Javascript function hijacking

By luoluo
On 2007-11-30
Luoluonet_at_yahoo.cn
Http://www.ph4nt0m.org

I. Overview

Javascript function hijacking, that is, the javascript hijacking technology mentioned by foreigners. A piece of code that was accidentally seen when I first discussed the problem with Jian Xin, probably written like this:

Window. alert = function (s ){};

I think this method is clever and novel. It is similar to API Hook. simply called javascript function hook, that is, function hijacking. By replacing the implementation of js functions to hijack this function call, an example of a complete hook alert function is as follows:

<! --1.htm -->
<Script type = "text/javascript">
<! --
Var _ alert = alert;
Window. alert = function (s ){
If (confirm ("do you want to play the box, the content is" "+ s + ""? ")){
_ Alert (s );
}
}
// -->
</Script>
<Html>
<Body>
<Input type = "button" onclick = "javascript: alert (Hello World !) "Value =" test "/>
</Body>
</Html>

Those who have worked on API Hook will surely smile at this code. They will save the original function implementation and then replace it with our own function implementation, after adding our own processing logic, we finally call the original function implementation, so that this alert function is hijacked. The principle is very simple. Let's take a look at some typical applications to see what we can do with it.


II. Application Example

1. to implement a simple javascript debugger, debugger compares the title party. In fact, it is a bit similar to the debugger function. It mainly uses js function hijacking to implement the function's break point, let's take a look at a simple example:

<Script type = "text/javascript">
<! --
Var _ eval = eval;
Eval = function (s ){
If (confirm ("eval called function" + eval. caller + "call parameter" + s )){
_ Eval (s );
}
}
// -->
</Script>
<Html>
<Head>
</Head>
<Body>
<Script type = "text/javascript">
<! --
Function test (){
Var a = "alert (1 )";
Eval ();
}

Function t (){
Test ();
}

T ();
// -->
</Script>
</Body>
</Html>

Use JavaScript Functions to hijack and interrupt function execution, and display parameters and function caller code to see the effect of a complete example:

> Help
Debug commands:

Bp <function name>-set a breakpoint on a function, e.g. "bp window. alert ".
Bl-list all breakpoints.
Bc <breakpoint number>-remove a breakpoint by specified number, e.g. "bc 0 ".
Help-help information.

> Bp window. alert
* Breakpoint on function "window. alert" added successfully.

> Bl
* 1 breakpoints:
0-window. alert

> Bc 0
* Breakpoint on function "window. alert" deleted successfully.

This example shows how to set breakpoints, view breakpoints, and delete breakpoints. The complete code is provided in appendix [1] of this article.

2. set traps to capture cross-site Testers in real time. Cross-Site testers are always used to alert to check whether cross-site testers exist. If you want to monitor whether someone is testing your website xss, you can hook the alert function on the page you want to monitor to record alert calls:

<Script type = "text/javascript">
<! --
Function log (s ){
Var img = new Image ();
Img. style. width = img. style. height = 0;
Img. src ="Http://yousite.com/log.php? Caller ="+ EncodeURIComponent (s );
}

Var _ alert = alert;
Window. alert = function (s ){
Log (alert. caller );
_ Alert (s );
}
// -->
</Script>

Of course, you need to add this function to the very beginning of the page, and it is also relatively concealed. Hehe, you can even make alert not to play the box or play a warning box, so that the tester can get crazy.

3. dom xss automatic scanning is implemented. Currently, the common XSS automatic scanning method is to search for features from http returned results to determine whether a vulnerability exists. However, this method is not applicable to dom xss scanning, because dom xss is caused by client scripts, for example, google's cross-site mechanism found by Jianxin some time ago (see Appendix [2]) is as follows:

Document. write (document. location. hash );

Such cross-site data cannot be reflected in http response, so traditional scanning methods cannot be scanned. However, if you are inspired by the above example, you will surely think of a way to set the trap. dom xss eventually causes alert to be executed, So we hook the alert function to set the trap, if the XSS succeeds, the alert function will be called to trigger the result of logging the trap. This will enable automatic dom xss scanning. The trap code is similar to the above.

4. flexible Use of js hijacking to assist in page code analysis. For example, when analyzing webpage Trojans, you may often use eval or document. write to encrypt, So we write the section hook eval and document. write tool, assisted in decryption:

<Script type = "text/javascript">
<! --
Var _ eval = eval;
Eval = window.exe cScript = Invalid variable Doc ument. write = Invalid variable Doc ument. writeln = function (s ){
Document. getElementById ("output"). value = s;
}
// -->
</Script>
<Html>
<Body>
Input:
<Textarea id = "input" cols = "80" rows = "10"> </textarea>
<Input type = "button" onclick = "javascript: _ eval (document. getElementById (input). value);" value = "decode"/>
<Br/>
Output:
<Textarea id = "output" cols = "80" rows = "10"> </textarea>
</Body>
</Html>

Enter the encryption code in the input box:

Eval (unescape ("% 61% 6C % 65% 72% 74% 28% 31% 3B "));

Output the decoded code in the output box:

Alert (1 );

Of course you can think of more flexible applications :)


Iii. Anti-Hijacking

When talking about hijacking, we must talk about anti-hijacking. If you want to write a robust xss playload, you need to consider anti-hijacking. There are two problems to solve:

How can I determine whether the instance is hijacked?
How can we counter hijacking if we find it hijacked?

1. Determine whether a function is hijacked. What is the difference between writing a Applet and writing a function before and after it is hooked:

<Textarea id = "tb1" cols = "80" rows = "8"> </textarea>
<Script type = "text/javascript">
<! --
Document. getElementById ("tb1"). value = eval + "";
Var _ eval = eval;
Eval = function (s ){
Alert (s );
_ Eval (s );
}
Document. getElementById ("tb1"). value + = eval;
// -->
</Script>

Result:

Function eval (){
[Native code]
}

Function (s ){
Alert (s );
_ Eval (s );
}

We found that the built-in functions are [native code], while the custom functions are specific function definitions. With this feature, we can simply check whether the functions are hijacked:

Function checkHook (proc ){
If (proc. toString (). indexOf ("[native code]")> 0 ){
Return false;
} Else {
Return true;
}
}

2. the first idea of how to counter hijacking is to restore the hijacked function. If the hijacked person saves the original function in a variable, it's okay to call the original function directly, but what should I do if the hacker himself does not save the copy? I can only create a new environment and use the clean functions in the new environment to restore the environment we have been hooked up. How can I create a new environment? The entire new iframe is ready, and it is a completely new environment. OK:

Function unHook (proc ){
Var f = document. createElement ("iframe ");
F. style. border = "0 ";
F. style. width = "0 ";
F. style. height = "0 ";
Document. body. appendChild (f );

Var d = f.content1_doc ument;
D. write ("<script type =" text/javascript "> window. parent. escape = escape; </script> ");
D. close ();
}

Based on sections 1 and 2, the test code is as follows:

<! --Antihook.htm -->
<Script type = "text/javascript">
<! --
Escape = function (s ){
Return s;
}
// -->
</Script>
<Html>
<Body>
<Input type = "button" onclick = "javascript: test ();" value = "test"/>
<Script type = "text/javascript">
<! --
Function test (){
Alert (escape ("s y "));

If (checkHook (escape )){
& Nb