I had pondered very long only then this's inside intriguing relations entire clear, I thought that many people looked I following paper will fall asleep, or simply “item of hundred lines” jumping over, but if you really wants to understand, will request transfer tries my each poc, will be helpful to the understanding (, although you possibly will faint). Please respect me the work achievement, code these many characters is not easy. Welcome the technology to discuss, but declines had not looked that carefully gesticulates. @_@
First, to help everybody better understanding, I speak this kind of attack to be able first to achieve any effect:
1. The cross territory carries out the script (IE, Firefox)
2. Turns durable XSS non-persistent XSS
3. The cross page carries out the script
4. The browser will be very difficult the threat which patches this “the characteristic” to create
5. Certainly has some condition limit, this only described this kind of attack theoretically.
Then, anything is cross iframe, simply speaking does iframe an iteration, realizes between some iframe overlapping data accessing. In the normal web application, many places usefully to this kind of technology, for instance facebook, for instance yahoo.
But expands some safe hidden dangers by cross iframe, is the key point which my here must discuss.
The following is my testing environment:
Windows XP SP2
IE 6 SP2 (I only then IE6, does not have IE7, please voluntarily test IE7)
Firefox 2.0.0.16
Test domain name:
www.A.com (/1.html, /4.html)
www.B.com (/2.html, /3.html)
This test has mainly used 4 html pages, please keep firmly in mind 1.html and 4.html is under territory A; 2.html and 3.html are under territory B
First has a look at anything is Cross Iframe, they can do anything.
Rule1: Under identical page's two iframe, if these two iframe aims at the identical territory, then they may visit mutually, and operates opposite party page's script.
On www.A.com, has a 1.html, has contained two iframe, these two iframe has quoted on www.B.com's two pages separately. Its code is as follows:
1.html:
Now our goal is transfers in iframe:tt2_3 javascript using iframe:tt2_2 the function.
3.html's code is as follows:
function alertpoc() {
alert (“alert POC”);
}
2.html's code is as follows:
2.html:
window.onload = function() {
parent.frames [“tt2_3] .alertpoc();
}
When then, visits http://www.A.com/1.html, in the iframe:tt2_2 script in www.B.com has carried out, it through reads the father window iframe:tt2_3, the attempt carries out script function alertpoc(). Because tt2_2 and tt2_3 with in www.B.com territory, therefore between them does not have the cross territory problem, the script is permitted the execution.
Rule2: Territory B can by the iframe proxy way, on the operation territory A script, or the transmit message, realizes the cross territory operation.
Other pages: : 1 * 2 * Next>>
|
You are here: hacking technology
> hacker invade
> Content
Category: Home
> hacker invade
