The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Chapter 12 

■

Attacking Other Users

455

70779c12.qxd:WileyRed  9/14/07  3:14 PM  Page 455

---

When an ActiveX control has been instantiated by the browser, individual

methods can be invoked as follows:

HACK STEPS

A simple way to probe for ActiveX vulnerabilities is to modify the HTML that

invokes the control, pass your own parameters to it, and monitor the results:

■

Vulnerabilities such as buffer overflows can be probed for using the

same kind of attack payloads as are described in Chapter 15. Triggering

bugs of this kind in an uncontrolled manner is mostly likely to result in a

crash of the browser process that is hosting the control.

■