Casaba Security » XSS http://www.casaba.com/blog Building and breaking software and robots Wed, 11 Jan 2012 18:08:45 +0000 en hourly 1 http://wordpress.org/?v=3.3.1 List of characters for testing Unicode transformations and best-fit mapping to dangerous ASCII http://www.casaba.com/blog/2010/12/list-of-characters-for-testing-unicode-transformations-and-best-fit-mapping-to-dangerous-ascii/ http://www.casaba.com/blog/2010/12/list-of-characters-for-testing-unicode-transformations-and-best-fit-mapping-to-dangerous-ascii/#comments Mon, 20 Dec 2010 18:54:58 +0000 Chris Weber http://www.casaba.com/blog/?p=239

I’m attaching two CSV files for use in test cases and tools.  The uni2asc.csv contains all of the Unicode characters that map to something ASCII < 0×80.  The bestfit.csv  contains all of the known best-fit  mappings to dangerous ASCII between legacy charsets and Unicode.

uni2asc.csv – for straight Unicode to Unicode mappings
bestfit.csv – for legacy charset to Unicode mappings

I gave these to Gareth so they may wind up in HackVertor.

The Unicode database contains meta data about every character, including compatibility mappings, normalization mappings, case mappings, and other decomposition data.  It’s useful for testing to know what special Unicode characters may transform to dangerous ASCII.  For example:

  • U+2134 SCRIPT SMALL O character will transform to the U+006F LATIN SMALL LETTER in certain cases

Of course, if you’re testing for SQL injection or XSS you probably want to know what transforms to dangerous characters like ‘ and <.  We attempted to automate some of this in our x5s tool which has done a good job so far, and we have a big update for that coming soon.

In the bestfit.csv file you’ll find all of best-fit mappings from Unicode to dangerous ASCII < 0×80 (and vice versa) in many of the legacy charsets from http://unicode.org/Public/MAPPINGS/.  There’s some wild legacy stuff in here.  For example:

  • In APL-ISO-IR-68, 0×27 maps to 0x5D in Unicode, and vice versa.

If you put these to use anywhere please let me know so I can pass the word along.

In APL-ISO-IR-68, 0×27 maps to 0x5D in Unicode, and vice versa.

]]> http://www.casaba.com/blog/2010/12/list-of-characters-for-testing-unicode-transformations-and-best-fit-mapping-to-dangerous-ascii/feed/ 0 Unibomber tool for specialized XSS testing http://www.casaba.com/blog/2009/07/unibomber-tool-for-specialized-xss-testing/ http://www.casaba.com/blog/2009/07/unibomber-tool-for-specialized-xss-testing/#comments Tue, 28 Jul 2009 01:04:31 +0000 Chris Weber John Hernandez has been working hard at Casaba to build a specialized testing tool that automates some of the unique techniques we use to find cross-sites scripting bugs (XSS). At Black Hat I'm planning to demo what we have so far. It automates the testing process greatly, by auto-injecting a canary and ID into each input be it query string, HTTP header, or POST parameter. By combining injection with 'output encoding' detection, you get automation that assists pen-testers in finding vulnerability hotspots.

Because it basically bombs a Web-app with a slew of Unicode characters to find XSS bugs we named it the Unibomber.

Appended to the canary is a special character – special because it can transform into a 'dangerous' character through normalization, casing, or best-fit mapping operations. So we end up injecting these special characters all over the place and then detecting where they get transformed and displayed as output.

The beauty is that we can find both reflected and persistent XSS bugs this way. It's not a one-click tool though, this is intended for use by an experienced person who knows how to find and exploit a clever XSS bug.

Anyone who looks for XSS will likely find some good bugs with the Unibomber. We sure have!

]]> http://www.casaba.com/blog/2009/07/unibomber-tool-for-specialized-xss-testing/feed/ 0