the-web-application-hackers-handbook

Chapter 13 n Attacking Users: Other Techniques 559
input. Safer alternatives are usually available with minimal extra effort.
For example, if it is considered necessary to launch external processes,
compile a list of all the external processes that may legitimately and safely
be launched. Then either create a separate method to call each one or use
a single method that takes an index number into this list.
As an additional defense-in-depth precaution, some ActiveX controls
validate the domain name that issued the HTML page from which they
are being invoked. Microsoft’s SiteLock Active Template Library template
allows developers to restrict the use of an ActiveX control to a specific list
of domain names.
Some controls go even further by requiring that all parameters passed to the
control must be cryptographically signed. If the signature passed is invalid, the
control does not carry out the requested action. You should be aware that some
defenses of this kind can be circumvented if the website that is permitted to
invoke the control contains any XSS vulnerabilities.
Attacking the Browser
The attacks described so far in this and the preceding chapter involve exploiting
some feature of an application’s behavior to compromise users of the application.
Attacks such as cross-site scripting, cross-site request forgery, and JavaScript
hijacking all arise from vulnerabilities within specific web applications, even
though the details of some exploit techniques may leverage quirks within specific
browsers.
A further category of attacks against users does not depend on the behavior
of specific applications. Rather, these attacks rely solely on features of
the browser’s behavior, or on the design of core web technologies themselves.
These attacks can be delivered by any malicious website or by any
benign site that has itself been compromised. As such, they lie at the edge
of the scope of a book about hacking web applications. Nevertheless, they
are worthy of brief consideration partly because they share some features
with attacks that exploit application-specific functions. They also provide
context for understanding the impact of various application behaviors by
showing what is possible for an attacker to achieve even in the absence of
any application-specific flaws.
The discussion in the following sections is necessarily concise. There is certainly
room for an entire book to be written on this subject. Would-be authors
with a significant amount of spare time are encouraged to submit a proposal
to Wiley for The Browser Hacker’s Handbook.