Hunting Security Bugs

Chapter 19. Additional Repurposing Attacks

In this chapter:
Understanding Document Formats That Request External Data
Web Pages Requesting External Data
Understanding Repurposing of Window and Thread Messages
Summary

In the ActiveX example in Chapter 18, an attacker calls into the ActiveX control by coercing the target to load an HTML document that contains data specified by the attacker. The attacker uses the Active X control for a purpose other than the control’s developer intended. This same concept applies to other technologies. The repurposing attacks apply to many technologies some are discussed in this chapter. In this chapter, we discuss how document formats and Web applications can be repurposed to perform malicious actions. You’ll also learn ...