Friday, April 17, 2015

The email that's watching you

Today's post contributed by Anthony Piron and Bart Leppens

Cross-site Scripting (XSS) is probably the most common security vulnerability in web applications. Nevertheless, the impact of XSS is still seriously underestimated by many people and even major companies. The CVE-scores given for Cross-Site Scripting issues are low on average. But an adversary doesn't care about scores if Cross-site Scripting vulnerabilities will make his dreams come true.

The impact of Cross-site Scripting in webmail applications does not differ from those in regular web applications. However, mail infrastructure is a top-notch target for a Cross-Site Scripting (XSS) attack.

We released a paper that explains why Cross-Site Scripting in webmail applications is a serious issue. The paper is called "The email that is watching you" (https://bmantra.github.io/publications/the-email-that-is-watching-you.pdf)

For some of the attacks described in this paper we have created modules in BeEF. The following video demonstrates exploitation of IBM iNotes with BeEF using CVE-2014-0913 as described in our paper:



We hope that our paper and this video prove that Cross-Site Scripting is not merely an anecdotical thing, but a real-world attack vector with serious consequences.

-------------------------------------------
Anthony Piron

Anthony has been an ICT professional for far too long: 15 years. He has worked non-exhaustively as a developer, dev ops, monitoring engineer, network specialist, project leader, and division manager. He has witnessed numerous foreseeable security fiascos. In his free time, he likes reading about and experimenting in the domains of computer science, hacking, security and mathematics.

Bart Leppens

Bart is an IT professional with over 10 years of experience with a strong focus on security. During his free time he spends a fair amount of time on (application) security. He likes contributing to the BeEF project and attending security conferences. Bart is not afraid of assembly code.

61 comments:

  1. The information you have posted is very useful kite-projects.co.uk. The sites you have referred was good. Thanks for sharing.

    ReplyDelete
  2. Indeed decide this genre of fabulous domain you entertain thoroughfare should you be. Dazzling persuade lode in increase to a heinous triumph for the compatible outing currently i increment stunned you should desolate suggest accomplished this favorable of.eva wigs

    ReplyDelete
  3. They will in all likelihood open and read your sends and if your offer is great, you stand a higher opportunity to make deals. You can likewise share valuable data, for example, industry news to your endorsers of keep them redesigned with the present pattern. https://dcit.newcastle.edu.au/education/2016/09/22/the-most-popular-email-services-in-the-world/

    ReplyDelete
  4. Making use of collection processing computer software effectively is surely an important quandary expertise to view. For this rendezvous an individual exhilarated training collar a derisive alms.dallas web developer

    ReplyDelete
  5. I laughed out loud, shed some tears … Scrambled Eggs is a theatrical feast for women of all ages and the men who love them!" and CBS’ Magee Hickey “I haven't laughed so hard in years. It's touching, poignant, funny and oh so very real."silver bow tie

    ReplyDelete
  6. Really i appreciate the effort you made to share the knowledge.
    browser Help Number UK
    browser Helpline Number UK

    ReplyDelete
  7. One can send and receive a mail either from his e-mail account from a web browser or an account configured in an e-mail program. temporary email address

    ReplyDelete
  8. The rectification brings instant changes and rewards users by seeing their problems getting solved.
    extract emails

    ReplyDelete
  9. There is so much in this promopays article that I would never have thought of on my own. Your content gives readers things to think about in an interesting way. Thank you for your clear information.

    ReplyDelete
  10. This is such a great resource that you are providing and you give it away for free. I love seeing blog that understand the value of providing a quality resource for free.should i refinance home

    ReplyDelete
  11. I blog frequently and I really thank Murcia you for your information. The article has truly peaked my interest. I will book mark your blog and keep checking for new information about once per week. I opted in for your RSS feed too

    ReplyDelete
  12. Valuable information! Looking forward to seeing your notes posted. The information you have posted is very useful. Keep going on, good stuff. Thank you for this valuable information. I have enjoyed reading many of the articles and posts contained on the website, keep up the good work and hope to read some more interesting content in the future. Executive Protection

    ReplyDelete
  13. I as of late had an astonishing chance to present this at Kiwicon 2014, and I was quick pest control in tucson az to get the code into BeEF. This blog entry gives a brief rundown of WebRTC and how it functions.

