XSS Attacks

358 Chapter 7 9 Exploit Frameworks

Figure 7.46 Viewing Document

There are many implications to this. An attacker can browse directories and open and

read any file that Firefox can normally open within browser

(html, txt, ).

We'll focus on the

impact to Firefox for now, and go for a tour in XSS-Proxy of this hard drive.

Using XSS-Proxy's "evaluate input," we can determine where Sage was running from

and easily get the Firefox user profile directory. (We can also walk through the directory

structure to get this information with

other file: //-based

XSS vulnerabilities)

Figure 7.47 ...