Informative Information for the Uninformed | ||||||||||||||
|
||||||||||||||
Next: Penetration Testing
Up: Potential Uses and Enhancements
Previous: Automation with Scripting
  Contents
Passive Information Gathering
In some situations the ActiveX control may not have enough
information to create an HTTP tunnel between the target machine and
the attacker. An example of information that the control would need
but may not have is proxy authorization credentials. In cases such
as these it would be possible for the ActiveX control to be enhanced
to support keystroke logging and other forms of information
gathering that would allow it to collect enough data to be able to
build some sort of data channel. The ActiveX control could also be
extended to make the data channel more covert by having it vary both
in protocol, such as by switching to and from DNS, and in delay,
such as by causing HTTP posts to be spread out in time to make them
appear less suspicious.
|