FAQ for HW3, Part I

Where can we obtain our assigned transcripts?

They are available here.

What format are the passwords?

Passwords are all 3-character ASCII strings, where the characters are taken from the set {0,1,2,3,4,5,6,7,8,9,a,b,c,d,e,f} (note the lower case).

Where can we find more information about the Yahoo! authentication protocol?

Of course, the source code alone is enough. However, if you find yourself stuck you can look here for some additional help. Some less specific, but still possibly useful, information is here.

What are some good sources to learn about Javascript?

I found the following sites helpful: Remember: You don't need to learn more Javascript than is needed to perform the attack!

What changes do we need to make to the raw source code we obtain from the Yahoo! website?

The changes you need to make are as follows:
  1. Comment out the following lines in the source code:

    location.href=url;
    form.onsubmit=null;
    (These are roughly lines 259 and 261.) You can comment out code using "//".

  2. Add the following line immediately after the lines you just commented out:

    form.submission.value=url;

  3. Replace the line of the form
    < form method=post action="https://login.yahoo.com/config/login?a300q92a55197" autocomplete=off name=login_form onsubmit="return hash(this,'http://login.yahoo.com/config/login')"> (this will be roughly at line 406; note that the numbers following "login?" will be different) with the following:
    < form method=post action="" autocomplete=off name=login_form onsubmit="return hash(this,'http://login.yahoo.com/config/login')">

  4. After the segment of code: 
            < tr>
                < td align="right" nowrap class="bodywhite">Password:< /td>
                < td align="right">< input name="passwd" size="17" value="" type="password">< /td>
        < /tr>
    (this will be roughly around lines 456-459) add the following code: 
         < tr>
		< td align="right" nowrap class="bodywhite">Submitted value:< /td>
		< td align="right">< textarea width="100%" height="400px" name="submission" wrap="logical" rows="10" cols="80">< /textarea>< /td>
     < /tr>
     < tr>
		< td colspan="2" align="right" nowrap class="bodywhite">< input type="reset" value="Reset values" name="reset1">< /td>
     < /tr>
If you like, you can also download a file in which the above changes have already been made for you (if you are unable to download the file directly, you can again load it in a Javascript-enabled browser, view the source, and then copy and paste it to a text editor).

What can we do with the attack.html file once we have made the above changes?

Load the local file attack.html in your web browser. Type a username and password, and then click "Sign In". This simulates the login process, except that the values that would normally be sent to the Yahoo! server are instead displayed in the text box. Hit the "Reset values" button to clear all the values; this will allow you to experiment with various choices for the username and password as you (modify the program and) try to learn how the program works.

How should we submit everything?

Keep everything in two directories, one for each part. The first portion of the homework should go in a directory named "part1" and the second in a directory named "part2".

For part 1, you should have the following files: