the-web-application-hackers-handbook

566 Chapter 13 n Attacking Users: Other Techniques
Figure 13-9 shows BeEF performing a port scan of the victim user’s own
computer.
Figure 13-9: BeEF performing a port scan of a compromised user’s computer
Another highly functional browser exploitation framework is XSS Shell, produced
by Ferruh Mavituna. It provides a wide range of functions for manipulating
zombie hosts compromised via XSS, including capturing keystrokes, clipboard
contents, mouse movements, screenshots, and URL history, as well as the injection
of arbitrary JavaScript commands. It also remains resident within the user’s
browser if she navigates to other pages within the application.
Man-in-the-Middle Attacks
Earlier chapters described how a suitably positioned attacker can intercept
sensitive data, such as passwords and session tokens, if an application uses
unencrypted HTTP communications. What is more surprising is that some
serious attacks can still be performed even if an application uses HTTPS for
all sensitive data and the target user always verifies that HTTPS is being used
properly.
These attacks involve an “active” man in the middle. Instead of just passively
monitoring another user’s traffic, this type of attacker also changes some of that
traffic on the fly. Such an attack is more sophisticated, but it can certainly be
delivered in numerous common situations, including public wireless hotspots
and shared office networks, and by suitably minded governments.
Many applications use HTTP for nonsensitive content, such as product descriptions
and help pages. If such content makes any script includes using absolute
URLs, an active man-in-the-middle attack can be used to compromise HTTPSprotected
requests on the same domain. For example, an application’s help page
may contain the following: