Developer's Guide to Web Application Security

Web-Based E-Mail Attacks

The most serious consequence of JavaScript comes when using a Web-based mail

service. Executing JavaScript when the user opens a Web-based e-mail message

allows the JavaScript code to essentially take over what is displayed on the screen.

This could completely fool users into thinking they were working in the normal

Hotmail system, when in fact, everything they were doing was being monitored and

perhaps sent back to a server on the Internet.

Let’s look at an example. Imagine you open a message with embedded JavaScript

on a Web-based e-mail service.The code in the e-mail could easily display a fake

login screen to make you think ...