The Metasploit menace inside your firewall
Using the browser as a middleman, the attacker has two way communication. Also, because HTTP is used to send and receive data from the browser it is likely that a Firewall/DMZ will permit the traffic.
Could it work against search engines spiders?
We talked about web browsers loading the exploit from a website, but could this work with different file formats and software? For example Acrobat Reader comes to my mind for this advisory.
This is a new area of research and there are potentially more inter-protocol issues with web technologies. For one, AJAX can allow more flexibility than the methods discussed in the research. Also, different character sets have the potential to yield more tightly controllable Inter-protocol Exploits.
The recently published acrobat cross-site scripting vulnerability could potentially be used to launch Inter-protocol Exploits. Any issue that has the potential to force an application to make a request with controllable content could be used for attacks, provided it meets the requirements of encapsulation and error tolerance.
It is even simpler. If the attacker used an advanced cross-site scripting virus, the payload would be enough to launch the attack on Internal networks. For example the MySpace virus payload was executed one million times in 20 hours. Inter-protocol Exploitation and advanced cross-site scripting viruses are a dangerous combination.
How do you search for new bugs? How do you develop new attacks?
My work brings me into contact with a wide range of platforms and technologies. In recent times, developing BeEF has supported an interest in the dynamics of component interaction in complex, often eclectic, environments.
Interception proxies are a must when developing web attacks. The Odysseus and Burp proxies allow a lot of control over HTTP communication. Increasingly, I am finding the need for generic network proxies like Echo Mirage that hook into network function calls.
Another tool which I couldn't do without is netcat. It is simple and powerful - a great combination. ®
Wade Alcorn is a security researcher/consultant living in Brisbane, Australia. His permanent role at NGS Consulting is Principal Security Consultant. Further to consultancy engagements he has contributed various security tools and published vulnerabilities and white papers.