the-web-application-hackers-handbook

Chapter 13 n Attacking Users: Other Techniques 513
generated by the application, and it submits this back to the application when
the victim unwittingly clicks the confirm button. As far as the target application
is concerned, everything is normal.
To deliver the key trick of having the victim user see one interface but interact
with a different one, the attacker can employ various CSS techniques. The iframe
that loads the target interface can be made an arbitrary size, in an arbitrary location
within the attacker’s page, and showing an arbitrary location within the
target page. Using suitable style attributes, it can be made completely transparent
so that the user cannot see it.
TRY IT!
http://mdsec.net/auth/405/
Developing the basic attack further, the attacker can use complex script code
within his interface to induce more elaborate actions than simply clicking a button.
Suppose an attack requires the user to enter some text into an input field
(for example, in the amount field of a funds transfer page). The attacker’s user
interface can contain some content that induces the user to type (for example,
a form to enter a phone number to win a prize). A script on the attacker’s page
can selectively handle keystrokes so that when a desired character is typed,
the keystroke event is effectively passed to the target interface to populate the
required input field. If the user types a character that the attacker does not want
to enter into the target interface, the keystroke is not passed to that interface,
and the attacker’s script waits for the next keystroke.
In a further variation, the attacker’s page can contain content that induces
the user to perform mouse-dragging actions, such as a simple game. Script
running on the attacker’s page can selectively handle the resulting events in
a way that causes the user to unwittingly select text within the target application’s
interface and drag it into an input field in the attacker’s interface, or vice
versa. For example, when targeting a web mail application, the attacker could
induce the user to drag text from an e-mail message into an input field that
the attacker can read. Alternatively, the user could be made to create a rule to
forward all e-mail to the attacker and drag the required e-mail address from
the attacker’s interface into the relevant input field in the form that defines the
rule. Furthermore, since links and images are dragged as URLs, the attacker
may be able to induce dragging actions to capture sensitive URLs, including
anti-CSRF tokens, from the target application’s interface.
A useful explanation of these and other attack vectors, and the methods by
which they may be delivered, can be found here:
http://ui-redressing.mniemietz.de/uiRedressing.pdf