3 ms·
What kind of code can be executed through the Javascript interface? They seem to claim it's not specific to Paypal's implementation and these seem fairly common
by tokenizerrr 13y ago
What kind of code can be executed through the Javascript interface? They seem to claim it's not specific to Paypal's implementation and these seem fairly common. I was under the impression they only expose various methods and variables. How can they be exploited?
- gberger 13y agoAn attacker can show the user a page identical to PayPal's and convincingly ask them for their credentials. The submission would send the credentials to the attacker.
- tokenizerrr 13y agoYeah, but that seems to be different from code execution. https://news.ycombinator.com/item?id=7493849 https://news.ycombinator.com/item?id=7493849 seems to be closer to the truth.
- gberger 13y agoAn attacker can show the user a page identical to PayPal's and convincingly ask them for their credentials. The submission would send the credentials to the attacker.
- gberger 13y agoAn attacker can show the user a page identical to PayPal's and convincingly ask them for their credentials. The submission would send the credentials to the attacker.