{"id":57,"date":"2007-11-02T18:19:01","date_gmt":"2007-11-02T13:19:01","guid":{"rendered":"http:\/\/codeinmybug.wordpress.com\/2007\/11\/02\/drive-by-download-where-network-security-meets-webappsec\/"},"modified":"2008-05-07T15:10:02","modified_gmt":"2008-05-07T09:40:02","slug":"drive-by-download-where-network-security-meets-webappsec","status":"publish","type":"post","link":"https:\/\/projectbee.org\/blog\/archive\/drive-by-download-where-network-security-meets-webappsec\/","title":{"rendered":"Drive-by Download: Where Network Security Meets WebAppSec"},"content":{"rendered":"

DEMO<\/strong><\/a><\/h3>\n

This post was due since the Bank of India hack incident<\/a>, and was fueled by PDP’s Drive-by Java post<\/a>, which is a very simple, yet a well thought of extension (sort of) to the Drive-by Download attack. This post is aimed to provide a clearer understanding of the Drive-by Download attack (via a demo).<\/p>\n

Citing Wikipedia<\/a>, Any download that happens without knowledge of the user<\/strong> can be referred to as Drive-by Download (DBD). Pretty obviously, an attacker downloads (or uploads, depending on the perspective) malwares, viruses etc., especially in case of a zero-day. Now, I should also specify that by the sub-title “network security meets web application security”, I simply wish to point that viruses, malwares, worms are not really a concern of WebAppSec. Please note that these exclude the Javascript payloads<\/em>.<\/p>\n

Here is the video of Bank of India Hack, showing <\/strong>DBD in action.
\n<\/object><\/p>\n

Here is my demo of DBD in action<\/strong><\/a>.
\n<\/strong>All files downloaded to your system are 0 (zero) KB and are completely harmless. You’ve my word. \ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":"

DEMO This post was due since the Bank of India hack incident, and was fueled by PDP’s Drive-by Java post, which is a very simple, yet a well thought of extension (sort of) to the Drive-by Download attack. This post is aimed to provide a clearer understanding of the Drive-by Download attack (via a demo). … <\/p>\n

Continue reading “Drive-by Download: Where Network Security Meets WebAppSec”<\/span><\/a><\/p>\n","protected":false},"author":6,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[15,18,24,33,168,167],"tags":[20,27],"class_list":["post-57","post","type-post","status-publish","format-standard","hentry","category-demo","category-education","category-hack","category-loophole","category-security","category-webappsec","tag-fraud","tag-iframe"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t