The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 12 

■

Attacking Other Users

439

70779c12.qxd:WileyRed  9/14/07  3:14 PM  Page 439

---

3. A user browses the attacker’s innocuous-looking web site. If the user is

simultaneously using 

wahh-app.com

, or does so while the attacker’s site

is being displayed in another browser window, then the attacker’s Tro-

jan content will overwrite the frame 

main_display

in the 

wahh-app.com

window. If the user continues using what appears to be the 

wahh-app

.com

application, then any data he enters will be submitted to the

attacker.

This type of attack bears similarities to phishing attacks in which the

attacker constructs a cloned web site and seeks to entice unwitting users to

access it. However, in the case of frame injection, the attack is more sophisti-

cated and much more convincing, because the cloned content actually replaces

the authentic content within a browser window whose URL still points to the

genuine application.

If the application being targeted uses HTTPS, then the attack will still suc-

ceed, and the security padlock displayed by the browser window will con-

tinue to show the correct certificate for 

wahh-app.com

. This is because when a

browser displays a frameset, the security information for the main window

relates to the page containing the frameset, which in this case still originates

from 

wahh-app.com

. Hence, even a well-informed user may not notice an

attack of this kind.