How would I find/which URI has an embedded ActiveX control??

asked 2021-09-30 01:00:14 +0000

Cityzen727
1

Sorry, I don't have the points to upload the .pcap

I'm looking through the Hypertext Transfer Protocol tree on multiple GET requests and OK responses for 3-4 .htm pages.

How would I identify which page has an embedded ActiveX control?

Thanks in advance!

C727

edit retag flag offensive close merge delete

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2021-09-30 07:55:33 +0000

hugo.vanderkooij
76 ●182 ●4

I would export the pages and use an analyser that is specically good in HTTP analysis. Or if you know the exact text/keyword you can do a free search on you packets.

edit flag offensive delete link

add a comment

answered 2021-09-30 09:07:32 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23790 ●4 ●950 ●227 https://www.wireshark.org

Somewhat difficult as an ActiveX control can be embedded directly in a page with an <object ... >...</object> tag with a classid property (that contains the string "clsid:...") but due to a patent issue (long since resolved) MS couldn't allow folks to do that directly, instead they had to add JavaScript code on the page to "create" the object tag dynamically and thus obscuring the use of an ActiveX object. Often times the JavaScript code would check the browser it was running and only instantiate the object if the browser supported ActiveX.

You can try a filter such as frame contains "<object" and frame contains "clsid:" for a simple text search that works for me on a page known to have an ActiveX control added by JavaScript.