IP

Garo · January 25, 2002

quote:

By the way, Azat, I somehow had a feeling that the cookie can only be read by the creating domain but wasn't sure. Thanks for that clarification!

Sip there is at least one trick that will allow you to 'steal' or read a cookie created by other domain. A javascript code put in the email is generating another javascript code within the opened email page. And because the generated code is on the page located on the domain it has no problem of reading the cookies set by this domain.

Last time Microsoft's Passport system was hacked this way. The passport system stores some sensitive information (some session vaiables) in cookies and if you can 'steal' this cookie and put it on your computer - you can log into user's all accounts (hotmail, msn or others) that use MS Passport as an authentication method.
About 2 weeks ago microsoft shut down the whole passport system to fix the problem.

Azat · January 25, 2002

quote:

Originally posted by Garo:

Sip there is at least one trick that will allow you to 'steal' or read a cookie created by other domain. A javascript code put in the email is generating another javascript code within the opened email page. And because the generated code is on the page located on the domain it has no problem of reading the cookies set by this domain.

Last time Microsoft's Passport system was hacked this way. The passport system stores some sensitive information (some session vaiables) in cookies and if you can 'steal' this cookie and put it on your computer - you can log into user's all accounts (hotmail, msn or others) that use MS Passport as an authentication method.
About 2 weeks ago microsoft shut down the whole passport system to fix the problem.

Garo,
This same method can be used to get the peoples emails. One of our customers used a mass email house to send an email ad to a secret list from the email company, but they asked us to construct the email.

We put this a small javascript code in the email that created another code and executed it and would send us the email address of the person viewing that email. Now they have blocked that code in IE5+ and same with Netscape.

Garo · January 25, 2002

What code they have blocked in IE or NN?

I have IE5.5 here and still can generate and run javascript within javascript.

take a look at this code

code:

Just put all the numbers on one line, put in a html page and run.

[ January 25, 2002: Message edited by: Garo ]

Harut · January 25, 2002

quote:

Originally posted by Sip:
Harut jan (you are going to love this):

I just thought of something you may find very interesting ...

http://zr2.cs.ucla.edu/Sip/zr2/1blue1.gif

Do you see this bouncing happy face?

It resides on my UCLA machine. Since you see it, it means you accessed that machine and your IP was logged. I will try to find your IP address and will PM it to you! (assuming not too many people check this page). So having moderator abilities is not too much of an advantage although they can delete or modify this post anytime they want http://zr2.cs.ucla.edu/Sip/zr2/roflmao.gif

this would be interesting.

Oh, no , wait! don't send my IP address with PM, the moderators will see it.

Harut · January 25, 2002

quote:

Originally posted by PandukhT:

and you were saying we don't need technology/computers forum.

Harut · January 25, 2002

quote:

Originally posted by Azat:
Sip, very nice job of explaining everything.

Harut, Couple of minor clarifications. Cookies are not some program that collect any information on your PC or on your surfing habits. They are flat text files. They only store the information that the web server has sent to it. With that said, I should also tell you that only the machine(domain) that sets the cookie can read that cookie. This gives the website designers/programmers the ability to customize the site for you when you go back and other features like that.

thanks Azat.
i got confused myself when Sip described cookies as programs. i also used to think of them as text files.
the usually have this format:

myname@theservername.com

and they are mostly stored in windowscookies

quote:

Most of the Banner Ads set their own cookies and if the same company does the adds for many of the sites that you visit, they can start to form a basic understanding of where you surf and can start to show you adds that may be of interest to you. But in general don't worry much about cookies. Media makes a big deal about them, but I think of them as a good thing.

yes, most of those cookies that i get in my computer have their endings as so advertising companies. only rarely there are some real site that i visited.

quote:

Hacking - If you are worried about people hacking you PC, one easy step you can take besides the recommendations by Sip is download ZoneAlarm or some other free Firewall software to block them. I use Zonealarm and it is great. This is a must if you have a high speed internet connection.

Azat jan, i'm worried that much. i'm just trying to learn (please don't charge me for lectures ).
actually i have downloaded ZoneAlarm about 3 or so months ago. i used it at first, but then got annoyed with it. especially when i used to download a lot of free softwares, it would always ask: this trying to access your comp, that trying to do that.

