Talk:Cross Frame Scripting

From OWASP
Revision as of 16:48, 8 January 2010 by Justin Ludwig (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

I don't think there's a real consensus on what a "cross-frame scripting attack" actually is (there are a lot of pages out on the web which use it to describe an XSS attack that includes a frame as part of the attack); but the term "cross-frame scripting" has been in common use since the days of netscape 2.0, and refers to using javascript to access content in one frame from another frame. So I re-wrote a large part of this article to discuss an attack which uses javascript to access content in one frame from another frame, because it's a real issue too, and not covered well anywhere else.

I focused on the IE bug which leaks events across framesets because that's the only existing bug of this type of which I'm aware. I also kept some examples of using XSS with frames, to demonstrate how they're different from cross-frame scripting.

Justin Ludwig 21:48, 8 January 2010 (UTC)