Notes on JSP TLD injection

Another oldie pdf I found on my archive which contains some interesting notes on xss injection on JSPs TLDs (this is probably the smallest pdf I've posted here for a while).

What is interesting about the JSP TLD is that there are two parsing stages (which affect the payloads/exploits/vulnerability state)

F1 How To - Scanning HacmeBank WebServices v0.6 (from 2008)

Another one from the O2 Archives, here is a pdf (shown below) that I wrote in June 2008 that showed how to use F1 (what the O2 Platform used to be called before it was Open Sourced) to scan HacmeBank Website and WebServices

Check out the consolidated graphs that I was able to create at the time. Pretty cool way to visualize multiple traces in one graph :)

The 2nd part of the document, shows how F1 was used to auto-create-callbacks (i.e. tainted sources) in the OunceLabs engine (this feature has since been added to the latest version of IBM AppScan Source)

ASP.NET MVC – XSS and AutoBind Vulns in MVC Example app (from 2008)

Here is a old pdf that I wrote ages ago (Sep 2008) that documents a couple Spring MVC AutoBinding vulnerabilities (similar to the ones shown in Exploiting Microsoft MVC vulnerabilities using OWASP O2 Platform)

Util - Windows Handles - View Handle Screenshot v1.0.exe

Following from Util - Windows Handles Viewer (Simple GUI with REPL) here is nice utility that takes a screenshot of the target handle's window (when the target process doesn't use the the Win32 Windows controls, you will get a screenshot of the main Window)

You can download the 868 Kb tool from: Util - Windows Handles - View Handle Screenshot v1.0.exe

IBM AppScan Source's and AppScan Standard's TreeViews running side-by-site in the same GUI

Using the technique described in Injecting a .NET REPL into an Unmanaged/C++ application (Notepad) I was able to create this PoC (below) where you can see both IBM AppScan Source (Java) and IBM AppScan Standard (.NET) TreeViews hosted inside a 3rd party C# based Form:

Using Jni4Net (Part 4) - Integrating AppScan with TeamMentor (first PoC)

Using the Jni4Net based  Eclipse plugin shown in the Using Jni4Net (Part 3) - Writing and Invoking O2 Methods from Java and Eclipse post, I was able to create a PoC of showing TeamMentor Guidance when a particular security finding is selected (in AppScan Source):

Injecting a .NET REPL into an Unmanaged/C++ application (Notepad)

Using Windows Messages (and some O2 Platform glue) I found a way to 'inject' a window (i.e. a windows control) from one process into another one.

Its is actually quite easy, the key is to use the user32.dll setParent API call to change the location (and rendering) of a particular control.

Here is an example of injecting an .NET TextBox into Notepad (on the left is the .NET Textbox and on the right is the Notepad's Textbox)

Using Jni4Net (Part 3) - Writing and Invoking O2 Methods from Java and Eclipse.pdf

After Using Jni4Net (Part 1) - To C# REPL a java process (ZAP Proxy) and  Using Jni4Net (Part 2) - Controling OWASP ZAP remotely (via Java BeanShell REPL in .Net) the next step was to see if we could consume (and code) the .NET APIs from Java.

And again Jni4Net really worked!

Here is a .NET WinForms control, coded and executed from the (Eclipse written) Java code:

Using Jni4Net (Part 2) - Controling OWASP ZAP remotely (via Java BeanShell REPL in .Net)

Once I was able to Use Jni4Net (Part 1) - To C# REPL a java process (ZAP Proxy) I was able to use the ZAP BeanShell support to start controlling and manipulating ZAP's GUI from the .Net C# REPL.

Here is an example of adding a new 'Site' (i.e. a TreeNode) to the main ZAP 'Site's window (i.e. TreeView)

Using Jni4Net (Part 1) - To C# REPL a java process (ZAP Proxy)

Last week I discovered the Jni4Net FOSS project which provides the foundation blocks to create a Java bridge to .Net (and vice-versa).

To try Jni4Net, and see if it was really possible to have .Net and Java code running on the same process (with the CLR and JVM being able to invoke each other's methods), I decided to see if I could connect the O2 Platform with the OWASP ZAP project (with both running on the same process)

My first step was to use the Injecting C# DLLs into Managed (C#) and Unmanaged (C++) processes  O2 capabilities to inject an C# REPL into the ZAP process.

And here they are in action:

• the foreground window is the (CLR based) C# REPL 
• the background window is the (JVM based) ZAP process.

Scripting MDbg and DbgHostLib

If you are into script .Net debugging sessions (see WinDbg, Cdb, Sun-Of-Strike and Util - Start SoSNet (O2 Version).exe  and Scripting SoS (Sun-of-Strike) .Net managed extension using O2 ) you will also find interesting the Scripting MDbg.pdf and  Scripting DbgHostLib.pdf documents (both embedded below)

Scripting SoS (Sun-of-Strike) .Net managed extension using O2

If you want to script the Sun-of-Strike (SoS) managed .Net debugging extension (see WinDbg, Cdb, Sun-Of-Strike and Util - Start SoSNet (O2 Version).exe post) you should read the Scripting SoS.net pdf (embedded bellow) since it provides a detailed explanation (with tons of scripts) of how I used the O2 Platform to script (in realtime) SoS and to create the Util - Start SoSNet (O2 Version) v1.0.exe tool (see also the SunOfStripeAPI.cs and SosNet scripts folder)

TeamMentor Vulnerability Disclosures: CSRF , ClickJacking and Get Password Hash from Browser Memory

Following the Test and Hack TeamMentor server with 3.2 RC5 code and SI library post, Dinesh Shetty took the challenge and sent me 3 nice documents with a number of security issues on the 3.2 version of TeamMentor (note that we are also Creating an TeamMentor Security Bounty Program)

Here are some comments on the 3 issues, and below you can see the PDFs he submitted:

O2 Platform AppScan Standard Plugin (first version)

Using AppScan Standard SDK here is a simple Plug-in that adds O2 Platform's Log Viewer and C# REPL environment to this AppScan menu.

Using Roslyn to Load and (quickly) Compile C# Solution files (outside VisualStudio)

Now that we can use Roslyn to compile (and create assemblies) in real-time the next step is to use it to open up and consume C# Solution files (something that I've always wanted to do properly without needing to use VisualStudio or deal with the xml format used by the *.sln files).

Weird Roslyn.Utilities.SerializableDataStorage casting issue when using new version

While writing a couple Roslyn scripts I started having a weird problem when consuming the June 2012 CTP dlls.

I was having the exception:

Unable to cast transparent proxy to type 'Roslyn.Utilities.SerializableDataStorage'. Unable to cast transparent proxy to type 'Roslyn.Utilities.SerializableDataStorage'.

3 pdfs on how I added Roslyn support to the O2 Platform (lots of Roslyn Script examples)

As you saw on Video: Real time Vulnerability Scanning using Cat.Net and Roslyn (SAST) and Video: Using O2's Roslyn-based C# REPL Script environment I was able to add a good number of Roslyn capabilities to O2.