1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
| 1. FSCommand() (an attacker can use this when executing an embedded flash object)
2. onAbort() (when the user aborts an image that is loading)
3. onActivate() (when an object is set as the active element)
4. onAfterPrint() (fires after the user prints or print-previews a job)
5. onAfterUpdate() (fires on a data object after the source object's data is updated)
6. onBeforeActivate() (fires on an object when it is set as the active element)
7. onBeforeCopy() (the attacker executes attack code before a selection is copied to the clipboard — the attacker can achieve this via the execCommand("Copy") function.)
8. onBeforeCut() (the attacker executes attack code before a selection is cut.)
9. onBeforeDeactivate() (fires after the active element is changed)
10. onBeforeEditFocus() (fires before an object inside an editable element reaches a UI-activated state, or before an editable object is selected)
11. onBeforePaste() (the user must be tricked into pasting, or it must be triggered via the execCommand("Paste") function.)
12. onBeforePrint() (the user must be tricked into printing, or the attacker can use the print() or execCommand("Print") function.)
13. onBeforeUnload() (the user must be tricked into closing the browser — the attacker cannot unload windows unless it is executed from its parent window.)
14. onBeforeUpdate() (fires on a data object after the source object updates its data.)
15. onBegin() (the onbegin event fires immediately after the element's lifecycle begins)
16. onBlur() (fires when focus is lost*)
17. onBounce() (fires when a marquee object's behavior property is set to "alternate", or when the marquee's content reaches the edge of the window.)
18. onCellChange() (fires when data changes in a data provider)
19. onChange() (a select, text, or TEXTAREA field loses focus or its value is changed.)
20. onClick() (click event)
21. onContextMenu() (the user must right-click in the attack area)
22. onControlSelect() (fires when the user tries to control a selection object.)
23. onCopy() (the user must copy something, or use the execCommand("Copy") command)
24. onCut() (the user must copy something, or use the execCommand("Cut") command)
25. onDataAvailable() (the user changes data on some element, or the attacker can execute the same function.)
26. onDataSetChanged() (fires when the source data object is changed)
27. onDataSetComplete() (fires when data is successfully retrieved from the data source object)
28. onDblClick() (the user double-clicks some element.)
29. onDeactivate() (fires when the current element loses its active state)
30. onDrag() (requires the user to drag some object)
31. onDragEnd() (requires the user to drag some object)
32. onDragLeave() (requires the user to drag some object from a valid position.)
33. onDragEnter() (requires the user to drag some object from a valid position.)
34. onDragOver() (requires the user to drag some object from a valid position.)
35. onDragDrop() (the user drags some object (such as a file) into the browser window.)
36. onDragStart() (occurs when the user begins a drag operation.)
37. onDrop() (the user drags some object (such as a file) into the browser window.)
38. onEnd() (fires when the lifecycle ends)
39. onError() (fires when an error occurs while loading a document or image)
40. onErrorUpdate() (fires when an error occurs while updating an object related to the data source)
41. onFilterChange() (fires when a filter's completion state changes)
42. onFinish() (fires when a moving Marquee text finishes one movement)
43. onFocus() (the attacker can execute code when the window gains focus)
44. onFocusIn() (the attacker can execute code when the window gains focus)
45. onFocusOut() (the attacker can execute code when the window loses focus)
46. onHashChange() (fires when the hash of the current address changes)
47. onHelp() (fires attack code when the user presses F1 in the current window)
48. onInput() (fires after the content in an editable element is changed by the user)
49. onKeyDown() (the user presses a key)
50. onKeyPress() (the user clicks or presses a key)
51. onKeyUp() (the user releases a key)
52. onLayoutComplete() (requires the user to print or print-preview)
53. onLoad() (the attacker executes attack code after the window loads)
54. onLoseCapture() (can be triggered by the releaseCapture() method)
55. onMediaComplete() (when a streaming media file is played, this event fires before the file starts playing.)
