The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

398

Chapter 12 

■

Attacking Other Users

70779c12.qxd:WileyRed  9/14/07  3:14 PM  Page 398

---

Exploit Browser Vulnerabilities

If bugs exist within the user’s browser or any installed plug-ins, an attacker

may be able to exploit these via malicious JavaScript or HTML. In some cases,

bugs within plug-ins such as the Java VM have enabled attackers to perform

two-way binary communication with non-HTTP services on the local com-

puter or elsewhere, enabling the attacker to exploit vulnerabilities that exist

within other services identified via port scanning. Many software products

(including non–browser-based products) install ActiveX controls that may

contain vulnerabilities.