the-web-application-hackers-handbook

Chapter 12 n Attacking Users: Cross-Site Scripting 477
Sending XML Requests Cross-Domain
It is possible to send near-arbitrary data cross-domain within the HTTP request
body by using an HTML form with the enctype attribute set to text/plain. This
tells the browser to handle the form parameters in the following way:
n Send each parameter on a separate line within the request.
n Use an equals sign to separate the name and value of each parameter (as
normal).
n Do not perform any URL encoding of parameter names or values.
Although some browsers do not honor this specification, it is properly honored
by current versions of Internet Explorer, Firefox, and Opera.
The behavior described means that you can send arbitrary data in the message
body, provided that there is at least one equals sign anywhere within the data. To
do this, you split the data into two chunks, before and after the equals sign. You
place the first chunk into a parameter name and the second chunk into a parameter
value. When the browser constructs the request, it sends the two chunks separated
by an equals sign, thereby exactly constructing the required data.
Since XML always contains at least one equals sign, in the version attribute of
the opening XML tag, we can use this technique to send arbitrary XML data crossdomain
in the message body. For example, if the required XML were as follows:
foo
we could send this using the following form:
document.forms[0].submit();
To include common attack characters within the value of the param parameter,
such as tag angle brackets, these would need to be HTML-encoded within the
XML request. Therefore, they would need to be double HTML-encoded within
the HTML form that generates that request.
TIP You can use this technique to submit cross-domain requests containing
virtually any type of content, such as JSON-encoded data and serialized binary
objects, provided you can incorporate the equals character somewhere within
the request. This is normally possible by modifying a free-form text field within
the request that can contain an equals character. For example in the following
JSON data, the comment field is used to introduce the required equals character:
{ “name”: “John”, “email”: “gomad@diet.com”, “comment”: “=” }