Hacker News Reader

Comment by matsemann | Hacker News Reader

Can not contain "script".

I hacked a big social platform in my early teens (Nettby.no), since they just did a removal of all banned words, including <script>. I instead wrote <scr<script>ipt> in my profile bio, and after their removal I had a valid html tag injected into the webpage and full control of anyone visiting my page..

View on HN

Well, duh: they needed to make sure to run the script twice.

Make it 3 times, you never know how clever those hackers folks could be!

Make it infinite times and stop after the output stabilizes to a constant string!

I think this is actually a correct solution. Although not particularly elegant or efficient. If as long as if the string is unsafe the string will be modified. Then looping infinitely will never return an unsafe string. If it is also true that the modifications only delete characters then you will eventually arrive at a safe (or empty) string.

Hah, I hacked Nettby in school too, good days.

Nettby had no HTTPS, so I did an ARP poisoning MITM and stole everybody's passwords. Then I posted random nonsense from people's accounts and watched the chaos ensue(did no snooping, even 14yo me had a semblance of ethics somehow).

Eli5 this attack pla

I've no idea what nettby is.

But ARP is how computers figure out what IP address is associated with a hardware / ethernet address, so they know what ethernet address to use for sending packets to a specific IP.

ARP poisoning means you flood the network with fake ARP packets saying your ethernet address has the gateway IP or whatever IP. So then the other devices will forward packets to your machine instead of the intended destination.

As nettby didn't use HTTPS it would then be trivial to capture / read the packets and figure out everyones' passwords. I.e. the messages would be plain text, unencrypted.

Not exactly Eli5, but hope it helps.

This is pretty much the reply I'd write, so I'll just add my endorsement.

Couple more tidbits of information:

  Nettby was a Norwegian Myspace clone and it was all the rage back when I was in middle school(around 2007-2009 or thereabouts).
  ARP stands for Address Resolution Protocol.
  ARP has no security built in by default. This combined with the plaintext passwords made the attack trivial.

Yes but isnt this possible only on LANs?

Correct. I did this at school. It was early days of students being allowed laptops in class.

We weren't actually allowed internet, but the school had an extremely basic wifi network that was WEP encrypted... So naturally I broke out Aircrack-ng and ameliorated that situation. And suddenly everyone was procrastinating on nettby in class.

It should also be said that HTTPS was seldom used outside of especially sensitive applications until ~2010 when someone packaged a HTTP MITM attack up into a handy Firefox extension. I think that Facebook used HTTPS for the actual login credential exchange, snd then bounced back to HTTP, which meant that the session cookie/s were still MITMable.

It’s insane how long it took to see widespread HTTPS adoption.

Yes! Firesheep was the extension, and I think the combination of that and LetsEncrypt (which was in part a reaction to Firesheep) were the reason the web went from almost entirely decrypted by default to almost entirely encrypted by default in a matter of months. The capabilities had been there for years, but Firesheep made session hijacking a literal one-click affair and vividly highlighted the danger of unencrypted web traffic - it’s maybe the most impactful bit of white-hat hackery of all time.

Iirc Google said they'd start penalizing non https sites in search results and browser makers added much more aggressive warnings to http pages.

It caused quite a commotion among small site operators.

I remember back in that time that a lot of apps had convoluted code to do this https only at login dance. All in the name of performance (because https was slower despite it being a premature optimization really). Switching to https only actually mostly helped simplify codebases...

yeah, a colleague and I ripped out all of the http / https dance out of a 20 year old code base a little while back. It simplified things a lot.

That's easy, they should have just removed the angle brackets, job done.

They allowed some html, though, which is why they didn't safely print your bio as a plain (html escaped) string.

oldest injection trick ever :-)

I actually think it's the second oldest, since the first would be just injecting the string itself.

WoW

LOL. I did the same thing with a Coca-Cola site and their MD wrote me a nasty letter and removed my account.

Interesting, can you explain 'full control'?

You can run any JavaScript.

So you can show a popup saying the user needs to log in again, and then log their credentials on your own server instead.

Or exfiltrate their session cookie, or post spam/phishing links on their behalf...

Session cookies are generally not available to javascript. The latter is true though.

Perhaps HttpOnly wasn't as prevalent back then?

Yup, no CORS either, all protections relied on having proper CSRF-tokens, but with JS access one could read that token as well.

My "hack" was mostly pretty harmless. Just did some layout changes to make my profile cooler. But the door was wide open for anything.

Reply on news.ycombinator.com