0
changed data needs to be sent, instead of the full HTML, which results in web applications
that appear more responsive. The methods supported by XHR include most of the HTTP
methods, including GET, POST, HEAD, POST, and DELETE, via its open method:
Open (HTTP method, URL)
Here??™s a sample XHR request to GET a web page:
open("GET", "http://www.isecpartners.com")
Using XHR, an attacker who entices a user to visit a web page can perform GETs and
POSTs on behalf of the user. The great thing about XHR is that it will not perform any
actions on a different domain, so the request must be within the same domain of the
page. For example, if the attacker entices a victim user to visit www.clevelandbrowns
.com, which includes a malicious XHR request that submits a GET to an evil site called
www.baltimorebenedicts.com, the XHR request will fail since the request is not within
the clevelandbrowns.com domain. However, if the attacker tries to get the user to visit
www.clevelandbrowns.com/ArtLied, XHR will allow the request.
Even with the domain limitation, attackers know a lot of targets on the information
super highway. Social networking sites such as MySpace, Facebook, or Linked-in; blog
applications such as blogger.
Pages:
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211