Vulnerability Development mailing list archives

Netscape forms using standard windows controls


From: no.user () ANON XG NU (No User)
Date: Sun, 21 May 2000 04:52:39 -0500


This cannot be new - but I just found out. My intention was to write an automatic form filler (if you have to know 4 
sure: to check all nailnews items wiv one click). Forms displayed in netscape for Win32 use standard windows controls. 
If you do an EnumChildWindows() on a form, you will get all kinds of Button  Edit fields.

IE doesnt do this. You can check out by yourself by pointing Spy++ at IE while its displaying a form: there is just one 
window that you will find, namely "Internet Explorer_Server". This looks like another one of those "inside technologys" 
M$ uses to annoy competitors - those things sure look like standard controls, but they arent. Anyone know just what 
they do ? Same in Outlook, btw.

Back to NS: you can easily subclass a window, say, a password edit field - no big deal. If NS reads the form data, it 
will read the contents of the window. So, forms filling can be done but you can do all kinds of nasty things, too: such 
as sending the pwd somewhere else, or (if you want to make someones life miserably), garble the contents so that all 
login attempts to secure sites will fail.

Workarounds: I dont know of any safe way to prevent running windows from being seen by EnumChildWindows() - other than 
the said M$ code - the first (and crucial step) if you want to remotely subclass a window.


Current thread: