Friday, April 17, 2015

The email that's watching you

Today's post contributed by Anthony Piron and Bart Leppens

Cross-site Scripting (XSS) is probably the most common security vulnerability in web applications. Nevertheless, the impact of XSS is still seriously underestimated by many people and even major companies. The CVE-scores given for Cross-Site Scripting issues are low on average. But an adversary doesn't care about scores if Cross-site Scripting vulnerabilities will make his dreams come true.

The impact of Cross-site Scripting in webmail applications does not differ from those in regular web applications. However, mail infrastructure is a top-notch target for a Cross-Site Scripting (XSS) attack.

We released a paper that explains why Cross-Site Scripting in webmail applications is a serious issue. The paper is called "The email that is watching you" (https://bmantra.github.io/publications/the-email-that-is-watching-you.pdf)

For some of the attacks described in this paper we have created modules in BeEF. The following video demonstrates exploitation of IBM iNotes with BeEF using CVE-2014-0913 as described in our paper:



We hope that our paper and this video prove that Cross-Site Scripting is not merely an anecdotical thing, but a real-world attack vector with serious consequences.

-------------------------------------------
Anthony Piron

Anthony has been an ICT professional for far too long: 15 years. He has worked non-exhaustively as a developer, dev ops, monitoring engineer, network specialist, project leader, and division manager. He has witnessed numerous foreseeable security fiascos. In his free time, he likes reading about and experimenting in the domains of computer science, hacking, security and mathematics.

Bart Leppens

Bart is an IT professional with over 10 years of experience with a strong focus on security. During his free time he spends a fair amount of time on (application) security. He likes contributing to the BeEF project and attending security conferences. Bart is not afraid of assembly code.

40 comments:

  1. The information you have posted is very useful kite-projects.co.uk. The sites you have referred was good. Thanks for sharing.

    ReplyDelete
    Replies
    1. I have read your blog its very attractive and impressive. I like it your blog.

      Email Marketing India Email Marketing Services India

      Delete
  2. Indeed decide this genre of fabulous domain you entertain thoroughfare should you be. Dazzling persuade lode in increase to a heinous triumph for the compatible outing currently i increment stunned you should desolate suggest accomplished this favorable of.eva wigs

    ReplyDelete
  3. They will in all likelihood open and read your sends and if your offer is great, you stand a higher opportunity to make deals. You can likewise share valuable data, for example, industry news to your endorsers of keep them redesigned with the present pattern. https://dcit.newcastle.edu.au/education/2016/09/22/the-most-popular-email-services-in-the-world/

    ReplyDelete
  4. Making use of collection processing computer software effectively is surely an important quandary expertise to view. For this rendezvous an individual exhilarated training collar a derisive alms.dallas web developer

    ReplyDelete
  5. I laughed out loud, shed some tears … Scrambled Eggs is a theatrical feast for women of all ages and the men who love them!" and CBS’ Magee Hickey “I haven't laughed so hard in years. It's touching, poignant, funny and oh so very real."silver bow tie

    ReplyDelete
  6. Really i appreciate the effort you made to share the knowledge.
    browser Help Number UK
    browser Helpline Number UK

    ReplyDelete
  7. One can send and receive a mail either from his e-mail account from a web browser or an account configured in an e-mail program. temporary email address

    ReplyDelete
  8. The rectification brings instant changes and rewards users by seeing their problems getting solved.
    extract emails

    ReplyDelete
  9. There is so much in this promopays article that I would never have thought of on my own. Your content gives readers things to think about in an interesting way. Thank you for your clear information.

    ReplyDelete
  10. This is such a great resource that you are providing and you give it away for free. I love seeing blog that understand the value of providing a quality resource for free.should i refinance home

    ReplyDelete
  11. I blog frequently and I really thank Murcia you for your information. The article has truly peaked my interest. I will book mark your blog and keep checking for new information about once per week. I opted in for your RSS feed too

    ReplyDelete
  12. Valuable information! Looking forward to seeing your notes posted. The information you have posted is very useful. Keep going on, good stuff. Thank you for this valuable information. I have enjoyed reading many of the articles and posts contained on the website, keep up the good work and hope to read some more interesting content in the future. Executive Protection

    ReplyDelete
  13. I as of late had an astonishing chance to present this at Kiwicon 2014, and I was quick pest control in tucson az to get the code into BeEF. This blog entry gives a brief rundown of WebRTC and how it functions.

    ReplyDelete
  14. your blog is very attractive and impressive. i appreciate to share the knowledge Web Hosting

    ReplyDelete
  15. http://aborsi-tuntas.com/
    Obat Aborsi Cara Ampuh Penggugur Janin
    http://obat-aborsi99.com/
    Obat Penggugur Kandungan Janin
    http://klinikfarma.com/
    Jual Obat Aborsi Alsi
    http://situs-online.com/
    Jual Obat Aborsi Penggugur Kandungan
    http://obattelat-bulan.com/
    Obat Aborsi Obat Penggugur Kandungan, Jual Obat Aborsi Ampuh
    http://obat-aborsi-aman.com/
    Obat Aborsi Cytotec
    http://obataborsi-ampuh.com/
    Jual Obat Aborsi Cytotec
    http://jual-cytoteconline.com/
    Cara MenggugurKan Kandungan Janin

    ReplyDelete
  16. Softhof is a reliable hosting company which offers web hosting in Pakistan, domain registration in Pakistan and VPS hosting in Pakistan. Softhof is provide web hosting in Pakistan and it is a specialized in windows hosting as well as Linux web hosting provider company in Pakistan, offers best web hosting services with free domain name. Softhof providing low cost web hosting in Pakistan, with free domain, reseller hosting, dedicated support and your satisfaction as the best web hosting company.
    Web Hosting in Pakistan

    ReplyDelete
  17. You could use this phone locator for some interesting situations or for just having fun with your friends

    ReplyDelete
  18. Hey!
    The information you have posted is very useful financing home construction The sites you have referred was good. Thanks for sharing.