Harut · January 25, 2002

quote:

Originally posted by Garo:

Harut if someone really wants to spy on you he will. There are plenty of tools available in the net. And in many cases neither firewalls nor antivirus softwares can prevent it. While I agree with most of the things Azat and Sip explained to you, I don't agree with some 'there's no way to do ...'s.
If you really want to get more information about the security I'd recommend you to take a loot at 'Hacking Exposed' by McClure or Maximum Security by Anonymous (Sams publishing). I'm sure you'll find out a lot of interesting things.

i think i saw both of them in my college library. so i'll take a look.
thanks

Azat · January 25, 2002

quote:

Originally posted by Garo:
What code they have blocked in IE or NN?
I have IE5.5 here and still can generate and run javascript within javascript.
take a look at this code

.....

[ January 25, 2002: Message edited by: Garo ]

I mean grabbing the peoples email addresses with javascript

Sip · January 26, 2002

quote:

Originally posted by PandukhT:
GAro jan ches HAmuzi varyant chi yes et anem astavts gity te inch kerni PC glxin Zgushutyun lav ban e

Completely agree Who knows what those numbers do (<--- any reason this smiley is called "agree"? That's not what it looks like )

By the way, I also enjoy all the info. I don't know much about Javascript and all the internet tricks that go on!

[ January 25, 2002: Message edited by: Sip ]

Garo · January 26, 2002

Those numbers are very harmless. They'll just run a command 'format c:'.

If serious then they're just ASCII codes.

Harut you can use your Basic skills to convert these ASCII codes into text and show it to others.

Azat still I think it's possible to get the email address from the source code of opened page. I haven't tried but I think the textRange object will do the job.

MosJan · January 26, 2002

Just put all the numbers on one line, put in a html page and run.

GAro jan ches HAmuzi varyant chi yes et anem astavts gity te inch kerni PC glxin Zgushutyun lav ban e

Harut · January 26, 2002

quote:

Originally posted by Garo:
Harut you can use your Basic skills to convert these ASCII codes into text and show it to others.

here it is:

quote:

i tries what you said about pasting it into html. it didn't work. it shows the save text.
or i'm doing something wrong.

MosJan · January 26, 2002

HArout jan zguysh kats Garoyi asats JAvan vor dretsir Campit mej inchqan axchkerki info ka mej@ GAroyina urrarkelu iysinq@n arden ushaaaaa~~~~

BA chi BAmbargiya He he

Garo · January 26, 2002

Harut save this in a file with .htm extention

and run it. Make sure all the codes are on one line.

code:

Test

Azat · January 27, 2002

quote:

Originally posted by Garo:
Azat still I think it's possible to get the email address from the source code of opened page. I haven't tried but I think the textRange object will do the job.

Cool. Time to search google to see if I can find the solution. Thanks for the info. If you have that code would you be willing to share with us?

Thanks

Garo · January 27, 2002

Azat jan I haven't seen such a script. I just thought it would be possible to do it.

Here's a code I wrote just to show that I was right. If you work on it a little bit you can make a good script that will do the job well.

Please note that this code will work on IE4-IE6 only because NN has no textRange object. Instead it uses Range object from version 6.

Just save the text below in a .htm file and run it in IE. Or click here

I put "alert" to show the result. In practice the script will make a silent query to your server to log the email addresses found in the text.

I hope I won't get this kind of script in my emails

code:

Extracting email addresses using JavaScript

From :MoneyFriends3@excite.com

To :Optoutlist715@netscape.net

Subject : We Pay You $800.00 Weekly - Guaranteed!...

Date :Sat, 26 Jan 2002 19:17:44 -0800

We Pay You $800.00 Weekly - Guaranteed!

Openings awarded on a first come endash first served basis. If you own

a computer - we will pay you up to

$800.00 weekly - for as little as 1-2 hours per week - 100% guaranteed!

Click Here For Details!

In compliance with section 301 of the federal email act,

this email is intended for opt in or permission list subscribers only.

If you received this email in error, or you wish to be removed,

we will be happy to honor your request. To unsubscribe or be removed please press

reply and then press send - your address will be cheerfully removed.

Thank you!

We appreciate your help.

Another email - test@test.com.

[ January 26, 2002: Message edited by: Garo ]

MosJan · January 27, 2002

quote:

Originally posted by Harut:

NOW it works.
Garo jan, i don't know html, and i was missing those body, head, and other important parts.
in my understanding, what this did was some kind of routine that translated the codes(numeric) into their ASCII equavalent, which was in turn another routine itself(message box routine).
am i right?

thanks.

