Jump to content

  • Log In with Google      Sign In   
  • Create Account

Awesome job so far everyone! Please give us your feedback on how our article efforts are going. We still need more finished articles for our May contest theme: Remake the Classics

#ActualAntheus

Posted 06 February 2012 - 10:03 AM

What technologies are available for this kind of functionality?


Cross-site scripting malware does this.

Since this falls under a security issue, browsers actively introduce features which prevent such behavior. Sites also increasingly support SSL to prevent man in the middle attacks.

Think what you're asking:
- user logs into a bank account
- when they make a deposit, their request is intercepted and sent to my server
- I modify the amount from $10 to $10,000 and submit that
- I return modified response to user showing they deposited $10.


Some sites offer augmenting of pages, such as leaving comments on third-party pages.

The way they work is that you install a plugin/bookmarklet. Whenever such user visits a page, the plugin makes a request to your server, saying something like: "show me extra content for page www.example.com". Plugin then renders this on top of original page. Intercepting requests is generally not possible since it's a considerably security flaw. Such plugins do not interfere with original page, they operate completely independently and in parallel. After original page has loaded, they can examine DOM to request additional third-party information, but only reactively and passively, they are prevented from interfering with original server/client communication.

#1Antheus

Posted 06 February 2012 - 10:01 AM

What technologies are available for this kind of functionality?


Cross-site scripting malware does this.

Since this falls under a security issue, browsers actively introduce features which prevent such behavior. Sites also increasingly support SSL to prevent man in the middle attacks.

Think what you're asking:
- user logs into a bank account
- when they make a deposit, their request is intercepted and sent to my server
- I modify the amount from $10 to $10,000 and submit that
- I return modified response to user showing they deposited $10.


Some sites offer augmenting of pages, such as leaving comments on third-party pages.

The way they work is that you install a plugin/bookmarklet. Whenever such user visits a page, the plugin makes a request to your server, saying something like: "show me extra content for page www.example.com". Plugin then renders this on top of original page. Intercepting requests is generally not possible since it's a considerably security flaw.

PARTNERS