56. onMediaError() (fires when the page the user opens contains a media file and an error occurs)
57. onMessage() (fires when the document object receives a message)
58. onMouseDown() (the attacker needs the user to click an image.)
59. onMouseEnter() (the cursor moves into an object or area)
60. onMouseLeave() (the attacker needs the user to move the cursor into an image or table, then move it out again)
61. onMouseMove() (the attacker needs the user to move the mouse onto an image or table)
63. onMouseOver() (the cursor moves over an object or area)
64. onMouseUp() (the attacker needs the user to click an image)
65. onMouseWheel() (the attacker needs the user to use their mouse wheel)
66. onMove() (the user or attacker needs to move the page)
67. onMoveEnd() (the user or attacker needs to move the page)
68. onMoveStart() (the user or attacker needs to move the page)
69. onOffline() (occurs when the browser transitions from online mode to offline mode)
70. onOnline() (occurs when the browser transitions from offline mode to online mode)
71. onOutOfSync() (interrupt the element's ability to play its media as defined by the timeline)
72. onPaste() (the user must paste, or the attacker executes the execCommand("Paste") method)
73. onPause() (fires when the active element's timeline pauses, including the body element)
74. onPopState() (fires when the user navigates back through session history)
75. onProgress() (fires when a flash animation loads)
76. onPropertyChange() (the user or attacker needs to change an element's property)
77. onReadyStateChange() (the user or attacker needs to change an element's property)
78. onRedo() (the user performs a redo operation)
79. onRepeat() (the event fires once for each repetition of the timeline, excluding the first full cycle)
80. onReset() (the user or attacker resets the form)
81. onResize() (the user resizes the window, or the attacker triggers it automatically with some code such as <SCRIPT>self.resizeTo(500,400);</SCRIPT>)
82. onResizeEnd() (the user resizes the window, or the attacker triggers it automatically with some code such as <SCRIPT>self.resizeTo(500,400);</SCRIPT>)
83. onResizeStart() (the user resizes the window, or the attacker triggers it automatically with some code such as <SCRIPT>self.resizeTo(500,400);</SCRIPT>)
84. onResume() (fires when an element resumes from pause to active, including the body element)
85. onReverse() (if the element has a repeatCount greater than one, this event fires every time the timeline begins to play backward)
86. onRowsEnter() (the user or attacker needs to change a row in the data source)
87. onRowExit() (the user or attacker needs to change a row in the data source)
88. onRowDelete() (the user or attacker needs to delete a row in the data source)
89. onRowInserted() (the user or attacker needs to insert a row into the data source)
90. onScroll() (the user needs to scroll, or the attacker can execute the scrollBy() function)
91. onSeek() (media playback moves to a new position)
92. onSelect() (the user needs to select some text — the attacker can run it automatically using some method such as window.document.execCommand("SelectAll");)
93. onSelectionChange() (the user needs to select some text — the attacker can run it automatically using some method such as window.document.execCommand("SelectAll");)
94. onSelectStart() (the user needs to select some text — the attacker can run it automatically using some method such as window.document.execCommand("SelectAll");)
95. onStart() (fires when a marquee element's loop begins)
96. onStop() (the user needs to click the stop button or leave the page)
97. onStorage() (the storage area changes)
98. onSyncRestored() (user interrupts the element's ability to play its media as defined by the timeline to fire)
99. onSubmit() (requires the attacker or user to submit the form)
100. onTimeError() (the user or attacker needs to set a time property such as dur to an invalid value)
101. onTrackChange() (the user or attacker needs to change the track of the playlist)
102. onUndo() (user went backward in undo transaction history)
103. onUnload() (when the user clicks a link or presses Enter, or the attacker triggers a click event)
104. onURLFlip() (this event fires when an Advanced Streaming Format (ASF) file, played by a HTML+TIME (Timed Interactive Multimedia Extensions) media tag, processes script commands embedded in the ASF file)
105. seekSegmentTime() (this is a method that locates the specified point on the element's segment time line and begins playing from that point. The segment consists of one repetition of the time line including reverse play using the AUTOREVERSE attribute.)
|