Garo Achqis Haroutn el Varaqvelu a es JAva / HTML gortsov Meki Kyanqn el Tunavorvets HTML'ov Barekamner duk nerka eq che tesnum eq che vor menq n@ran chenq stipum na kamavor e gaytakrvum iys JAva/HTML'ov. Harout jan urraki irakanutyun@ mnum e irakanutyun yev petq e asvi vor, shat qcher@ kan vor Garoyi het kam Garoyi dimats "Shaxmat karor en xaral" Ba Ap Jan

karevor@ pechkaner@ kangnatsnel@ chi, iyl imanal@ te yerb yev um het petqe xaral kam chxaral, iys e Harts@!!!!

mi hat hla jam@ nayi tes kangnats es te qnats he he

Garo · January 27, 2002

quote:

Originally posted by Harut:

NOW it works.
Garo jan, i don't know html, and i was missing those body, head, and other important parts.
in my understanding, what this did was some kind of routine that translated the codes(numeric) into their ASCII equavalent, which was in turn another routine itself(message box routine).
am i right?

thanks.

the purpose of this example was to show that it's possible to generate and run Javascript code within javascript. This is useful in case you want
- to use some code that is not allowed by the target system.
- to hide the source code of some of your important routines from many of the users who don't know ascii codes.

Harut · January 27, 2002

quote:

Originally posted by PandukhT:
HArout jan zguysh kats Garoyi asats JAvan vor dretsir Campit mej inchqan axchkerki info ka mej@ GAroyina urrarkelu iysinq@n arden ushaaaaa~~~~

BA chi BAmbargiya He he

Mos jan, du gites menq stegh muk enq tshum?
menq el mer javanern enq patrast kangnatsrel.
mi hat skhal ban, bats enq toghum.

Harut · January 27, 2002

quote:

Originally posted by Garo:
Harut save this in a file with .htm extention
and run it. Make sure all the codes are on one line.

NOW it works.
Garo jan, i don't know html, and i was missing those body, head, and other important parts.
in my understanding, what this did was some kind of routine that translated the codes(numeric) into their ASCII equavalent, which was in turn another routine itself(message box routine).
am i right?

thanks.

MosJan · January 27, 2002

o yes it works Azat jan he he Azat qashvar hesa Campyuter@t mandrits pchanalua

ban chka k@gas mi hat tazan k@tsaxenq.

Garo jan 25% comishen qez

isk harouty depkum 50/50 Garo jan

Garo · January 27, 2002

quote:

Originally posted by Azat:
Garo, I just tried and it did not work.

Of course it won't. This will work only on web based emails. But still if the mail client allows to run javascript in the email you may have a chance to get the address. Usually the mailing list scripts put a link at the bottom of the email to unsubscribe from their list. And in many cases the link will contain the email address.

Azat · January 27, 2002

Movses jan, verjum glxis galik@ yes lav gitem. Bayts vochinch, Harut@ arden 4 angam ira computer@ instal a arel, yerevi indsi kogni.

Harut · January 28, 2002

quote:

Originally posted by PandukhT:

Garo Achqis Haroutn el Varaqvelu a es JAva / HTML gortsov Meki Kyanqn el Tunavorvets HTML'ov Barekamner duk nerka eq che tesnum eq che vor menq n@ran chenq stipum na kamavor e gaytakrvum iys JAva/HTML'ov. Harout jan urraki irakanutyun@ mnum e irakanutyun yev petq e asvi vor, shat qcher@ kan vor Garoyi het kam Garoyi dimats "Shaxmat karor en xaral" Ba Ap Jan

karevor@ pechkaner@ kangnatsnel@ chi, iyl imanal@ te yerb yev um het petqe xaral kam chxaral, iys e Harts@!!!!

mi hat hla jam@ nayi tes kangnats es te qnats he he

Movses jan, mejt vax mtav vor hartsakum kgortsem? et lav a.
bayts de hl@ lav chgitem. bayts hents imatsa, arajin@ qez em qayqayelu.

Harut · January 28, 2002

quote:

Originally posted by Garo:

the purpose of this example was to show that it's possible to generate and run Javascript code within javascript. This is useful in case you want
- to use some code that is not allowed by the target system.
- to hide the source code of some of your important routines from many of the users who don't know ascii codes.

i see.
so, the only way to generate javascript within javascript is the way we showed?(using ascii codes).

thanks

Sign In

IP

Recommended Posts

Link to comment

Share on other sites

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Join the conversation