Saturday, May 30, 2009

Modifying content in HTTPS

I know I haven't updated in a while, but I'm here again to share my information with whoever wants it. This time, it's not something personal that I've discovered or an experience of my own.
Instead, I've recently read a paper published by Microsoft that really got me thinking about other possibilities that I'm going to be testing out and having fun with in the near future. The paper, written with malicious proxies in mind, points out browser flaws in handling certain events with HTTPS and intriguing research on modifying HTTPS content.

Personally, there was this one very inspiring technique that is rather easy to perform and something I'd consider dangerous. This was when a site such as calls for off-site file(s) or file(s) from their sub-domain, an example being a javascript file from Now what happens is the person sends a request for, which also sends a request for, and the attacker sends back a 302 redirect to a different https script instead of An easier to follow example:

A.) Victim sends request for
B.) calls script from
C.) Attacker does not return requested content, instead it returns a 302 redirect for which points to
D.) Now the attacker's script is loaded in the context of which means the attacker has access over the client-side content of the site and can use DOM manipulation to modify that client-side content.

The paper has other great new ideas that makes it completely worth the read. It also has other old ideas such as stealing cookies, of an https site, that do not have the secure bit set by modifying a page to put a hidden iframe that points to that same site, but over a regular http session. It is truly an inspiring paper that is on the path of deeper problems within how our browsers handle HTTPS sessions.

Paper located at:

Presentation slides at: