

This should block any non-localhost from accessing localhost.

(note: only protects you superficially, based on DNS. what we'd want is protection based on IP. otherwise you're still exposed to anyone setting their own DNS to 127.0.0.1. but it's something...)

Re: I can see your local web servers

#148

Post by ludwigvan » Tue, May 28, 2019, 5:48 PM UTC

Also if you are a front end developer and are on an insecure WiFi (coworking space or public WiFi) make sure you only bind to localhost.

Otherwise other people on the network can see your frontend code which you are probably compiling with sourcemaps, which will give the attacker almost the complete source code of your SPA.)

Re: I can see your local web servers

#149

Post by cosarara » Tue, May 28, 2019, 5:57 PM UTC

notatoad wrote: post #137

cosarara wrote: post #132

Earlier quoted context omitted.

The reverse proxy is accessible from your browser and is properly configured to not accept random requests from any webpage (See: CORS). The others are not directly accessible, but only through the reverse proxy server. Does that make sense?

not really, no. i still don't see what the reverse proxy or the VM are bringing to the table here. If i'm understanding the necessary CORS config here, it's to simply not send any access-control-allow-origin header, which does not require a VM or reverse proxy, most HTTP services do that by default. simply being accessed through a reverse proxy instead of directly doesn't add any additional security

Actually, you are right.

Re: I can see your local web servers

#150

Post by mrob » Tue, May 28, 2019, 6:04 PM UTC

icebraining wrote: post #77

julienreszka wrote: post #6

Earlier quoted context omitted.

You can't see shit neither

Actually, they can: even if you enable JS, NoScript's ABE will prevent this attack: https://en.wikipedia.org/wiki/NoScript#Application_Boundarie...

Not anymore. It's not included in modern versions (after the changes in Add-Ons for Firefox's Quantum update).