Hi Readers, in the field of penetration testing, we all know attacks such as Clickjacking, Cross Site Scripting etc. These are attacks from most OWASP Top 10 test cases.
Today we will look into some advanced attack vectors which have been lately around sometime but not all are aware of.
Pastejacking. The art of changing what you copy from web pages.
What is pastejacking?
• Pastejacking is a method that malicious websites employ to take control of your computers’ clipboard and change its content to something harmful without your knowledge.
• This feature can allow malicious websites to take over your computers’ clipboard.
• When you copy something and paste it to your clipboard, the website can run one or more commands using your browser.
• The method can be used to change the Clipboard contents.
• If you paste something directly to the Terminals!? Result: Lethal Commands Executed
To avoid paste jacking:
• Windows users need to check what is placed into your computers’ clipboard.
• Paste the contents into the Notepad. It pastes clipboard as text only and lets you see what is there in the clipboard.
• Result: An additional step to prevent getting Pastejacked.
Attack scenario:
Here we have a sample page which shows a text: “who am i?” as bait for copying. Once this text is selected, it will automatically get replaced in the clipboard with echo ” I @// H4k3r” .
PasteJacking Page
Output on console of pastejacking
What is XSSJacking
XSS jacking is yet another attack which chains together three different attacks: It combines Clickjacking, Pastejacking, and Self-XSS.
For those who may not be aware, here’s a quick intro :
Practical scenario how it can be exploited:
Attack scenario:
Here in first screen shot we can see, a page with two simple text fields, enter your name and enter your name again.
XSS Jacking Step 1
As to be expected a user will type his name first and then use the copy paste function for the second field. The moment he does so the xss alert will be triggered as an abuse of pastejacking method. The victim unknowingly ended up executing the self-XSS in the second field upon which the clickjacking exploit code was set.
So three attacks got executed in a jiffy!
XSS Jacking Step 2
Output page.
XSS Jacking 3
Result: The above two exploits are not really something having a patch!
Since it’s a mix of luck, feasibility and social engineering attacks, needing user intervention, make sure whenever you copy some content from unknown sites, its safe to first copy the content and paste it into a harmless place such as notepad to see what the content in the clipboard is.
References:
The above code for web pages is modified with a shortened form from the original sources of:
• https://github.com/dxa4481/Pastejacking
• https://github.com/dxa4481/XSSJacking
Note: The above article has also been published in Hakin9 https://hakin9.org/download/burp-suite-compendium/