    ReplyDelete
  14. your blog is very attractive and impressive. i appreciate to share the knowledge Web Hosting

    ReplyDelete
  15. http://aborsi-tuntas.com/
    Obat Aborsi Cara Ampuh Penggugur Janin
    http://obat-aborsi99.com/
    Obat Penggugur Kandungan Janin
    http://klinikfarma.com/
    Jual Obat Aborsi Alsi
    http://situs-online.com/
    Jual Obat Aborsi Penggugur Kandungan
    http://obattelat-bulan.com/
    Obat Aborsi Obat Penggugur Kandungan, Jual Obat Aborsi Ampuh
    http://obat-aborsi-aman.com/
    Obat Aborsi Cytotec
    http://obataborsi-ampuh.com/
    Jual Obat Aborsi Cytotec
    http://jual-cytoteconline.com/
    Cara MenggugurKan Kandungan Janin

    ReplyDelete
  16. Softhof is a reliable hosting company which offers web hosting in Pakistan, domain registration in Pakistan and VPS hosting in Pakistan. Softhof is provide web hosting in Pakistan and it is a specialized in windows hosting as well as Linux web hosting provider company in Pakistan, offers best web hosting services with free domain name. Softhof providing low cost web hosting in Pakistan, with free domain, reseller hosting, dedicated support and your satisfaction as the best web hosting company.
    Web Hosting in Pakistan

    ReplyDelete
  17. You could use this phone locator for some interesting situations or for just having fun with your friends

    ReplyDelete
  18. Hey!
    The information you have posted is very useful financing home construction The sites you have referred was good. Thanks for sharing.

    ReplyDelete
  19. I didn't understand this visual and criteria for Gold medal with 6 fingers. Please explain.Commercial real estate attorney

    ReplyDelete
  20. The information you have posted is very useful. Keep going on, good stuff. Thank you for this valuable information.

    ReplyDelete
  21. Can I just say, Josh, that Permanent Saturday continues to astound. It's probably my favourite regular feature on the site at the moment (the closest competition is Jack's Bronze deer statues, but it's a lot harder to find a time when I've got the concentration to listen to those, so I never get to comment before the announcement posts fall away into history).

    ReplyDelete
  22. i know yes yes i yes we all visited this part of the word last year - stunning scenery and colours, and amazing bird life. The valley of Bezirgan, above Kalkan, is a real treasure to be explored and refinancing calculator home mortgage. As the writer says, the trekking is superb -but it wrecked my aging knees!

    ReplyDelete
  23. Making use of collection processing computer software effectively is surely an important quandary expertise to view. For this rendezvous an individual exhilarated training collar a derisive alms online shoes in Pakistan

    ReplyDelete
  24. As the time passing by popular email services changes. But google would always stay in my heart. I even set up my site on google account.

    ReplyDelete
  25. fantastic site, wherein did u provide you with the statistics on this posting?i have examine most of the articles in your website now, and that i sincerely like your style. thank you one million and please keep up the powerful work klasbahis.free download garrys mod

    ReplyDelete
  26. As a blogger, I am sure that you would like your blog to make some serious noise online. You want people to talk about it and you want your visitors to recommend it to their friends and family members.play gmod demo

    ReplyDelete
  27. Your blog postings are going well but it is getting more and more difficult to come up with new topics about which to write. After reading this article, coming up with blog topics will no longer be an issue.loafers shoes prices in Pakistan

    ReplyDelete
  28. Writing is an interesting art if properly crafted. The more interesting fact is that anyone can write. All you need to do is begin to write and then, your creative juices will take over.men shoes in pakistan

    ReplyDelete
  29. Every hour, there are hundreds of web sites are adding to digital world. However all websites are not successful and there are many fit falls on each website.Click Here

    ReplyDelete
  30. It would be less demanding for the marketer to secure more exact data from the potential leads through online studies in different emails sent to comprehend the requirements of the consumers better. US Email Lists 2018

    ReplyDelete
  31. Success on the internet is what you are after. This assumption is based on two facts; that you are taking the time out to read this article, and the fact that more and more people are now realizing that the internet is a potential goldmine. best garrys mod games

    ReplyDelete
  32. Thanks for information. Very interesting, by the way I use some custom essay writting service - https://ferdigskrevet.com/

    ReplyDelete
  33. Admiring the time and effort you put into your blog and detailed information you offer! I like the video torrents

    ReplyDelete
  34. Welcome to the Best writer Review, Here you can get the best All Assignment Help reviews sites. We strongly urge you to check our entire website once and we will assure you will find this review website very useful. Our hard work will be rewarded if students like you will appreciate our effort and spread the message about this site with your class-fellows and friends.

    ReplyDelete
  35. If you feel that you need help when it comes to writing sociology papers then we could help you. Here at Erik Erikson psychosocial theory we have some of the best professional writers that are ready and waiting to make your academic writing very much easier. In fact, we can take all the stress and hard work out of writing, so that you are free to get on with whatever else you choose to do

    You may decide to try and buy a sociology research paper online somewhere but you need to be aware of some things. Those sites will offer sociology papers for sale but they have been sold to hundreds of other people. You have no idea where those papers came from and who wrote them. You do not know the academic level of the writer and chances are you will have to spend time tweeking the paper to your professor’s specifications. For that kind of hassle you might as well just write the paper yourself.

