Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DuckDuckGo XSS vulnerability

twitter.com

Post reply on HN
Print view View original

1–10 of 25 posts

Re: DuckDuckGo XSS vulnerability

#3

Post by mcintyre1994 »

That second link is seriously scary, how would you ever avoid falling for that? Does anyone know how it works? Going to https://tranquil-bits.surge.sh I'm guessing I'm seeing the attacker's form, but it has duckduckgo.com/vpn as the URL and https.

Edit: If you click submit on the VPN form you get "This could have been a phishing page." so it's definitely the attacker's form, that's crazy.

Re: DuckDuckGo XSS vulnerability

#4

Post by slazaro »

Wow. The example in the tweet would completely fool me. If you just go to the address bar and press enter ("reloading" the page, but actually going to the address), you can see it's just a search.

Re: DuckDuckGo XSS vulnerability

#6

Post by discordianfish »

mcintyre1994 wrote: post #3

That second link is seriously scary, how would you ever avoid falling for that? Does anyone know how it works? Going to https://tranquil-bits.surge.sh I'm guessing I'm seeing the attacker's form, but it has duckduckgo.com/vpn as the URL and https. Edit: If you click submit on the VPN form you get "This could have been a phishing page." so it's definitely the attacker's form, that's crazy.

The problem is the XSS vulnerability. This means the attacker can run arbitrary JS on the site, which I assume is used in the second link to modify the form handlers to run the "This could have been a phishing page.". And yes, that could be used to send the credentials somewhere.

There isn't anything you can do to spot this. This is on DuckDuckGo to fix and they not responding to the report for such long time is irresponsible and not really excusable.

Re: DuckDuckGo XSS vulnerability

#7

Post by mcintyre1994 »

discordianfish wrote: post #6
mcintyre1994 wrote: post #3

That second link is seriously scary, how would you ever avoid falling for that? Does anyone know how it works? Going to https://tranquil-bits.surge.sh I'm guessing I'm seeing the attacker's form, but it has duckduckgo.com/vpn as the URL and https. Edit: If you click submit on the VPN form you get "This could have been a phishing page." so it's definitely the attacker's form, that's crazy.

The problem is the XSS vulnerability. This means the attacker can run arbitrary JS on the site, which I assume is used in the second link to modify the form handlers to run the "This could have been a phishing page.". And yes, that could be used to send the credentials somewhere. There isn't anything you can do to spot this. This is on DuckDuckGo to fix and they not responding to the report for such long time is irre…

They're faking the URL too though - https://duckduckgo.com/vpn isn't a real site or product - it just redirects to a DDG search for vpn. The page is entirely the attacker's, but it shows DDG's domain with https.

It looks like tranquil-bit.surge.sh redirects to http://tranquil-bit.surge.sh/vpn so maybe DDG are somehow setting the URL to whatever the u= param redirects to?

Re: DuckDuckGo XSS vulnerability

#9

Post by jchw »

mcintyre1994 wrote: post #7
discordianfish wrote: post #6

Earlier quoted context omitted.

The problem is the XSS vulnerability. This means the attacker can run arbitrary JS on the site, which I assume is used in the second link to modify the form handlers to run the "This could have been a phishing page.". And yes, that could be used to send the credentials somewhere. There isn't anything you can do to spot this. This is on DuckDuckGo to fix and they not responding to the report for such long time is irre…

They're faking the URL too though - https://duckduckgo.com/vpn isn't a real site or product - it just redirects to a DDG search for vpn. The page is entirely the attacker's, but it shows DDG's domain with https. It looks like tranquil-bit.surge.sh redirects to http://tranquil-bit.surge.sh/vpn so maybe DDG are somehow setting the URL to whatever the u= param redirects to?

The URL faking is with the HTML5 history API. It's possible to fake any URL on that domain because the JavaScript is executed in the context of that domain.

Re: DuckDuckGo XSS vulnerability

#10

Post by interfixus »

Thank you, just the push I've been needing. As of this moment, I'm off to ixquick/startpage, which for one thing doesn't require me to go all laid-back and inclusive on the JavaScript, and which for another has those nifty proxy-links.
Post reply on HN