3

What is the name of the attack if:

  • there is a forum on the goodwebsite.comm
  • there is an attacker website badwebsite.comm

The form on the goodwebsite.comm allows us to insert iframes, and using window.top.location we can redirect the parent page to any page, ex.: badwebsite.comm to show the users a login form that looks similar that is on goodwebsite.comm. After the users gaved their user/pw, they will be redirected to the original page/forum of goodwebsite.comm. Next time they refresh the page, they will be NO login screen, because we stored a cookie, thus only showing fake login page from badwebsite.comm when it's the first visit.

Question: what is this attack called?

3

It's called XSS (Cross-Site Scripting).

Quoted from here:

Cross-site Scripting (XSS) refers to client-side code injection attack wherein an attacker can execute malicious scripts (also commonly referred to as a malicious payload) into a legitimate website or web application. XSS is amongst the most rampant of web application vulnerabilities and occurs when a web application makes use of unvalidated or unencoded user input within the output it generates.

By leveraging XSS, an attacker does not target a victim directly. Instead, an attacker would exploit a vulnerability within a website or web application that the victim would visit, essentially using the vulnerable website as a vehicle to deliver a malicious script to the victim’s browser.

While XSS can be taken advantage of within VBScript, ActiveX and Flash (although now considered legacy or even obsolete), unquestionably, the most widely abused is JavaScript – primarily because JavaScript is fundamental to most browsing experiences.

1

It is XSS/phishing - goodwebsite.comm has given someone the option to insert a script that will redirect to badwebsite.comm, so it is a little like XSS, but the user will be able to see the URL on the browser and thus he will be able to see it is not goodwebsite.comm.

If you think the user should notice the URL it is phishing, otherwise it is XSS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.