Web Attacker Model

web security

Definition

Web Attacker Model

In the web attacker model the attacker operates a malicious website evil.com under their own control and lures the victim into visiting it. The attacker cannot connect to bank.com directly — they can only observe what the victim’s browser does.

The attacker is therefore constrained to the cross-origin actions a browser will perform on the victim’s behalf when the victim visits evil.com.

In the Mobile-Web Setting

Obs

In the mobile-web setting the attacker’s malicious website is loaded inside a benign app’s WebView, so the attack surface is no longer only the cross-origin actions a browser performs — it also includes the app’s JS bridge, the web-to-app direction. The benign container that loads the attacker’s site is then flagged a PUA. The inverse model, where the attacker controls the app instead, is the app attacker model.