[ADDED] A Surrogate Script for ING Direct and Similar Sites
Posted: Thu Sep 23, 2010 12:27 am
Giorgio, I was wondering if there is a way to provide a surrogate script for this page code:
NOTE: apparently the forum will not allow me to post the entire code (Your message contains 60770 characters. The maximum number of allowed characters is 60000.) so I am cutting all of it except the actual function in question! I would alternatively attach the code but we can't here.
The continue button that validates and submits the pin to the signin page processor so that you can proceed is inline trapped inside an URCHIN function for tracking (onClick="callUrchinPathTracker('/signIn/', 'pinpad/continue');submitForm();") and the only way to bypass this restriction is to allow globally on NoScript, turn off AdBlock, allow all requests on RequestPolicy, and turn off blocking in Ghostery, effectively turning off ALL the security measures of security. Of course, alternatively you can just blanket whitelist ING in all of those applications which effectively means that you won't be able to bypass the tracking and/or use ABE rules which will also require the global whitelisting of the site and rule based restrictions instead. Either way you go, you are giving them the information they want and I want a way to facilitate the function but cripple the payload. My hope is that a surrogate script can trick ING into thinking all the security is off and still nullify the tracking and provide the needed continue function.
Doable? Ideas? Thanks in advance.
NOTE: apparently the forum will not allow me to post the entire code (Your message contains 60770 characters. The maximum number of allowed characters is 60000.) so I am cutting all of it except the actual function in question! I would alternatively attach the code but we can't here.
Code: Select all
...
<script type="text/javascript">
urchinTracker('/login_pinpad');
</script>
...
<div class="loginPadding">
<script language='javascript'>
function checkEnter(e, form) {
var charCode;
if(e && e.which) {
charCode = e.which;
} else {
charCode = e.keyCode;
}
if (charCode == 13) {
form.submit();
return false;
} else {
return true;
}
}
</script>
...
<div style="padding: 10px 0px 16px 0px; margin-left:98px;" class="m_pinpad">
<div id="keyOnly" style="display:none;">
<div class="keypad">
<table border="0" cellpadding="0" cellspacing="0">
<tr valign="top">
<td align="right">
<img src="https://home.ingdirect.com/images/secure/pinpad/1.gif" class='pinpadbutton' id='pinKeyboardCnumber' onMouseUp='return mouseUpKb("C", 1 , "pinKeyboard")' onMouseDown='return setButtonDownKb(1 , "C", "pinKeyboard")' onMouseOut='return setButtonUpKb(1, "C", "pinKeyboard")' height='32' width='20' alt='1' /> </td>
<td align="left">
<img src="https://home.ingdirect.com/images/secure/pinpad/C.gif" class='pinpadbutton' id='pinKeyboardCchar' onMouseUp='return mouseUpKb("C", 1 , "pinKeyboard")' onMouseDown='return setButtonDownKb(1 , "C", "pinKeyboard")' onMouseOut='return setButtonUpKb(1 , "C", "pinKeyboard")' width='17' height='32' alt='C' /> </td>
<td align="right">
<img src="https://home.ingdirect.com/images/secure/pinpad/2.gif" class='pinpadbutton' id='pinKeyboardVnumber' onMouseUp='return mouseUpKb("V", 2 , "pinKeyboard")' onMouseDown='return setButtonDownKb(2 , "V", "pinKeyboard")' onMouseOut='return setButtonUpKb(2, "V", "pinKeyboard")' height='32' width='20' alt='2' /> </td>
<td align="left">
<img src="https://home.ingdirect.com/images/secure/pinpad/V.gif" class='pinpadbutton' id='pinKeyboardVchar' onMouseUp='return mouseUpKb("V", 2 , "pinKeyboard")' onMouseDown='return setButtonDownKb(2 , "V", "pinKeyboard")' onMouseOut='return setButtonUpKb(2 , "V", "pinKeyboard")' width='17' height='32' alt='V' /> </td>
