Hey Folks, Let's Have a little look over Cross Site Tracing though many of you know as it is simple and easiest way but still for some of you who don't know what it is. M gonna Demonstrate.

Introduction

XST (Cross Site Tracing) is combined Attack that includes HTTP TRACE METHOD and XSS Techniques. XST Allows an Attacker to see what data is being recieved at the other end of the request chain. its an old attack type that was discovered in the late of 2003. well i think its enough for now, Let's move to practical as always UrduSecurity do.

Cross Site Tracing

Well Guys First of all I need a Web server to whom I've to send the request so for this im gonna use my Localhost on port 81. and Let's Try to access it via curl.

curl -X TRACE 192.168.1.3:81

ok now let's see what is in response.

 

Umph As we can see TRACE in response so this method is allowed. Now Let's try to Add a new header if we can do it by using curl's -H option.

oh ?? injected :P , so this application is prone to xss attacks via Trace method that is inshort called Cross Site Tracing. If we don't see TRACE in response and see a source page then trace method is disabled.

Hope it's Clear.

Cross Site Tracing | WebAppSec

Uploaded by: Adeel Chaudhary

Views:

Category: WebAppSec

Share

Tweet