The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Implementing a Callback Function

In some applications, the JavaScript returned by the vulnerable application

does not contain only a JSON object, but also invokes a callback function on

that object. For example:

showContacts(

[

[ ‘Jeff’, ‘1741024918’, ‘[e-mail]’ ],

[ ‘C Gillingham’, ‘3885193114’, ‘[e-mail]’ ],

[ ‘Mike Kemp’, ‘8041148671’, ‘[e-mail]’ ],

[ ‘Wade A’, ‘5078782513’, ‘[e-mail]’ ]

]);

This technique is often used in mash-ups in which one application includes

a JSON object from another domain, and specifies a call-back function in its

request for the script. The returned script invokes the specified call-back func-

tion on the JSON object, enabling the invoking application to process the data

in arbitrary ways.