<td align="right">
<img src="https://home.ingdirect.com/images/secure/pinpad/3.gif" class='pinpadbutton' id='pinKeyboardHnumber' onMouseUp='return mouseUpKb("H", 3 , "pinKeyboard")' onMouseDown='return setButtonDownKb(3 , "H", "pinKeyboard")' onMouseOut='return setButtonUpKb(3, "H", "pinKeyboard")' height='32' width='20' alt='3' /> </td>
<td align="left">
<img src="https://home.ingdirect.com/images/secure/pinpad/H.gif" class='pinpadbutton' id='pinKeyboardHchar' onMouseUp='return mouseUpKb("H", 3 , "pinKeyboard")' onMouseDown='return setButtonDownKb(3 , "H", "pinKeyboard")' onMouseOut='return setButtonUpKb(3 , "H", "pinKeyboard")' width='17' height='32' alt='H' /> </td>
</tr><tr valign="top">
<td align="right">
<img src="https://home.ingdirect.com/images/secure/pinpad/4.gif" class='pinpadbutton' id='pinKeyboardMnumber' onMouseUp='return mouseUpKb("M", 4 , "pinKeyboard")' onMouseDown='return setButtonDownKb(4 , "M", "pinKeyboard")' onMouseOut='return setButtonUpKb(4, "M", "pinKeyboard")' height='32' width='20' alt='4' /> </td>
<td align="left">
<img src="https://home.ingdirect.com/images/secure/pinpad/M.gif" class='pinpadbutton' id='pinKeyboardMchar' onMouseUp='return mouseUpKb("M", 4 , "pinKeyboard")' onMouseDown='return setButtonDownKb(4 , "M", "pinKeyboard")' onMouseOut='return setButtonUpKb(4 , "M", "pinKeyboard")' width='17' height='32' alt='M' /> </td>
<td align="right">
<img src="https://home.ingdirect.com/images/secure/pinpad/5.gif" class='pinpadbutton' id='pinKeyboardGnumber' onMouseUp='return mouseUpKb("G", 5 , "pinKeyboard")' onMouseDown='return setButtonDownKb(5 , "G", "pinKeyboard")' onMouseOut='return setButtonUpKb(5, "G", "pinKeyboard")' height='32' width='20' alt='5' /> </td>
<td align="left">
<img src="https://home.ingdirect.com/images/secure/pinpad/G.gif" class='pinpadbutton' id='pinKeyboardGchar' onMouseUp='return mouseUpKb("G", 5 , "pinKeyboard")' onMouseDown='return setButtonDownKb(5 , "G", "pinKeyboard")' onMouseOut='return setButtonUpKb(5 , "G", "pinKeyboard")' width='17' height='32' alt='G' /> </td>
<td align="right">
<img src="https://home.ingdirect.com/images/secure/pinpad/6.gif" class='pinpadbutton' id='pinKeyboardRnumber' onMouseUp='return mouseUpKb("R", 6 , "pinKeyboard")' onMouseDown='return setButtonDownKb(6 , "R", "pinKeyboard")' onMouseOut='return setButtonUpKb(6, "R", "pinKeyboard")' height='32' width='20' alt='6' /> </td>
<td align="left">
<img src="https://home.ingdirect.com/images/secure/pinpad/R.gif" class='pinpadbutton' id='pinKeyboardRchar' onMouseUp='return mouseUpKb("R", 6 , "pinKeyboard")' onMouseDown='return setButtonDownKb(6 , "R", "pinKeyboard")' onMouseOut='return setButtonUpKb(6 , "R", "pinKeyboard")' width='17' height='32' alt='R' /> </td>
</tr><tr valign="top">
<td align="right">
<img src="https://home.ingdirect.com/images/secure/pinpad/7.gif" class='pinpadbutton' id='pinKeyboardJnumber' onMouseUp='return mouseUpKb("J", 7 , "pinKeyboard")' onMouseDown='return setButtonDownKb(7 , "J", "pinKeyboard")' onMouseOut='return setButtonUpKb(7, "J", "pinKeyboard")' height='32' width='20' alt='7' /> </td>
<td align="left">
<img src="https://home.ingdirect.com/images/secure/pinpad/J.gif" class='pinpadbutton' id='pinKeyboardJchar' onMouseUp='return mouseUpKb("J", 7 , "pinKeyboard")' onMouseDown='return setButtonDownKb(7 , "J", "pinKeyboard")' onMouseOut='return setButtonUpKb(7 , "J", "pinKeyboard")' width='17' height='32' alt='J' /> </td>
<td align="right">
