the-web-application-hackers-handbook

Chapter 13 n Attacking Users: Other Techniques 521
JSON
In a variation on the preceding example, the application does not perform a
function callback in the dynamically invoked script, but instead just returns
the JSON array containing the user’s details:
[
]
[ ‘Name’, ‘Matthew Adamson’ ],
[ ‘Username’, ‘adammatt’ ],
[ ‘Password’, ‘4nl1ub3’ ],
[ ‘Uid’, ‘88’ ],
[ ‘Role’, ‘User’ ]
As described in Chapter 3, JSON is a flexible notation for representing arrays
of data and can be consumed directly by a JavaScript interpreter.
In older versions of Firefox, it was possible to perform a cross-domain script
include attack to capture this data by overriding the default Array constructor
in JavaScript. For example:
function capture(s) {
alert(s);
}
function Array() {
for (var i = 0; i < 5; i++)
this[i] setter = capture;
}
This attack modifies the default Array object and defines a custom setter
function, which is invoked when values are assigned to elements in an array. It
then executes the response containing the JSON data. The JavaScript interpreter
consumes the JSON data, constructs an Array to hold its values, and invokes
the attacker’s custom setter function for each value in the array.
Since this type of attack was discovered in 2006, the Firefox browser has been
modified so that custom setters are not invoked during array initialization. This
attack is not possible in current browsers.
TRY IT!
http://mdsec.net/auth/409/
You need to download version 2.0 of Firefox to exploit this example. You
can download this from the following URL:
www.oldapps.com/firefox.php?old_firefox=26