the-web-application-hackers-handbook

444 Chapter 12 n Attacking Users: Cross-Site Scripting
This kind of attack is known as virtual defacement because the actual content
hosted on the target’s web server is not modified. The defacement is generated
solely because of how the application processes and renders user-supplied input.
In addition to frivolous mischief, this kind of attack could be used for serious
criminal purposes. A professionally crafted defacement, delivered to the
right recipients in a convincing manner, could be picked up by the news media
and have real-world effects on people’s behavior, stock prices, and so on, to the
attacker’s financial benefit, as illustrated in Figure 12-6.
Figure 12-6: A virtual defacement attack exploiting an XSS flaw
Injecting Trojan Functionality
This attack goes beyond virtual defacement and injects actual working functionality
into the vulnerable application. The intent is to deceive end users into
performing some undesirable action, such as entering sensitive data that is then
transmitted to the attacker.
As was described in the attack against Apache, an obvious attack involving
injected functionality is to present users with a Trojan login form that submits
their credentials to a server controlled by the attacker. If skillfully executed,
the attack may also seamlessly log in the user to the real application so that she
does not detect any anomaly in her experience. The attacker is then free to use
the victim’s credentials for his own purposes. This type of payload lends itself
well to a phishing-style attack, in which users are fed a crafted URL within the
actual authentic application and are advised that they need to log in as normal
to access it.
Another obvious attack is to ask users to enter their credit card details, usually
with the inducement of some attractive offer. For example, Figure 12-7 shows a
proof-of-concept attack created by Jim Ley, exploiting a reflected XSS vulnerability
found in Google in 2004.