CONTENT INJECTON TUTORIAL | ARBITARY TEXT INJECTION | H4K-XTRA
Content spoofing, also referred to as content injection, "arbitrary text injection" or virtual defacement, is an attack targeting a user made possible by an injection vulnerability in a web application. When an application does not properly handle user-supplied data, an attacker can supply content to a web application, typically via a parameter value, that is reflected back to the user. This presents the user with a modified page under the context of the trusted domain.
This attack is typically used as, or in conjunction with, social engineering because the attack is exploiting a code-based vulnerability and a user's trust. As a side note, this attack is widely misunderstood as a kind of bug that brings no impact.
Text Injection:
Another example of a content spoofing attack would be to present false information to a user via text manipulation. An attack scenario is demonstrated below. For this scenario, lets assume proper output encoding HAS been implemented and XSS is not possible.
An attacker identifies a web application that gives recommendations to its users on whether they should buy or sell a particular stock.
The attacker identifies a vulnerable parameter
The attacker crafts a malicious link by slightly modifying a valid request.
The link containing the modified request is sent to a user and they clicks the link.
A valid webpage is created using the attackers malicious recommendation and the user believes the recommendation was from the stock website.
Valid Page:
http:// vulnerablesite/suggestions.php?stockid=123&stockrecommendation=We+Recommend+You+Buy+
Now,
Modified Page:
http:// vulnerablesite/suggestions.php?stockid=123&stockrecommendation=We+Really+Recommend+You+Sell+This+Stock+Now
For More Knowledge : https://www.owasp.org/index.php/Conte...