3 ms·
I tried to figure out how to do this a while ago. Doesn't anti cross site scripting built into most modern browsers stop this? The flash and java security model
by shubb 13y ago
I tried to figure out how to do this a while ago. Doesn't anti cross site scripting built into most modern browsers stop this? The flash and java security models certainly do.
I think you can do this by serving the user a hidden form that e.g. sends a firmware to the device, and a real form that they are likely to submit. The hidden form is the one that actually gets submitted. But I thought anything via XHR wouldn't work. Which is needed for a brute force attack say.
What did you find?
- shooper 13y agoWhat about embbedding iframes?
- shubb 13y agoThat would look to be correct, see here for example: http://hackers2devnull.blogspot.co.uk/2013/07/exploiting-post-method-xss-silently.html http://hackers2devnull.blogspot.co.uk/2013/07/exploiting-pos... In which case, I woner why more sites (or evil ads via an ad network) don't attack our home routers?
- chc 13y agoProbably because it isn't really necessary — it's easier just to own the user's PC the old-fashioned way.