[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: Internet Explorer and Opera local zone restriction bypass

> From: Andreas Sandblad [mailto:sandblad@xxxxxxxxxx]
> I can only reproduce it together with user-interaction, that is manually
> pressing refresh in Internet Explorer. I did some attempts to try to
> automaticly refresh the page using javascript but without any luck
> (denied access due to cross-site-policy).

There is absolutely no requirement for any user-interaction, as you can
programmatically click the Refresh button - or rather, trigger the exact same
non-window-object-dependant non-cross-site functionality in the current window
object where you have all the access you need.



Refresh is just one of the many command identifiers that document and range
objects can utilize


Use a third window object to store the state on wether or not you have refreshed
already, to avoid an infinite loop.

Thor Larholm
PivX Solutions, LLC - Senior Security Researcher
http://pivx.com/larholm/ - Get our research, join our mailinglist