Web Attacks: An Online shoe business has their website set up so that logged-in
ID: 3582076 • Letter: W
Question
Web Attacks:
An Online shoe business has their website set up so that logged-in users have an HTTP cookie. One such user, Alice, buys a pair of shoes and notices that after confirming that she wants to buy the shoes the site takes her to a page with the URL http://www.shoeplace.com/buy.php?shoeID=123456
In other words, the shoe website is using a GET request to place the final order. Suppose while logged into the shoe site, Alice visits evil.com in another browser tab.
Give malicious HTML, , with a brief explaination, that an adversary in control of this evil site can send to Alice's browser to cause problems for her on the shoe site.
Explanation / Answer
When Alice, buys a pair of shoes and notices that after confirming that she wants to buy the shoes the site takes her to a page with the URL http://www.shoeplace.com/buy.php?shoeID=123456 i.e. the shoe website is using a GET request to place the final order. But when in between Alice visits evil.com in another browser tab then the website evil.com can send arbitrary HTML code. It is a type of injection issue that occurs when a user is able to control an input point.
A particular type of attacks commonly referred to as “code insertion or injection” and often “Cross-Site Scripting” has become very popular. Unfortunately, the number of applications vulnerable to these attacks is increasing rapidly, and the varieties of ways attackers are finding to be successful in exploiting them is on the increase. Analysis of a lot of sites has indicated that not only are the majority of sites vulnerable, but they are vulnerable to many different types of methods and much of their content is vigrously affected.An embedded code attack is heavily dependant on the delivery function. Thus the delivery method often interprets the audience the script will drop heavily.
Related Questions
drjack9650@gmail.com
Navigate
Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.