<img src="https://home.ingdirect.com/images/secure/pinpad/8.gif" class='pinpadbutton' id='pinKeyboardPnumber' onMouseUp='return mouseUpKb("P", 8 , "pinKeyboard")' onMouseDown='return setButtonDownKb(8 , "P", "pinKeyboard")' onMouseOut='return setButtonUpKb(8, "P", "pinKeyboard")' height='32' width='20' alt='8' /> </td>
<td align="left">
<img src="https://home.ingdirect.com/images/secure/pinpad/P.gif" class='pinpadbutton' id='pinKeyboardPchar' onMouseUp='return mouseUpKb("P", 8 , "pinKeyboard")' onMouseDown='return setButtonDownKb(8 , "P", "pinKeyboard")' onMouseOut='return setButtonUpKb(8 , "P", "pinKeyboard")' width='17' height='32' alt='P' /> </td>
<td align="right">
<img src="https://home.ingdirect.com/images/secure/pinpad/9.gif" class='pinpadbutton' id='pinKeyboardWnumber' onMouseUp='return mouseUpKb("W", 9 , "pinKeyboard")' onMouseDown='return setButtonDownKb(9 , "W", "pinKeyboard")' onMouseOut='return setButtonUpKb(9, "W", "pinKeyboard")' height='32' width='20' alt='9' /> </td>
<td align="left">
<img src="https://home.ingdirect.com/images/secure/pinpad/W.gif" class='pinpadbutton' id='pinKeyboardWchar' onMouseUp='return mouseUpKb("W", 9 , "pinKeyboard")' onMouseDown='return setButtonDownKb(9 , "W", "pinKeyboard")' onMouseOut='return setButtonUpKb(9 , "W", "pinKeyboard")' width='17' height='32' alt='W' /> </td>
</tr><tr valign="top">
<td colspan="2" align="right">
<img src="https://home.ingdirect.com/images/secure/pinpad/clear_keyboard.gif" class='pinpadbutton' onMouseUp='emptyText("pinKeyboard")' height='32' width='37' alt='Clear' /> </td>
<td align="right">
<img src="https://home.ingdirect.com/images/secure/pinpad/0.gif" class='pinpadbutton' id='pinKeyboardNnumber' onMouseUp='return mouseUpKb("N", 0, "pinKeyboard")' onMouseDown='return setButtonDownKb(0, "N", "pinKeyboard")' onMouseOut='return setButtonUpKb(0, "N", "pinKeyboard")' height='32' width='20' alt='zero' /> </td>
<td align="left">
<img src="https://home.ingdirect.com/images/secure/pinpad/N.gif" class='pinpadbutton' id='pinKeyboardNchar' onMouseUp='return mouseUpKb("N", 0, "pinKeyboard")' onMouseDown='return setButtonDownKb(0, "N", "pinKeyboard")' onMouseOut= 'return setButtonUpKb(0, "N", "pinKeyboard")' width='17' height='32' alt='N' /> </td>
<td width="2"></td>
<td colspan="2">
</td>
</tr>
</table>
<div class="keypadInput">
<input type="password" id="customerAuthenticationResponse.PIN" name="customerAuthenticationResponse.PIN" value="" tabindex='3' maxlength='11' size='10' autocomplete='off' onKeyPress='return filterInput(event)'> </div>
</div>
</div>
<div id="clickOnly" class="clickpad" style="text-align:center;width:130px;">
<table border="0" cellpadding="0" cellspacing="0">
<tr valign="top">
<td align="right">
<img src="https://home.ingdirect.com/images/secure//nimbus/pinpad/1.gif" class='pinpadbutton' onMouseUp='return mouseUpMouse(this, "C", 1 , "pin")' onMouseDown='return setButtonDownMouse(this, 1 )' onMouseOut='return setButtonUpMouse(this, 1 )' height='34' width='41' alt='1' /> </td>
<td align="right">
<img src="https://home.ingdirect.com/images/secure//nimbus/pinpad/2.gif" class='pinpadbutton' onMouseUp='return mouseUpMouse(this, "V", 2 , "pin")' onMouseDown='return setButtonDownMouse(this, 2 )' onMouseOut='return setButtonUpMouse(this, 2 )' height='34' width='41' alt='2' /> </td>
<td align="right">
<img src="https://home.ingdirect.com/images/secure//nimbus/pinpad/3.gif" class='pinpadbutton' onMouseUp='return mouseUpMouse(this, "H", 3 , "pin")' onMouseDown='return setButtonDownMouse(this, 3 )' onMouseOut='return setButtonUpMouse(this, 3 )' height='34' width='41' alt='3' /> </td>
</tr><tr valign="top">
<td align="right">
