6a96547ef0
git-svn-id: http://webgoat.googlecode.com/svn/branches/webgoat-6.0@485 4033779f-a91e-0410-96ef-6bf7bf53c507
24 lines
898 B
HTML
24 lines
898 B
HTML
<div align="Center">
|
|
<p><b>Lesson Plan Title:</b> How to Perform DOM Injection Attack. </p>
|
|
</div>
|
|
|
|
<p><b>Concept / Topic To Teach:</b> </p>
|
|
How to perform DOM injection attacks.
|
|
<br>
|
|
<div align="Left">
|
|
<p>
|
|
<b>How the attacks works:</b>
|
|
</p>
|
|
Some applications specially the ones that uses AJAX manipulates and updates the DOM
|
|
directly using javascript, DHTML and eval() method.<br>
|
|
An attacker may take advantage of that by intercepting the reply and try to inject some
|
|
javascript commands to exploit his attacks.
|
|
</div>
|
|
<p><b>General Goal(s):</b> </p>
|
|
<!-- Start Instructions -->
|
|
* Your victim is a system that takes an activation key to allow you to use it.<br>
|
|
* Your goal should be to try to get to enable the activate button.<br>
|
|
* Take some time to see the HTML source in order to understand how the key validation process works.<br>
|
|
<!-- Stop Instructions -->
|
|
|