3 ms·
What would the attack vector be for something like this?
by hodwik 11y ago
What would the attack vector be for something like this?
- konceptz 11y agoSame as most html injection attacks. I haven't tested as I'm on the way to work, but I will try to craft the attack as follows: 1: discover html attribute vulnerable to this. 2: craft payload as a link, for Dom, reflected or stored. 3: watch them type characters as rules are triggered. (Is this possible to use as a key logger?!) So that's general, then more specifically As an attacker I would probably trigger a password lock of the target where the user has to enter security questions. Then gather that information. Another reason to hate security questions. Remediation: Output encode in the proper context! This most certainly qualifies as the exact reason why your fancy blacklist (or whitelist) filter set is not the proper mitigation for xss. In the above scenario, The attacker is injecting rules as inline css in the context of an html attribute, so then output encode in that context. Also I need to check if it can bypass the CSP in any way, though I doubt it. Sorry for the organization or this post, as I mentioned im on the train.