Reflected DOM Injection

Reflected DOM Injection (RDI) is an evasive XSS technique which uses a third party website to construct and execute an attack. This technique can be implemented on websites that use a user-provided URL as part of their service (e.g. translation services, caching services, etc.)

反射型DOM注入式一种逃避式的XSS技术，该技术利用第三方网站构造并进行攻击。该技术可以攻击使用用户提供的URL作为服务（如翻译服务、缓存服务等）的一部分的网站。

In order to implement this technique:

1. Take a piece of code that you would like to hide using RDI (“Code X”)   准备欲使用RDI隐藏的代码（"code  X"）
   
2. Find a service that receives user input as described above (“Service Y”)  寻找一个接受用户输入的服务 （“Service Y”）
   
3. Choose a feature that is unique to this service (e.g. a DOM element added by this service) and use it to create a pseudo-unique “key”. 选择一个该服务唯一的特点（如该服务添加的一个DOM元素等），并使用该特点创建伪唯一key。
   
4. Encrypt Code X using the key and host it on your website, add code that will attempt to re-create the key and decrypt the content in runtime.使用唯一的key对code x进行加密并部署至网站上，添加在运行时刻尝试重建该key和解密内容的代码。
   
5. Browse to your website using Service Y. The decryption code will execute and re-generate the key, decrypt your hidden code, and execute it.使用服务Y浏览网站。解密代码会执行并重新生成key，解密隐藏的代码并执行。

By using this technique the exploit is triggered only if the user followed the expected flow and accessed our website using the third party service. The same code, however, would not execute by browsing directly to the attacker’s website.

Usage of RDI technique Figure 1

Figure 1 describes a direct access to a website that uses the RDI technique to exploit the user’s browser. By accessing the website directly, the exploit remained encrypted and the content sent to the client machine remains benign.

Usage of RDI technique Figure 2

Figure 2 describes the attack scenario - where the user accesses the website which uses the RDI technique using the third party Service Y. The service creates a new connection to the attacker’s website, receives the content, manipulates it in order to provide the service, and delivers the new modified content to the user. This manipulation done by Service Y turns the attacker’s page into a malicious one by helping generate the key required to decrypt the malicious code. The RDI technique actually uses the third party service to create the malicious content.

The RDI technique provides the following benefits:

1. The URL to the exploit is hosted on known and legit service.
2. The content hosted on the attacker’s website is essentially legit when accessed directly.
3. The malicious content can only be revealed by following the full flow of the attack.

The RDI technique was first presented at DEFCON 21^[1] by Daniel Chechik and Anat Davidi. A full scenario of the technique is described in a paper^[2] published following the conference on the Trustwave SpiderLabs blog.

---

1. Jump up^ "DEFCON 21 Conference".
2. Jump up^ Chechik, Daniel. "Introducing RDI – Reflected DOM Injection". Trustwave SpiderLabs.