The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

446

Chapter 12 

■

Attacking Other Users

70779c12.qxd:WileyRed  9/14/07  3:14 PM  Page 446

---

tab, the browser uses 

XMLHttpRequest

to retrieve the user’s personal contacts,

which are returned using JSON:

[

[ ‘Jeff’, ‘1741024918’, ‘[e-mail]’ ],

[ ‘C Gillingham’, ‘3885193114’, ‘[e-mail]’ ],

[ ‘Mike Kemp’, ‘8041148671’, ‘[e-mail]’ ],

[ ‘Wade A’, ‘5078782513’, ‘[e-mail]’ ]

]

The returned message contains valid JavaScript syntax that defines an array.

The client-side script uses the JavaScript interpreter to construct the array and

then processes its contents.