HTML Input Field Obfuscation via Script Injection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web applications are vulnerable to malicious attacks as scripts can attach event listeners to HTML input fields, allowing attackers to observe keystrokes and obtain sensitive data from users, even after form submission.
Innovation Solution
A network traffic management system injects a script into web page source code to remove event listeners from protected input fields, encrypting data and inserting decoy fields to obscure the order of input fields, thereby preventing attackers from intercepting sensitive information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If event listeners are attached to HTML input fields to monitor user input, then attackers can observe keystrokes and obtain sensitive data, but web applications need to process and validate user input efficiently
Solution Approach 1:
A network traffic management system acts as an intermediary between the client and server, injecting security scripts into web pages that modify input field behavior. The injected script wraps input field event handlers to prevent malicious event listeners from capturing keystrokes while still allowing legitimate form submission to proceed to the server for validation.
2Reliability
If web pages send form data via HTTP messages, then data can be transmitted to the server, but attackers can parse HTTP messages to extract sensitive information based on field names and order
Solution Approach 1:
The injected script dynamically changes parameters of input fields including their names, IDs, and the order in which they appear in the form. This obfuscation technique ensures that even if attackers parse HTTP messages, they cannot reliably identify sensitive data fields based on predictable field names or positions, while the server can still correctly process the data using the obfuscated parameters.
Data Source
AI summary
Methods, non-transitory computer readable media, security management apparatuses, and network traffic management systems are disclosed that improve network security via input field obfuscation are disclosed. With this technology, a script is injected into source code of a web page received from a server. The source code is then sent to a requesting client. The script is configured to remove an event listener attached to a protected input field of the web page to provide a script secured input field. An application layer message that is received from the client is subsequently sent to the server. The application layer message includes data submitted via the script secured input field that prevented one or more keystrokes corresponding to the data from being observed by a source of the event listener.