bugtraq - RE: Internet Explorer and Opera local zone restriction bypass

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 27 Oct 2003 23:44:01 -0800
From: "Thor Larholm" <thor@...x.com>
To: <sandblad@....umu.se>, "Mindwarper *" <mindwarper@...uxmail.org>
Cc: <bugtraq@...urityfocus.com>, <vuln-dev@...urityfocus.com>
Subject: RE: Internet Explorer and Opera local zone restriction bypass


> From: Andreas Sandblad [mailto:sandblad@....umu.se]
> I can only reproduce it together with user-interaction, that is manually
> pressing refresh in Internet Explorer. I did some attempts to try to
> automaticly refresh the page using javascript but without any luck
> (denied access due to cross-site-policy).

There is absolutely no requirement for any user-interaction, as you can
programmatically click the Refresh button - or rather, trigger the exact same
non-window-object-dependant non-cross-site functionality in the current window
object where you have all the access you need.

document.execCommand("Refresh");

http://msdn.microsoft.com/workshop/author/dhtml/reference/methods/execcommand.asp

Refresh is just one of the many command identifiers that document and range
objects can utilize

http://msdn.microsoft.com/workshop/author/dhtml/reference/commandids.asp

Use a third window object to store the state on wether or not you have refreshed
already, to avoid an infinite loop.



Regards
Thor Larholm
PivX Solutions, LLC - Senior Security Researcher
http://pivx.com/larholm/ - Get our research, join our mailinglist