 - JavaScript hijacking is a technique that an attacker can use to masquerade as a valid user and read sensitive data from a vulnerable Web application, particularly one using Ajax (Asynchronous JavaScript and XML). Nearly all major Ajax applications have been found vulnerable.
JavaScript hijacking allows a hacker to gain access to data through a loophole in which an interactive Web site on a given domain can run JavaScript hosted on a different domain. For example, in a Web-based e-mail application that uses Ajax, an attacker can log in as the legitimate user. All of the contents of the e-mail inbox and address book then become available to the hacker. In addition, the hacker may send bogus e-mail messages in the name of the victim.
Ajax is a method of building interactive Web applications by combining several programming tools including JavaScript, which can cause a linked-to page to appear (or fail to appear) in a pop-up, hide the status bar, change text in the status bar, change text or graphics within a Web page, create new cookies, change existing cookies or read existing cookies. JavaScript code can be embedded in HTML and interpreted by the Web browser. Ajax is convenient because it allows the content on a Web page to update immediately when a user performs an action.
| LAST UPDATED: |
28 Jun 2007
|
 |
Read more about JavaScript hijacking:
|
|
Do you have something to add to this definition? Let us know.
Send your comments to techterms@whatis.com
|
|