<img src="https://home.ingdirect.com/images/secure//nimbus/pinpad/4.gif" class='pinpadbutton' onMouseUp='return mouseUpMouse(this, "M", 4 , "pin")' onMouseDown='return setButtonDownMouse(this, 4 )' onMouseOut='return setButtonUpMouse(this, 4 )' height='34' width='41' alt='4' /> </td>
<td align="right">
<img src="https://home.ingdirect.com/images/secure//nimbus/pinpad/5.gif" class='pinpadbutton' onMouseUp='return mouseUpMouse(this, "G", 5 , "pin")' onMouseDown='return setButtonDownMouse(this, 5 )' onMouseOut='return setButtonUpMouse(this, 5 )' height='34' width='41' alt='5' /> </td>
<td align="right">
<img src="https://home.ingdirect.com/images/secure//nimbus/pinpad/6.gif" class='pinpadbutton' onMouseUp='return mouseUpMouse(this, "R", 6 , "pin")' onMouseDown='return setButtonDownMouse(this, 6 )' onMouseOut='return setButtonUpMouse(this, 6 )' height='34' width='41' alt='6' /> </td>
</tr><tr valign="top">
<td align="right">
<img src="https://home.ingdirect.com/images/secure//nimbus/pinpad/7.gif" class='pinpadbutton' onMouseUp='return mouseUpMouse(this, "J", 7 , "pin")' onMouseDown='return setButtonDownMouse(this, 7 )' onMouseOut='return setButtonUpMouse(this, 7 )' height='34' width='41' alt='7' /> </td>
<td align="right">
<img src="https://home.ingdirect.com/images/secure//nimbus/pinpad/8.gif" class='pinpadbutton' onMouseUp='return mouseUpMouse(this, "P", 8 , "pin")' onMouseDown='return setButtonDownMouse(this, 8 )' onMouseOut='return setButtonUpMouse(this, 8 )' height='34' width='41' alt='8' /> </td>
<td align="right">
<img src="https://home.ingdirect.com/images/secure//nimbus/pinpad/9.gif" class='pinpadbutton' onMouseUp='return mouseUpMouse(this, "W", 9 , "pin")' onMouseDown='return setButtonDownMouse(this, 9 )' onMouseOut='return setButtonUpMouse(this, 9 )' height='34' width='41' alt='9' /> </td>
</tr><tr valign="top">
<td align="right">
<img src="https://home.ingdirect.com/images/secure//nimbus/pinpad/clear.gif" class='pinpadbutton' onMouseDown='return emptyText("pin")' height='34' width='41' alt='Clear' /> </td>
<td align="right">
<img src="https://home.ingdirect.com/images/secure/nimbus/pinpad/0.gif" class='pinpadbutton' width='41' height='34' alt='zero' onMouseDown='return setButtonDownMouse(this, 0)' onMouseOut= 'return setButtonUpMouse(this, 0)' onMouseUp='return mouseUpMouse(this, "N", 0, "pin")' /> <td width="2"></td>
<td colspan="2">
</td>
</tr>
</table>
<div style="margin:0 10px 0 0;height:25px;" id="pinball"><!-- --></div>
</div>
</div>
</div>
<div class="bl"></div>
<div class="bc" style="width: 315px;"></div>
<div class="br"></div>
</div>
</div>
</div>
<div id="keyboardMessage" class="smallerText" style="padding:10px 0 0 0;width:202px;float:left;display:none">
<a href="#" class="orangeLink" onClick="togglePinPads(true);" tabindex="4" style="font-size:11px;">Return</a> to the <strong>NUMBERS</strong> only PINpad.
</div>
<div id="clickMessage" class="smallerText" style="padding:10px 0 0 0;width:202px;float:left; clear:none; ">
If you're unable to use your mouse, you may also use your <a class="orangeLink" href="#" onClick="togglePinPads(false);" tabindex="3" style="font-size:11px;">keyboard</a>.
</div>
<div style="float:left; clear:none;padding:10px 0 0 19px!important;">
<a href="#" class="transBtn" id="continueButton" name="continueButton" title="Continue" tabIndex="5" onClick="callUrchinPathTracker('/signIn/', 'pinpad/continue');submitForm();"><div style="text-decoration:none;">Continue</div></a>
</div>
</div> </div>
<input type="hidden" name="riskBasedAuthorizationResults" value="" id="riskBasedAuthorizationResults"/>
</form>
<!-- Risk Based Assessment -->
<script type="text/javascript" src='https://www.advanced-web-analytics.com/70012/splash.js'></script>
...Doable? Ideas? Thanks in advance.