Shulou(Shulou.com)06/01 Report--

This article shows you how to analyze the use of iFrame injection, the content is concise and easy to understand, it will definitely brighten your eyes. I hope you can get something through the detailed introduction of this article.

IFrame injection is a very common cross-site scripting attack. It includes one or more iframe codes that have been inserted into the page or article content, or generally download an executable program or perform other actions to make the site visitor's computer compromise. At best, Google may mark the site as "malicious". In the worst case, site owners and visitors end up using malware-infected computers.

IFrame injection occurs when an iFrame on a fragile web page displays another web page through a user-controllable input.

GET/search.jsp?query=%3Ciframe%20src=%22 https://google.com/?%22%3E%3C/iframe%3E HTTP/1.1

Different browsers use different payload:

(IE) (Firefox, Chrome, Safari)

A variety of uses are as follows:

(IE) (IE) (Firefox, Chrome, Safari) (Firefox, Chrome, Safari) http://target.com/something.jsp?query=eval(location.hash.slice(1))#alert(1)

Accepting user-supplied data as the iframe source URL may cause malicious content to be loaded in the Visualforce page.

IFrame spoofing vulnerabilities occur in the following situations:

1. Data enters the web application through untrusted sources.

2. The data is used as an iframe URL without validation.

In this way, if an attacker provides the victim with an iframesrc parameter set as a malicious Web site, the framework will be rendered along with the content of the malicious Web site.

The above is how to analyze the use of iFrame injection. Have you learned any knowledge or skills? If you want to learn more skills or enrich your knowledge reserve, you are welcome to follow the industry information channel.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.