Vulnerability Development mailing list archives

Re: Netscape forms using standard windows controls


From: ztang () WEBER LCS MIT EDU (Chon-Chon Tang)
Date: Mon, 22 May 2000 12:00:01 -0400


You should do a little more research into the IE application model; it
provides what you need.

All, and I stress, *all*, of the core functionality you need is exposed by
Internet Explorer through a number of COM interfaces.  Accessing form
fields is substantially easier than looking for subclassed windows.

The reason EnumChildWindows doesn't show up is probably because the entire
internet explorer applciation consists mostly of a simple window shell
containing their COM component that actually contains the
content/rendering/document object model.

On Sun, 21 May 2000, No User wrote:

This cannot be new - but I just found out. My intention was to write an automatic form filler (if you have to know 4 
sure: to check all nailnews items wiv one click). Forms displayed in netscape for Win32 use standard windows 
controls. If you do an EnumChildWindows() on a form, you will get all kinds of Button  Edit fields.

IE doesnt do this. You can check out by yourself by pointing Spy++ at IE while its displaying a form: there is just 
one window that you will find, namely "Internet Explorer_Server". This looks like another one of those "inside 
technologys" M$ uses to annoy competitors - those things sure look like standard controls, but they arent. Anyone 
know just what they do ? Same in Outlook, btw.

Back to NS: you can easily subclass a window, say, a password edit field - no big deal. If NS reads the form data, it 
will read the contents of the window. So, forms filling can be done but you can do all kinds of nasty things, too: 
such as sending the pwd somewhere else, or (if you want to make someones life miserably), garble the contents so that 
all login attempts to secure sites will fail.

Workarounds: I dont know of any safe way to prevent running windows from being seen by EnumChildWindows() - other 
than the said M$ code - the first (and crucial step) if you want to remotely subclass a window.



Current thread: