lj_dev: the XSS security challenge

Brad Fitzpatrick (

bradfitz) wrote in

lj_dev,
@ 2006-01-30 22:18:00

the XSS security challenge
Anybody bored and want a permanent account? Read on:

We're going to be running an XSS (Cross site scripting / Javascript injection) bug hunt challenge soon here. The biz people like the idea but need to squabble over rules and legal stuff. Unofficially, it'll involve giving out permanent accounts and money (or gift certificates).

So while I can't promise you jack right now in terms of money, I can give out permanent accounts like candy, so I'll announce the first round of the game:

STEP 1: Go to http://www.test.dev.livejournal.org/ . Make an account. Probably need to change it to paid so you can make styles/etc.

STEP 2: Inject some JavaScript. Use S1, S2, CSS, overrides, you name it. It'd probably help if you read the HTML and CSS cleaner code in cvs to look for bugs, but it's not required. If you want, the code is at:

cvs/livejournal/cgi-bin/cleanhtml.pl
cvs/wcmtools/lib/HTMLCleaner.pm
cvs/wcmtools/lib/CSS-Cleaner/lib/CSS/Cleaner.pm

CVS viewers are at http://cvs.danga.com/ and http://cvs.livejournal.org/ .

STEP 3: Email me (brad@danga.com) with subject containing at least "XSS-LJ", and a URL to a minimal test case illustrating your hole. I need to know how you did it, source code, maybe your test account's password, whatever it takes. The more clear it is, the more likely you win and I don't accept somebody else's later but more clear bug report first. After you find a hole, go create a new account for your next hole.

Brad's unofficial rules: I am judge, jury, and sole candy giver, at least until there are official rules. If I give you a permanent account, that doesn't mean you're not eligible for money/gift certificates later. We'll retroactively give that out for the best/hardest-to-fix/most-clever holes after the fact.

NOTE: The code running on the above URLs isn't live on the site yet. We don't care about holes at www.livejournal.com, because they're likely already fixed in the test code. The test code will go live on the site soon-ish. So reproduce (or produce) your bug reports on the test machine.

NOTE 2: The test machine above is a small virtual machine. I might not have given it enough memory. If it sucks, I'll increase it. Bear with me.

Page 1 of 2
<<	[1] [2]	>>

(Post a new comment)

	vxjasonxv 2006-01-31 06:36 am UTC (link)
	Free paid accounts? Whoo! Oh wait, isolated database :(. (Reply to this)(Thread)(Expand)

	anton 2006-01-31 06:43 am UTC (link)
	Can't create an account at there: 'unable to connect' when opening https://www.test.dev.livejournal.org/create.bml (Reply to this)(Thread)(Expand)

	andfarm 2006-01-31 06:48 am UTC (link)
	Damn, I found mine (and reported it, natch) back in December. Do I get a cookie? (Reply to this)(Thread)(Expand)

	ashley_y 2006-01-31 07:23 am UTC (link)
	And to think I paid $200 back in June... (Reply to this)(Thread)(Expand)

	noweb4u 2006-01-31 07:37 am UTC (link)
	check your email :) (Reply to this)(Thread)(Expand)

	Filtering out legitimate CSS? njyoder 2006-01-31 08:28 am UTC (link)
	This gets filtered: <div style="background-image: url('http://www.foo.com/foo.gif')">Test</div> I think it's because of this line: return undef if $v->{value} =~ m!^url! && $v->{value} !~ m!^url[\'\"]?http://!; Maybe I'm missing something, but doesn't that only match url'http://.... and not url('http://... ? You can't use properly formated url('...') properties. (Reply to this)(Thread)(Expand)

	automatonic 2006-01-31 09:11 am UTC (link)
	Sent... something? (Reply to this)

	caladri 2006-01-31 09:14 am UTC (link)
	Sent you a Safari-specific one courtesy of documentation and running strings on the WebKit binary. (Reply to this)

	tgies 2006-01-31 09:23 am UTC (link)
	Found 2, but one might not be That Great. Emails sent. (Reply to this)

	fd0man 2006-01-31 10:37 am UTC (link)
	Very cool. I'm not that well versed in Perl, so I didn't understand much of the code, but it's great that people do. So far, everything I've tried didn't do any Bad Things, but, AFAIC, that's a Good Thing. Keep up the great work! (Reply to this)

	jaebird 2006-01-31 01:34 pm UTC (link)
	Haha, my msn security had issues with your security tags (Reply to this)

	avatar 2006-01-31 02:40 pm UTC (link)
	Isn't this a good way of giving the hackers permanent accounts? Or should we consider that okay since they're helping? (Reply to this)(Thread)(Expand)

	slashdot! immorak 2006-01-31 04:00 pm UTC (link)
	http://it.slashdot.org/article.pl?sid=06/01/31/1324257&threshold=-1 (Reply to this)(Thread)(Expand)

	thehumangame 2006-01-31 04:29 pm UTC (link)
	Heh, does the proof-of-concept exploit code I sent you on Jul 10 count? As I recall it embedded javascript into an offsite CSS stylesheet using IE-specific properties, which could steal non-http-only cookies and do anything a downloadable client could do using XMLHttpRequest. (Reply to this)(Thread)(Expand)

	quadhome 2006-01-31 04:40 pm UTC (link)
	The test machine appears to have gone down from the Slashdot stress. Is there any other way of testing exploit code? I suppose the better follow-up question is, if it's perma-down, can I just e-mail the exploit code? (Reply to this)(Thread)(Expand)

	azalemeth 2006-01-31 07:53 pm UTC (link)
	I should just say that this is frankly a GREAT idea - and that you've been /.ed (though you know that already). I'll snap my fingers and start typing after supper.... (Reply to this)

	legolas 2006-02-01 12:32 am UTC (link)
	Could you grant me priviliges to approve schools on the test machine (legolas also)? I'll be looking for low-hanging fruit mostly, but who knows... (Reply to this)

	panda_cookie 2006-02-01 02:16 am UTC (link)
	Cuteness Attack does not work on the test server: http://pandatest.test.dev.livejournal.org/ (Reply to this)(Thread)(Expand)

	yukinoomoni 2006-02-01 03:35 am UTC (link)
	Wait a second; so instead of making our already existing accounts permanent, we have to make new ones in order to get this? (Reply to this)(Thread)(Expand)

	blackerlotus 2006-02-01 06:48 am UTC (link)
	Found one thing™ and a bug, email sent. (Reply to this)

	panda_cookie 2006-02-01 07:24 am UTC (link)
	Found some bugs. Email sent. Sorry about the Cuteness Attack emails, earlier. :) (Reply to this)

About

Help

Get Involved

Legal

Store

LJ Labs

	noven 2006-02-11 02:42 pm UTC (link)
	XSS is tricky. I've found an easy XSA vulnerability. Would that count? (Reply to this)

Username:		Create an Account Forgot your login? Login w/ OpenID
Password:
	Remember Me
	English • Español • Deutsch • Русский…