Reflected File Download - Revision history

Doktoresperanto: Any page that reflects users input can be vulnerable to RFD. Certainly under true conditions, for example Content-Disposition withou filename attribute.

2018-08-15T15:41:22Z

Any page that reflects users input can be vulnerable to RFD. Certainly under true conditions, for example Content-Disposition withou filename attribute.

Pawel Krawczyk: disable URLs

2017-04-26T09:38:41Z

disable URLs

Pawel Krawczyk: add basic information on RFD and references

2017-04-26T09:37:45Z

add basic information on RFD and references

Sahilchadha at 23:46, 2 March 2016

2016-03-02T23:46:44Z

Sahilchadha: Created page with "zzz"

2016-03-02T23:44:34Z

Created page with "zzz"

New page

zzz

@@ Line 1: / Line 1: @@
-{{template: Attack}}<br>
+{{template: Attack}}
 [[Category:OWASP ASDR Project]]
-'''Reflected File Download''' is an attack combining [http://stackoverflow.com/questions/2163803/what-is-the-semicolon-reserved-for-in-urls URL path segments] (now deprecated) with web services vulnerable to [https://securitycafe.ro/2017/01/18/practical-jsonp-injection/ JSONP Injection] to deliver malware to end users.
+'''Reflected File Download''' is an attack combining [http://stackoverflow.com/questions/2163803/what-is-the-semicolon-reserved-for-in-urls URL path segments] (now deprecated) with pages that reflects user inputs in the response. Generally web services vulnerable to [https://securitycafe.ro/2017/01/18/practical-jsonp-injection/ JSONP Injection] are used to deliver malware to end users.
 Let's assume we have a vulnerable API that reflects whatever we send to it (the URL was real apparently, now fixed):
@@ Line 25: / Line 26: @@
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
 [[Category:Security Focus Area]]
 __NOTOC__
 ==Overview==

@@ Line 6: / Line 6: @@
 Let's assume we have a vulnerable API that reflects whatever we send to it (the URL was real apparently, now fixed):
-     https://google.com/s?q=rfd%22||calc||
+     hxxps://google.com/s?q=rfd%22||calc||
      {"results":["q", "rfd\"||calc||","I love rfd"]}
 Now, this is normally harmless in a browser as it's JSON so it's not going to be rendered but the browser will rather offer to download the response as a file. Now here's the path segments come to help the attacker:
-     https://google.com/s;/setup.bat;?q=rfd%22||calc||
+     hxxps://google.com/s;/setup.bat;?q=rfd%22||calc||
 Everything between semicolons (`;/setup.bat;`) will be not sent to the web service, but instead the browser will interpret it as the file name... to save the API response. Now, a file called setup.bat will be downloaded and run without asking about dangers of running files downloaded from Internet (because it contains the word "setup" in its name). The contents will be interpreted as Windows batch file, and the `calc.exe` command will be run.

@@ Line 1: / Line 1: @@
 {{template: Attack}}<br>
 [[Category:OWASP ASDR Project]]
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''

← Older revision		Revision as of 23:46, 2 March 2016
Line 1:		Line 1:
−	~~zzz~~	+	{{template: Attack}}<br>
		+	[[Category:OWASP ASDR Project]]
		+
		+	Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
		+
		+
		+	[[Category:Security Focus Area]]
		+	__NOTOC__
		+	==Overview==