|
The Extended HTML Form Attack Revisited |
|
|
|
Source: cgisecurity - Posted by Bill Keys
|
"HTML forms (i.e. form) are one of the features in HTTP that allows users to send data to HTTP servers. An often overlooked feature is that due to the nature of HTTP, the web browser has no way of identifying between an HTTP server and one that is not an HTTP server. Therefore web browsers may send this data to any open port, regardless of whether the open port belongs to an HTTP server or not. Apart from that, many web browsers will simply render any data that is returned from the server.
Have you ever heard about the extended HTML form attack? What can web developer do? This article looks into this attack and how attackers can use it.
Read this full article at cgisecurity
Powered by AkoComment! |