    ReplyDelete
  19. I didn't understand this visual and criteria for Gold medal with 6 fingers. Please explain.Commercial real estate attorney

    ReplyDelete
  20. The information you have posted is very useful. Keep going on, good stuff. Thank you for this valuable information.

    ReplyDelete
  21. Can I just say, Josh, that Permanent Saturday continues to astound. It's probably my favourite regular feature on the site at the moment (the closest competition is Jack's Bronze deer statues, but it's a lot harder to find a time when I've got the concentration to listen to those, so I never get to comment before the announcement posts fall away into history).

    ReplyDelete
  22. i know yes yes i yes we all visited this part of the word last year - stunning scenery and colours, and amazing bird life. The valley of Bezirgan, above Kalkan, is a real treasure to be explored and refinancing calculator home mortgage. As the writer says, the trekking is superb -but it wrecked my aging knees!

    ReplyDelete
  23. Making use of collection processing computer software effectively is surely an important quandary expertise to view. For this rendezvous an individual exhilarated training collar a derisive alms online shoes in Pakistan

    ReplyDelete
  24. As the time passing by popular email services changes. But google would always stay in my heart. I even set up my site on google account.

    ReplyDelete
  25. fantastic site, wherein did u provide you with the statistics on this posting?i have examine most of the articles in your website now, and that i sincerely like your style. thank you one million and please keep up the powerful work klasbahis.free download garrys mod

    ReplyDelete
  26. As a blogger, I am sure that you would like your blog to make some serious noise online. You want people to talk about it and you want your visitors to recommend it to their friends and family members.play gmod demo

    ReplyDelete
  27. Your blog postings are going well but it is getting more and more difficult to come up with new topics about which to write. After reading this article, coming up with blog topics will no longer be an issue.loafers shoes prices in Pakistan

    ReplyDelete
  28. Writing is an interesting art if properly crafted. The more interesting fact is that anyone can write. All you need to do is begin to write and then, your creative juices will take over.men shoes in pakistan

    ReplyDelete
  29. Every hour, there are hundreds of web sites are adding to digital world. However all websites are not successful and there are many fit falls on each website.Click Here

    ReplyDelete
  30. It would be less demanding for the marketer to secure more exact data from the potential leads through online studies in different emails sent to comprehend the requirements of the consumers better. US Email Lists 2018

    ReplyDelete
  31. Success on the internet is what you are after. This assumption is based on two facts; that you are taking the time out to read this article, and the fact that more and more people are now realizing that the internet is a potential goldmine. best garrys mod games

    ReplyDelete
  32. Thanks for information. Very interesting, by the way I use some custom essay writting service - https://ferdigskrevet.com/

    ReplyDelete
  33. Admiring the time and effort you put into your blog and detailed information you offer! I like the video torrents

    ReplyDelete
  34. Welcome to the Best writer Review, Here you can get the best All Assignment Help reviews sites. We strongly urge you to check our entire website once and we will assure you will find this review website very useful. Our hard work will be rewarded if students like you will appreciate our effort and spread the message about this site with your class-fellows and friends.

    ReplyDelete
  35. If you feel that you need help when it comes to writing sociology papers then we could help you. Here at Erik Erikson psychosocial theory we have some of the best professional writers that are ready and waiting to make your academic writing very much easier. In fact, we can take all the stress and hard work out of writing, so that you are free to get on with whatever else you choose to do

    You may decide to try and buy a sociology research paper online somewhere but you need to be aware of some things. Those sites will offer sociology papers for sale but they have been sold to hundreds of other people. You have no idea where those papers came from and who wrote them. You do not know the academic level of the writer and chances are you will have to spend time tweeking the paper to your professor’s specifications. For that kind of hassle you might as well just write the paper yourself.

    ReplyDelete

  36. عندما تستعين بشركة متخصصة في عمل التنظيف الخاصة عندما تكون الشركة لها سمعة طيبة في مجال التنظيف ستحصل على منزل براق وأرضيات و حوائط نظيفة تماما مع الحفاظ على ألوانها من مواد التنظيف لنظافة شيئا ضروريا وخاصة عند تواجد اطفال صغار يخشي عليهم من الاتربة
    شركة تنظيف فلل بالرياض
    شركة تنظيف موكيت بالرياض
    شركة تنظيف كنب بالرياض
    شركة تنظيف واجهات بالرياض
    شركة تنظيف ستائربالرياض
    ارخص شركة تنظيف منازل بالرياض

    ReplyDelete