[22264] in bugtraq
Re: HTML Form Protocol Attack
daemon@ATHENA.MIT.EDU (Jim Paris)
Thu Aug 16 01:17:52 2001
Date: Wed, 15 Aug 2001 23:04:49 -0400
From: Jim Paris <jim@jtan.com>
To: bugtraq@securityfocus.com
Message-ID: <20010815230449.A3418@neurosis.mit.edu>
Reply-To: jim@jtan.com
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20010816024912.A14332@purple.chu.cam.ac.uk>; from bgrg2@cam.ac.uk on Thu, Aug 16, 2001 at 02:49:12AM +0100
> You're right, after attempted again I managed to get it to login to my
> FTP server, but ftp was not the best protocol to try it on considering
> the way data back from the server is sent, which there's no way of
> fiddling.
I'm not sure what you mean by this, but:
USER <SCRIPT>alert("hi")</SCRIPT>
331 Password required for <SCRIPT>alert("hi")</SCRIPT>.
You can pretty easily get arbitrary text sent back to the browser
(with other protocols too, I'm sure), so you could pass back
JavaScript that would go and interpret the text of the returned
document, causing your victim's web browser to suddenly become quite
intelligent and useful for future connections..
I can see it now..
1) Victim behind a firewall visits a webpage.
2) Victim's browser connects to an internal anonymous FTP server
3) Victim's browser walks the directory tree, downloads files,
and dumps their contents back to the original webpage.
Whee.
-jim
