From: pdp (architect) (pdp.gnucitizen@googlemail.com)
Date: Fri Oct 06 2006 - 05:43:23 EDT
http://www.gnucitizen.org/projects/javascript-spider/
During the last couple of days I have been testing several attack
vectors to circumvent the browser security sandbox also known as the
same origin policy. There is a lot involved into this subject and I
will present my notes very soon.
The JavaScript Spider is the first implementation of a proof of
concept tool which shows that Javascript can be in fact quite
dangerous. This implementation depends on proxydrop.com but other
proxies are possible as well: Google Translate is one of them. Keep in
mind that the tool spiders only the first level.
The tool is located here:
http://www.gnucitizen.org/projects/javascript-spider/launch.htm
As you can see publicly available anonymizing proxies can be used to
fetch remote pages. This technique will work quite successfully on
Internet resources but not on Intranet. The reason for this is quite
obvious.
Suggestions and comments are greatly appreciated.
-- pdp (architect) http://www.gnucitizen.org ------------------------------------------------------------------------ This List Sponsored by: Cenzic Need to secure your web apps? Cenzic Hailstorm finds vulnerabilities fast. Click the link to buy it, try it or download Hailstorm for FREE. http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW ------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:57:08 EDT