Dom Flow - Untangling The DOM For More Easy-Juicy Bugs

by Ahamed Nafeez
Modern day web applications are quite JavaScript heavy and its only going to get worse for pen-testers and scanners alike, because of the complexity involved. Client side attacks like DOM XSS, insecure usage of WebSockets, unwanted use of Global variables, insecure user-defined functions, and many other similar patterns are quite hard to detect for the pen-tester manually or even by static JavaScript analysers.
How about we hook onto all the JavaScript actions dynamically and transparently? The results are very useful to conduct more advanced penetration tests on web apps. Existing JS dynamic analysis tools only work if its built within the code, such as performance analysis. Moreover, the JS files are minified in production. To solve this problem enter Hookish!
Hookish! is an open-source chrome-extension which overrides most of the DOM properties and brings out the interesting stuff to the pen-tester. For instance, imagine a single page web-app with some complex JS code and you would like to know whether all the content being dynamically updated to the DOM are clean. Do they use a safe filter / encoder before pushing it to the DOM? Well, Hookish! can solve this problem for you. It hooks into all XHR responses, and matches those strings with DOM mutation events like DOMNodeInserted, DOMSubtreeModified etc. and also tries relevant payloads to check whether there are possible DOM XSS vulnerabilities and other such shenanigans. This is just scratching the surface, things can become more intuitive when a pen-tester uses Dom Flow.
Dom Flow is a feature where one can drag and drop the sources and sinks as he wishes to understand how data flows between them in the given app. This is something which brings out more understanding of the app and reveals hidden DOM based bugs and also helps the pen-tester to conduct further attacks.

[@domaincontroller]

03:38 today's state 06:45 the hello world of DOM XSS 07:20 document.write() 07:46 common sources/sinks, 25 millions flows later 08:49 why do this kind of problems come to existence, string into code 09:40 direct way 10:57 jQuery selector, $(x) as query selector 12:18 why is it especially hard to find 13:25 existing tools, Dominator Pro, tools, patching v8 for tracking sources 14:33 what can we look for in addition of DOM XSS, logical bugs =============================== DOM Injection ============================== 15:00 DOm-based open redirection 15:40 every kind HTML5 manipulation, webstorage, websockets 15:57 second order DOM Injection 17:00 globally exposed variables in the DOM, DOM clobbering 17:51 hookish github.com/skepticfx/hookish 23:00 damnvulnerable.me, google firing range 24:05 how hookish works, Dom hooks library 01:00:05 domhooks.js 26:33 overridding, cookies 27:45 Not all sources/sinks can be overriden, JS Suicide 29:57 domstorm, tracking status of all properties that can be override

[@dollarnote]

Good one, Bro