Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
Researcher bypass email filter – XSS in Gmail’s AMP For Email
Researcher bypass email filter – XSS in Gmail’s AMP For EmailPost Views: 54 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon-1.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes A cross-site scripting (XSS) vulnerability in AMP for Email, Gmail’s dynamic email feature, has netted a security researcher a $5,000 bug bounty payout.AMP for Email brings AMP functionality to rich, interactive emails. AMP itself is an open source HTML framework used to optimize websites for web browsing on mobile.
Adi Cohen, who unearthed the security flaw, said he had no problem finding a vector that triggered an XSS within the AMP playground, but found bypassing Gmail’s XSS filter a much tougher assignment.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Rendering contextsThe “easiest way to circumvent an XSS filter is by tricking it into a different rendering context than what the browser will actually use to render a given piece of code”, observed Cohen in a blog post.
Since AMP for Email forbids the likes of templates, SVG, math, and CSS, he instead targeted stylesheets as a potential path to an XSS payload with multiple rendering contexts.
This required a discrepancy between how the stylesheet is rendered by the filter and browser, either by “tricking the filter into believing a fake style tag is real”, or “the exact opposite”.
Cohen’s initial vector worked in the sandbox because AMP “leaves the CSS context as soon as it encounters the string ‘’ even if it doesn’t have a closing bracket (>) or at least a whitespace after it”.
He was then able to “trick the filter into believing we’re back in HTML context, while the browser obviously ignores entirely and stays well within the realm of CSS”.
Trending: Find Hidden Info using Google Dorking manually, and Automated using Pagodo
Trending: Offensive Security Tool: Offensive-Azure over substanceBut “what looked like a promising vector in AMP, seemed way less interesting after Gmail ran its magic on it,” said Cohen.
A breakthrough came when he harnessed a CSS selector, which ensured the payload was returned unchanged by Gmail – “no escaping or other mutations”.
However, the malicious payload prompted an error after the AMP sandbox encountered ‘’, so Cohen tried , but Gmail’s filter was wise to its resemblance to .
What worked instead was testing a benign payload with an encoded selector – because Gmail decoded it, he could use the selector to inject a closing style tag.
Cohen reported the issue to Google on March 27, 2021, and noticed on July 7 that it had been fixed.
As previously reported by The Daily Swig, Google addressed an unrelated, notable XSS in AMP For Email back in 2019, after security researcher Michał Bentkowski leveraged id attributes in tags to enable ‘DOM clobbering’ attacks.
Trending: New Linux malware called RapperBot brute-forces Linux SSH servers to breach networks
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?
If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: portswigger.net Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-3-1-300x150.png Twitter confirms zero-day used to expose data of 5.4 million accountsAugust 8, 2022
Reading Time: 4 minutes
*[...]
Researcher bypass email filter – XSS in Gmail’s AMP For Email
Researcher bypass email filter – XSS in Gmail’s AMP For EmailPost Views: 54 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon-1.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes A cross-site scripting (XSS) vulnerability in AMP for Email, Gmail’s dynamic email feature, has netted a security researcher a $5,000 bug bounty payout.AMP for Email brings AMP functionality to rich, interactive emails. AMP itself is an open source HTML framework used to optimize websites for web browsing on mobile.
Adi Cohen, who unearthed the security flaw, said he had no problem finding a vector that triggered an XSS within the AMP playground, but found bypassing Gmail’s XSS filter a much tougher assignment.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Rendering contextsThe “easiest way to circumvent an XSS filter is by tricking it into a different rendering context than what the browser will actually use to render a given piece of code”, observed Cohen in a blog post.
Since AMP for Email forbids the likes of templates, SVG, math, and CSS, he instead targeted stylesheets as a potential path to an XSS payload with multiple rendering contexts.
This required a discrepancy between how the stylesheet is rendered by the filter and browser, either by “tricking the filter into believing a fake style tag is real”, or “the exact opposite”.
Cohen’s initial vector worked in the sandbox because AMP “leaves the CSS context as soon as it encounters the string ‘’ even if it doesn’t have a closing bracket (>) or at least a whitespace after it”.
He was then able to “trick the filter into believing we’re back in HTML context, while the browser obviously ignores entirely and stays well within the realm of CSS”.
