the-web-application-hackers-handbook

Chapter 13 n Attacking Users: Other Techniques 565
NOTE Despite the restrictions imposed by the same-origin policy, various
techniques can be used in this situation to allow two-way asynchronous interaction
with the attacker’s server from a script that has been injected into a target
application. One simple method is to perform dynamic cross-domain script
includes to the attacker’s domain. These requests can both transmit captured
data back to the attacker (within the URL query string) and receive instructions
about actions that should be performed (within the returned script code).
Here are some actions that may be carried out within this type of framework:
n Logging keystrokes and sending these to the attacker
n Hijacking the user’s session with the vulnerable application
n Fingerprinting the victim’s browser and exploiting known browser vulnerabilities
accordingly
n Performing port scans of other hosts (which may be on a private network
accessible by the compromised user browser) and sending the results to
the attacker
n Attacking other web applications accessible via the compromised user’s
browser by forcing the browser to send malicious requests
n Brute-forcing the user’s browsing history and sending this to the attacker
One example of a sophisticated browser exploitation framework is BeEF,
developed by Wade Alcon, which implements the functionality just described.
Figure 13-8 shows BeEF capturing information from a compromised user,
including computer details, the URL and page content currently displayed, and
keystrokes entered by the user.
Figure 13-8: Data captured from a compromised user by BeEF