COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-587

Cross Frame Scripting (XFS)

This attack pattern combines malicious Javascript and a legitimate webpage loaded into a concealed iframe. The malicious Javascript is then able to interact with a legitimate webpage in a manner that is unknown to the user. This attack usually leverages some element of social engineering in that an attacker must convinces a user to visit a web page that the attacker controls.

Soyutlama

Detailed

Tipik ciddiyet

High

Saldırı ihtimali

Medium

Saldırıyı anla

Bu saldırı kalıbı nedir?

This attack pattern combines malicious Javascript and a legitimate webpage loaded into a concealed iframe. The malicious Javascript is then able to interact with a legitimate webpage in a manner that is unknown to the user. This attack usually leverages some element of social engineering in that an attacker must convinces a user to visit a web page that the attacker controls.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • The user's browser must have vulnerabilities in its implementation of the same-origin policy. It allows certain data in a loaded page to originate from different servers/domains.

Gerekli beceri

MITRE kaydında belirtilmemiş.

Gerekli kaynak

MITRE kaydında belirtilmemiş.

Etki

Başarılı saldırı neye yol açar?

Read Data

Etkilenen alanlar: Confidentiality

Savunma

Nasıl önlenir ve etkisi azaltılır?

1
Avoid clicking on untrusted links.
2
Employ techniques such as frame busting, which is a method by which developers aim to prevent their site being loaded within a frame.

Gerçek dünya

MITRE örnek olayları

Örnek olay 1Detay
An adversary-controlled webpage contains malicious Javascript and a concealed iframe containing a legitimate website login (i.e., the concealed iframe would make it appear as though the actual legitimate website was loaded). When the user interacts with the legitimate website in the iframe, the malicious Javascript collects that sensitive information.
CAPEC-587: Cross Frame Scripting (XFS) — DayBreach Saldırı Sözlüğü · DayBreach