+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Curious about this attack (/showthread.php?tid=5734467)
Curious about this attack - Abathur - Oct 10, 2017
Can anyone answer this?
Widgets.com, a company that sells widgets online, receives orders from customers through web forms. The customer completes the form in their browser window and clicks the submit button on the page. A url containing the type of widgets, the unit price and the quantity is created by javascript code in the page and sent by the user’s browser to the widgets.com server. Upon receiving this request the widgets.com server extracts the values from the url and enters them into the order processing database as a new order. How might this scenario be exploited by an attacker, name the type of flaw?
* - Baud - Oct 10, 2017
The first thing that comes to mind is XSS, which basically is JavaScript code embedded in places where it shouldn't be, and which is executed whenever the page containing the injected code is loaded. It's also one of the most common vulnerabilities out there, big companies were found with XSS vulnerabilities many times before. You can learn more about it here: https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
* - Abathur - Oct 10, 2017
(Oct 10, 2017 12:17 PM)Baud Wrote: The first thing that comes to mind is XSS, which basically is JavaScript code embedded in places where it shouldn't be, and which is executed whenever the page containing the injected code is loaded. It's also one of the most common vulnerabilities out there, big companies were found with XSS vulnerabilities many times before. You can learn more about it here: https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
Great thank you!