the-web-application-hackers-handbook

Chapter 12 n Attacking Users: Cross-Site Scripting 447
arbitrary code execution on the computer of a victim user. For example,
if a site is running in the Trusted Sites zone of Internet Explorer, injecting
the following code causes the Windows calculator program to launch on
the user’s computer:
var o = new ActiveXObject(‘WScript.shell’);
o.Run(‘calc.exe’);
n Web applications often deploy ActiveX controls containing powerful
methods (see Chapter 13). Some applications seek to prevent misuse by
a third party by verifying within the control itself that the invoking web
page was issued from the correct website. In this situation, the control can
still be misused via an XSS attack, because in that instance the invoking
code satisfies the trust check implemented within the control.
COMMON MYTH
“Phishing and XSS only affect applications on the public Internet.”
XSS bugs can affect any type of web application, and an attack against
an intranet-based application, delivered via a group e-mail, can exploit two
forms of trust. First, there is the social trust exploited by an internal e-mail
sent between colleagues. Second, victims’ browsers often trust corporate
web servers more than they do those on the public Internet. For example,
with Internet Explorer, if a computer is part of a corporate domain, the
browser defaults to a lower level of security when accessing intranet-based
applications.
Escalating the Client-Side Attack
A website may directly attack users who visit it in numerous ways, such as logging
their keystrokes, capturing their browsing history, and port-scanning the
local network. Any of these attacks may be delivered via a cross-site scripting
flaw in a vulnerable application, although they may also be delivered directly
by any malicious website that a user happens to visit. Attacks of this kind are
described in more detail at the end of Chapter 13.
Delivery Mechanisms for XSS Attacks
Having identified an XSS vulnerability and formulated a suitable payload to
exploit it, an attacker needs to find some means of delivering the attack to other