    ReplyDelete

  36. عندما تستعين بشركة متخصصة في عمل التنظيف الخاصة عندما تكون الشركة لها سمعة طيبة في مجال التنظيف ستحصل على منزل براق وأرضيات و حوائط نظيفة تماما مع الحفاظ على ألوانها من مواد التنظيف لنظافة شيئا ضروريا وخاصة عند تواجد اطفال صغار يخشي عليهم من الاتربة
    شركة تنظيف فلل بالرياض
    شركة تنظيف موكيت بالرياض
    شركة تنظيف كنب بالرياض
    شركة تنظيف واجهات بالرياض
    شركة تنظيف ستائربالرياض
    ارخص شركة تنظيف منازل بالرياض

    ReplyDelete
  37. Just can’t help to think, how a person can write such amazing stuff.
    Duo Circle

    ReplyDelete
  38. Wonderful illustrated information. I thank you about that. No doubt it will be very useful for my future projects. Would like to see some other posts on the same subject! National Lasagna Day

    ReplyDelete
  39. One tip: always verify email address of all entries in your email list. That way your email marketing campaigns will use fewer resources and will be more effective.

    ReplyDelete

  40. السلام عليكم ورحمة الله وبركاته اما بعد ، اهالي المنطقبة الشرقيه بالمملكة العربية السعوديه يسر شركة شام للخدمات المنزليه ان تعلن لجميع اهالي المنطقه عن بدأ تقديم خدماتها الخاصه بالمسابح للموسم الصيفي الجديد وذلك من خلال فروعا في مدينة الدمام ومدينة الخبر ومدينة القطيف ومدينة الجبيل ، واما عن فرعنا في مدينة الدمام فسوف تجدونه علي المتصفح تحت اسم
    شركة تنظيف مسابح بالدمام
    وايضا تحت اسم
    شركة صيانة مسابح بالدمام
    مقترنا برقم هاتف مندوبنا بالدمام لذل فللفحصول علي اي خدمه تخص المسابح تنظيفها او تشغيلها او صيانتها فليس عليك الا التصال بنا وسوف نصلك فورا ، واما اذل كنت من اهل مدينة الخبر وتحتاج الي ان تستفيد من خدماتنا في مدينة الخبر فسوف تجدنا علي المتصفح تحت اسم
    شركة صيانة وتنظيف مسابح بالخبر
    وفي هذا الفرع نسعد بتقديم كل الخدمات التي تخص المسابح لاهالي الخبر من خدمات تنظيف او صيانة او تشغيل برك السباحه ،ولاننا قد عملنا في شركة شام علي تغطية المنطقة الشرقيه كافه فقد حرصنا علي ان يكون لنا فرع في مدينة القطيف يختص بتقديم خدمات المسابح لجميع اهالي مدينة القطيف والذي سوف تجدونه علي المتصفح تحت مسمى
    شركة تنظيف وصيانة مسابح بالقطيف
    وهنا سوف تجدون كل ما يخص المسابح من خدمات تنظيف المسابح بالقطيف وصيانتها وتشغيلها ‘واما عن مدينة الجبيل فلنا ايضا هناك فرع يختص بتقديم خدمات المسابح لجميع اهالي الجبيل من تنظيف وصيانه وتشغيل وهذا الفرع سوف تجدونه علي المتصفح تحت اسم
    شركة صيانة وتنظيف مسابح بالجبيل
    بهذا اعزائي نكون في شركة شام قد استطعنا ان نغطي كافة انحاء المنطقة الشرقيه وتقديم كافة خدمات المسابح التي يحتاجها اهالي المنطقه باحدث الاساليب والطرق العلميه وباستخدام افضل مواد التنظيف واحسن اجهزة ومعدات الصيانه والتعقيم ، فلا تقلق عزيزي العميل ولا تحتار فشركة شام هي افضل اختيار .

    ReplyDelete
  41. Thank you for posting this article because I had been researching on this topic for a long time
    By Custom essay writing services

    ReplyDelete
  42. Our accounting homework help is the best homework providing company. We believe that our homework plays an important role in the final grades of students. Due to several reasons, students are unable to write accounting homework. Accounting homework requires remarkable knowledge as well as in-depth understanding of the accounting concepts. Students should get our accounting homework help at our company’s website.

    Biology, the study of life, can be fascinating and wondrous. However, certain biology topics can sometimes seem incomprehensible. The best way to get a clear understanding of difficult biology concepts is to study them at home, as well as at school. Students should use quality Do my accounting homework resources when studying. Below are some good resources and information to help you answer some of your biology homework questions.