Trending: Find Hidden Info using Google Dorking manually, and Automated using Pagodo
Trending: Offensive Security Tool: Offensive-Azure over substanceBut “what looked like a promising vector in AMP, seemed way less interesting after Gmail ran its magic on it,” said Cohen.
A breakthrough came when he harnessed a CSS selector, which ensured the payload was returned unchanged by Gmail – “no escaping or other mutations”.
However, the malicious payload prompted an error after the AMP sandbox encountered ‘’, so Cohen tried , but Gmail’s filter was wise to its resemblance to .
What worked instead was testing a benign payload with an encoded selector – because Gmail decoded it, he could use the selector to inject a closing style tag.
Cohen reported the issue to Google on March 27, 2021, and noticed on July 7 that it had been fixed.
As previously reported by The Daily Swig, Google addressed an unrelated, notable XSS in AMP For Email back in 2019, after security researcher Michał Bentkowski leveraged id attributes in tags to enable ‘DOM clobbering’ attacks.
Trending: New Linux malware called RapperBot brute-forces Linux SSH servers to breach networks
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?
If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: portswigger.net Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-3-1-300x150.png Twitter confirms zero-day used to expose data of 5.4 million accountsAugust 8, 2022
Reading Time: 4 minutes
*[...]
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking Researcher bypass email filter – XSS in Gmail’s AMP For Email Researcher bypass email filter – XSS in Gmail’s AMP For EmailPost Views: 54 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon-1.png…
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-2-300x150.png New Linux malware called RapperBot brute-forces Linux SSH servers to breach networksAugust 5, 2022
Reading Time: 4 minutes
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-1-300x150.png Jenkins security: Unpatched XSS, CSRF bugs included in latest plugin advisoryAugust 4, 2022
Reading Time: 3 minutes
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-300x150.png VMware urges admins to patch critical auth bypass bug immediatelyAugust 3, 2022
Reading Time: 3 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Researcher bypass email filter – XSS in Gmail’s AMP For Email first appeared on Black Hat Ethical Hacking.
Reading Time: 4 minutes
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-1-300x150.png Jenkins security: Unpatched XSS, CSRF bugs included in latest plugin advisoryAugust 4, 2022
Reading Time: 3 minutes
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-300x150.png VMware urges admins to patch critical auth bypass bug immediatelyAugust 3, 2022
Reading Time: 3 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Researcher bypass email filter – XSS in Gmail’s AMP For Email first appeared on Black Hat Ethical Hacking.
Zero to Hero Malware Reverse Engineering & Threat Intelligence
https://www.reddit.com/r/redteamsec/comments/wjyjh0/zero_to_hero_malware_reverse_engineering_threat/
submitted by /u/cybersocdm (https://www.reddit.com/user/cybersocdm)
[link] (https://www.reddit.com/r/cybersocitlibrary/comments/wjyfpf/zero_to_hero_malware_reverse_engineering_threat/) [comments] (https://www.reddit.com/r/redteamsec/comments/wjyjh0/zero_to_hero_malware_reverse_engineering_threat/)
https://www.reddit.com/r/redteamsec/comments/wjyjh0/zero_to_hero_malware_reverse_engineering_threat/
submitted by /u/cybersocdm (https://www.reddit.com/user/cybersocdm)
[link] (https://www.reddit.com/r/cybersocitlibrary/comments/wjyfpf/zero_to_hero_malware_reverse_engineering_threat/) [comments] (https://www.reddit.com/r/redteamsec/comments/wjyjh0/zero_to_hero_malware_reverse_engineering_threat/)
Pentester Promiscuous Notebook
https://medium.com/@reconshell.com/pentester-promiscuous-notebook-a230d880a924?source=rss------bug_bounty-5
https://medium.com/@reconshell.com/pentester-promiscuous-notebook-a230d880a924?source=rss------bug_bounty-5
gitbook for keeping my pentest notes on hand. It’s far from being perfect in terms
of organization (that’s why I call it “promiscuous”)…Continue reading on Medium » (https://medium.com/@reconshell.com/pentester-promiscuous-notebook-a230d880a924?source=rss------bug_bounty-5)
of organization (that’s why I call it “promiscuous”)…Continue reading on Medium » (https://medium.com/@reconshell.com/pentester-promiscuous-notebook-a230d880a924?source=rss------bug_bounty-5)
TOP Cross-Chain Bridge Open Test Is Underway
https://medium.com/top-network/top-cross-chain-bridge-open-test-is-underway-ecbfa224d9b7?source=rss------bug_bounty-5
https://medium.com/top-network/top-cross-chain-bridge-open-test-is-underway-ecbfa224d9b7?source=rss------bug_bounty-5
Since the emergence of DeFi, the congestion and high GAS fees of the Ethereum has hit heated discussions and led to the emergence of many…Continue reading on TOP Network » (https://medium.com/top-network/top-cross-chain-bridge-open-test-is-underway-ecbfa224d9b7?source=rss------bug_bounty-5)
Everything you need to know about starting a career in bug bounty hunting
IntroductionContinue reading on Medium »
Read more...
