The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

438

Chapter 12 

■

Attacking Other Users

70779c12.qxd:WileyRed  9/14/07  3:14 PM  Page 438

---

N OT E

The latest versions of most browsers have modified their behavior in

relation to named frames and, by default, extend the same origin policy to

prevent one web site from writing the content of a frame that was issued by a

different domain. As users gradually migrate to the latest browsers, this

category of vulnerability will cease to be relevant.

HACK STEPS

■

If the application uses frames, review the HTML source of the main

browser window, which should contain the code for the frameset.

■

If the frameset assigns a name to each frame, it is probably vulnerable,