    ReplyDelete
  43. All Online Assignment help is a web portal where students get help in making assignments for all the subjects, with the help of our experts. You will get 100% plagiarism free assignment. Expert’s consultation is also available for students. If they have any query they can contact with our experts anytime.

    ReplyDelete
  44. You started looking for a real college literature lesson homework help online because of some extraordinary sophisticated assignment that is due soon and you have no clue about a way to approach to its completion.

    Let’s first be clear on one thing: you buy at Help with college homework and we give great homework help. College demands it. And you don’t have to be involved if you are uninclined to do so. You can give us the assignment, explain what you will, and leave us to complete the work. However, our methodology is set up so that you can reap enormous benefits from the process itself. From the day you complete the buying process, you will get to choose your professional writer, and e-mail communication begins immediately.

    ReplyDelete

  45. شركة شام للخدمات المنزليه تقدم لعملائها الكرام افضل خدمات المسابح بالدمام من تنظيف وصيانة على اعلي مستوى من الكفائه والدقه وللتواصل معنا سوف تجدوننا على محرك البحث تحت اسم

    شركة تنظيف مسابح بالدمام

    اطلبنا الان نصلك في الحال ولا تقلق ولا تحتار فشركة شام هي افضل اختيار .

    ReplyDelete
  46. Hey I am, a student in Deakin university. I am a satisfied follower of Sample Assignment.The assignment help that they delivered was just flawless. I have also contacted their experts for marketing assignment help that was delivered before the deadline. Their 100% plagiarism-free work and the professional team of experts is what makes them unique. Also, the way how they catered to my urgency level brings me back to them for more and more Online assignment help.

    ReplyDelete
  47. So why choose us when looking for professional assistance on writing successful medical school essays ? The answer is obvious. We are the team that conceals no information from our customers. You are always welcome to browse our reviews section to discover how satisfied our customers are. We are very proud of our good name and reputation and we are happy to see every single positive response and evaluation of our best practices. From the number of positive responses on our website you may see that we excel ourselves to meet the highest standards you require and we are extremely good at that.

    The fact that you are on cosmetic surgery research paper outline right now means you have found a company of professional essay writers you can trust. A reputable team of highly educated and vastly experienced essayists, we will make sure that the piece of writing you purchase from us is the best one you can imagine. The writers from our agency have the necessary education to give you a very good argumentative essay on health care or an original research paper on health care because health care issues are among the most prioritized directions of our business.

    ReplyDelete
  48. Good Post! Thank you so much for sharing this pretty post, it was so good to read and useful to improve my knowledge as updated one, keep blogging.

    Selenium with python Training in Electronic City

    ReplyDelete
  49. As an established Australia assignment help organization, we always aim to increase the number of in-house experts we have so that we can offer you the perfect assignment writing help in conventional courses like Management, Law, Engineering, etc. Biostatistics assignment help service can be taken by a student so that the understanding of this field becomes easy. The importance of biostatistics is largely felt in need of estimating the risk factors or the subject at risk from a particular disease or ailment or under circumstances of measuring the response rate to a particular drug. TAFE assignment help is one of the many premium services provided by My Assignment Services. We have a dedicated team of expert tutors who have vast experience in providing TAFE assignment help to students all over the world.

    ReplyDelete
  50. diwali image

    Diwali Images: Hello, users, Diwali is on the way and we are left with just one month left.
    On the precious occasion of Diwali, we do wish our ...

    ReplyDelete
  51. Get help from professional coursework writer to ease your writing tasks if you are struggling hard. We are the only online coursework writing service in the UK that caters to your every need. We are the finest British online coursework help agency to help students for almost a decade now. We have obtained the place of being the best coursework help UK service for our choicest and student-friendly benefits.

    ReplyDelete
  52. Good Post! Thank you so much for sharing this pretty post, it was so good to read and useful to improve my knowledge as updated one, keep blogging.

    Dot net training in electronic city

    ReplyDelete
  53. If you are looking for an amenable dissertation writing provider who can come up with excellent sociology dissertation help, then look no further, and get in touch with our experts at the earliest. Scoring promising grades in your semesters will be easier than ever.Our dissertation writer are all qualified meaning they’ve been where you are now – whether that’s as a university student with an urgent need for a top rated dissertation or as a college graduate or undergraduate or even a high school student who is planning ahead for their academic future.

    ReplyDelete
  54. Useful post, thanks! I want to recommend one great tool that reveals personal emails and phone numbers from social networks: improver.io — check it out!find email from linkedin

    ReplyDelete
  55. Gayatri Mantra in hindi

    The Gayatri Mantra is a universal prayer enriched in the Vedas.
    It is also known as Savitri Mantra, which addressed to the Immanent and Transcendent Divine ...

    ReplyDelete
  56. Admiring the time and effort you put into your blog and detailed information you offer!..
    Mason Soiza

    ReplyDelete