IntroductionContinue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Collider from BlackCat — a working platform for selecting a private key for bitcoin wallets
https://cdn-images-1.medium.com/max/660/0*hACPwgt-MKBbkF5g.jpg
Mathematicians claim that it is almost impossible to find a private key, because finding one specific address is 2²⁵⁶ degrees…
Continue reading on Medium »
Collider from BlackCat — a working platform for selecting a private key for bitcoin wallets
https://cdn-images-1.medium.com/max/660/0*hACPwgt-MKBbkF5g.jpg
Mathematicians claim that it is almost impossible to find a private key, because finding one specific address is 2²⁵⁶ degrees…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Pentester Promiscuous Notebook
https://cdn-images-1.medium.com/max/642/1*psu6XMaWk9fI_vGJihkd5w.jpeg
gitbook for keeping my pentest notes on hand. It’s far from being perfect in terms
of organization (that’s why I call it “promiscuous”)…
Continue reading on Medium »
Pentester Promiscuous Notebook
https://cdn-images-1.medium.com/max/642/1*psu6XMaWk9fI_vGJihkd5w.jpeg
gitbook for keeping my pentest notes on hand. It’s far from being perfect in terms
of organization (that’s why I call it “promiscuous”)…
Continue reading on Medium »
Everything you need to know about starting a career in bug bounty hunting
https://medium.com/@capturethebugs/everything-you-need-to-know-about-starting-a-career-in-bug-bounty-hunting-d21f4eb72cd2?source=rss------bug_bounty-5
https://medium.com/@capturethebugs/everything-you-need-to-know-about-starting-a-career-in-bug-bounty-hunting-d21f4eb72cd2?source=rss------bug_bounty-5
IntroductionContinue reading on Medium » (https://medium.com/@capturethebugs/everything-you-need-to-know-about-starting-a-career-in-bug-bounty-hunting-d21f4eb72cd2?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
Twilio discloses data breach after SMS phishing attack on employees
Twilio discloses data breach after SMS phishing attack on employeesPost Views: 20 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon-1.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes Cloud communications company Twilio says some of its customers’ data was accessed by attackers who breached internal systems after stealing employee credentials in an SMS phishing attack.“On August 4, 2022, Twilio became aware of unauthorized access to information related to a limited number of Twilio customer accounts through a sophisticated social engineering attack designed to steal employee credentials,” Twilio said over the weekend.
“The attackers then used the stolen credentials to gain access to some of our internal systems, where they were able to access certain customer data.”
The company also revealed the attackers gained access to its systems after tricking and stealing credentials from multiple employees targeted in the phishing incident.
To do that, they impersonated Twilio’s IT department, asking them to click URLs containing “Twilio,” “Okta,” and “SSO” keywords that would redirect them to a Twilio sign-in page clone.
The SMS phishing messages baited Twilio’s employees into clicking the embedded links by warning them that their passwords had expired or were scheduled to be changed.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course
Twilio’s EMEA Communications Director Katherine James declined to provide more information when asked how many employees had their accounts compromised in the phishing attack and how many customers were affected by the breach, saying the company has “no additional comment to provide at this time beyond what is posted in the blog.”
https://www.bleepstatic.com/images/news/u/1109292/2022/Twilio_phishing_SMS.png
<figcaptionTwilio SMS phishing message (Twilio)
“The text messages originated from U.S. carrier networks. We worked with the U.S. carriers to shut down the actors and worked with the hosting providers serving the malicious URLs to shut those accounts down,” Twilio added.
