the-web-application-hackers-handbook

516 Chapter 13 n Attacking Users: Other Techniques
one domain may cause requests to a different domain, it may not easily read
the responses from those requests to steal the user’s data from a different
domain.
In fact, various techniques can be used in some situations to capture all or
part of a response from a different domain. These attacks typically exploit some
aspect of the target application’s functionality together with some feature of
popular browsers to allow cross-domain data capture in a way that the sameorigin
policy is intended to prevent.
Capturing Data by Injecting HTML
Many applications contain functionality that allows an attacker to inject some
limited HTML into a response that is received by a different user in a way that
falls short of a full XSS vulnerability. For example, a web mail application may
display e-mails containing some HTML markup but block any tags and attributes
that can be used to execute script code. Or a dynamically generated error message
may filter a range of expressions but still allow some limited use of HTML.
In these situations, it may be possible to leverage the HTML-injection condition
to cause sensitive data within the page to be sent to the attacker’s domain.
For example, in a web mail application, the attacker may be able to capture the
contents of a private e-mail message. Alternatively, the attacker may be able to
read an anti-CSRF token being used within the page, allowing him to deliver
a CSRF attack to forward the user’s e-mail messages to an arbitrary address.
Suppose the web mail application allows injection of limited HTML into the
following response:
[ limited HTML injection here ]
...
...
var _StatsTrackerId=’AAE78F27CB3210D’;
...
Following the injection point, the page contains an HTML form that includes
a CSRF token. In this situation, an attacker could inject the following text into
the response: