Home page logo
/

pen-test logo Penetration Testing mailing list archives

Re: [WEB SECURITY] The state of JavaScript Hacking
From: bugtraq () cgisecurity net
Date: Mon, 27 Nov 2006 20:28:12 -0500 (EST)

Mozilla with their XUL makes attackers life so much easier. It is not
that the Mozilla browser is vulnerable to any specific type of attack
but the past has already proved many times that eventually someone
will find an issue with the architecture. Then people will find the
same mistake in other places. The Mozilla XUL is considered a true RIA
(Rich Internet Application) platform that is currently the base of
many open source products. All of them support JavaScript, CSS, Flash
(if installed) and Java (if installed). If the developers of these
applications don't have deep understandings of the security
implications of the Mozilla platform the WEB will become suddenly very
dangerous place for them.

Last but not least we have Microsoft with their XAML and WPF (Windows
Presentation Foundation). I am sure that not that many people have
heard of these technologies so let me explain what they are in brief.
They are the Microsoft's way to do RIA. The only thing is that they
relay on .NET3 which makes them explicitly for Windows. I am not sure
what is the state of the MONO project though.

WPF will allow you to build Rich Internet Applications with XML, CSS
and .NET. .NET supports many languages one of which is JavaScript. Try
to do some coding in ASP and you will see that it feels the same as
browser JavaScript. This is JavaScript on the server, the browser and
the desktop. It enables web worms and future high-end attackers to a
degree hardly imaginable by anyone today.


I've been waiting awhile to see someone talk about this! :)

It is good to hear some conversation about XUL and WPF/XAML as these kinds of applications/technologies will change
the way we use the web. For those who know nothing about these technologies picture a windows application running
inside of your browser having the same look/feel as a non web application (a pretty applet). One of the initial 
concerns involves
the users inability to 'be aware of' application changes initiated potentially via XSS or other types of script 
injection.
One could XSS a site, change the URL to the sites RIA application to their own, and potentially act as a proxy with
the real application without the users knowledge. Does anyone know of any decent links/tutorials on signing 
XUL/WPF/XAML apps
to prevent such situations?

One of the neat .NET 3.0 features allows a developer to at compile time decide if an application is web based or 
standalone. So
for those of you who have written applets instead of modifying code you just change a compile time option.

"Finally, it is worth noting that Windows executables can be hosted in a window (by default) as well as in the browser. 
In both cases, the code remains the same and only needs to be compiled again with a different project property.
"
- http://msdn.microsoft.com/msdnmag/issues/04/01/DevelopingAppsforLonghorn/


Additional reading for those interested 
http://blogs.msdn.com/mharsh/archive/2006/03/23/559106.aspx
http://msdn2.microsoft.com/en-us/library/ms746927.aspx

Sample applications:
http://www.charlespetzold.com/wpf/

- zeno
http://www.cgisecurity.com Website Security news and more!
http://www.cgisecurity.com/index.rss [RSS Feed]


------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------


  By Date           By Thread  

Current thread:
  • Re: [WEB SECURITY] The state of JavaScript Hacking bugtraq (Nov 28)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault