4 ms·
how are iframes being injected into a page in a way which wouldn't allow other, simpler, methods of harvesting credentials. e.g. if I have access to inject an
by AdamJacobMuller 4y ago
how are iframes being injected into a page in a way which wouldn't allow other, simpler, methods of harvesting credentials.
e.g. if I have access to inject an iframe, can't I just inject some javascript which will post the credentials to another server?
If I have access to inject an iframe, can't I just modify the server code to just post the credentials to me?
- mananaysiempre 4y agoFor example, the iframe is inserted by an ad network the site owners trust, and the ad network in turn assumes fencing off a third-party ad selection or bot detection or whatever script into an iframe is sufficient isolation and doesn’t look at it all that hard (or maybe is not even permitted to for legal reasons). Having an ad on the login page is not universal, but neither is it uncommon, and some websites just have a login form on every page.