the-web-application-hackers-handbook

Chapter 3 n Web Application Technologies 65
n It modifies the core Ajax technology, XMLHttpRequest, to enable two-way
cross-domain interaction in certain situations. This can lead to new crossdomain
attacks, as described in Chapter 13.
n It introduces new mechanisms for client-side data storage, which can lead
to user privacy issues, and new categories of attack such as client-side SQL
injection, as described in Chapter 13.
“Web 2.0”
This buzzword has become fashionable in recent years as a rather loose and
nebulous name for a range of related trends in web applications, including the
following:
n Heavy use of Ajax for performing asynchronous, behind-the-scenes requests
n Increased cross-domain integration using various techniques
n Use of new technologies on the client side, including XML, JSON, and Flex
n More prominent functionality supporting user-generated content, information
sharing, and interaction
As with all changes in technology, these trends present new opportunities
for security vulnerabilities to arise. However, they do not define a clear subset
of web application security issues in general. The vulnerabilities that occur in
these contexts are largely the same as, or closely derived from, types of vulnerabilities
that preceded these trends. In general, talking about “Web 2.0 Security”
usually represents a category mistake that does not facilitate clear thinking
about the issues that matter.
Browser Extension Technologies
Going beyond the capabilities of JavaScript, some web applications employ
browser extension technologies that use custom code to extend the browser’s
built-in capabilities in arbitrary ways. These components may be deployed as
bytecode that is executed by a suitable browser plug-in or may involve installing
native executables onto the client computer itself. The thick-client technologies
you are likely to encounter when attacking web applications are
n Java applets
n ActiveX controls
n Flash objects
n Silverlight objects
These technologies are described in detail in Chapter 5.