“We have heard from other companies that they, too, were subject to similar attacks, and have coordinated our response to the threat actors – including collaborating with carriers to stop the malicious messages, as well as their registrars and hosting providers to shut down the malicious URLs. Despite this response, the threat actors have continued to rotate through carriers and hosting providers to resume their attacks.”
Trending: Find Hidden Info using Google Dorking manually, and Automated using Pagodo
Trending: Offensive Security Tool: Offensive-Azure Credentials revoked, attackers yet to be identifiedThe company has not yet identified the attackers, but it’s working with law enforcement as part of an ongoing investigation.
Twilio revoked the employee accounts compromised during the attack to block the attackers’ access to its systems and has started notifying customers affected by this incident.
“As the threat actors were able to access a limited number of accounts’ data, we have been notifying the affected customers on an individual basis with the details,” Twilio also revealed.
The company also disclosed in May 2021 that it was impacted by last year’s Codecov supply-chain attack where threat actors modified the legitimate Codecov Bash Uploader tool to steal credentials, secret keys, and user tokens from Codecov customers.
With more than 5,000 employees in 26 offices in 17 countries, Twillio provides programmable voice, text, chat, video, and email APIs used by over 10 mi[...]
Twilio discloses data breach after SMS phishing attack on employees
Twilio discloses data breach after SMS phishing attack on employeesPost Views: 20 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon-1.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes Cloud communications company Twilio says some of its customers’ data was accessed by attackers who breached internal systems after stealing employee credentials in an SMS phishing attack.“On August 4, 2022, Twilio became aware of unauthorized access to information related to a limited number of Twilio customer accounts through a sophisticated social engineering attack designed to steal employee credentials,” Twilio said over the weekend.
“The attackers then used the stolen credentials to gain access to some of our internal systems, where they were able to access certain customer data.”
The company also revealed the attackers gained access to its systems after tricking and stealing credentials from multiple employees targeted in the phishing incident.
To do that, they impersonated Twilio’s IT department, asking them to click URLs containing “Twilio,” “Okta,” and “SSO” keywords that would redirect them to a Twilio sign-in page clone.
The SMS phishing messages baited Twilio’s employees into clicking the embedded links by warning them that their passwords had expired or were scheduled to be changed.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course
Twilio’s EMEA Communications Director Katherine James declined to provide more information when asked how many employees had their accounts compromised in the phishing attack and how many customers were affected by the breach, saying the company has “no additional comment to provide at this time beyond what is posted in the blog.”
https://www.bleepstatic.com/images/news/u/1109292/2022/Twilio_phishing_SMS.png
<figcaptionTwilio SMS phishing message (Twilio)
“The text messages originated from U.S. carrier networks. We worked with the U.S. carriers to shut down the actors and worked with the hosting providers serving the malicious URLs to shut those accounts down,” Twilio added.
“We have heard from other companies that they, too, were subject to similar attacks, and have coordinated our response to the threat actors – including collaborating with carriers to stop the malicious messages, as well as their registrars and hosting providers to shut down the malicious URLs. Despite this response, the threat actors have continued to rotate through carriers and hosting providers to resume their attacks.”
Trending: Find Hidden Info using Google Dorking manually, and Automated using Pagodo
Trending: Offensive Security Tool: Offensive-Azure Credentials revoked, attackers yet to be identifiedThe company has not yet identified the attackers, but it’s working with law enforcement as part of an ongoing investigation.
Twilio revoked the employee accounts compromised during the attack to block the attackers’ access to its systems and has started notifying customers affected by this incident.
“As the threat actors were able to access a limited number of accounts’ data, we have been notifying the affected customers on an individual basis with the details,” Twilio also revealed.
The company also disclosed in May 2021 that it was impacted by last year’s Codecov supply-chain attack where threat actors modified the legitimate Codecov Bash Uploader tool to steal credentials, secret keys, and user tokens from Codecov customers.
With more than 5,000 employees in 26 offices in 17 countries, Twillio provides programmable voice, text, chat, video, and email APIs used by over 10 mi[...]