---
type: Article
title: usefulfor.com/security » Blog Archive » SSID Script Injection
description: "A rogue access point beaconing a malicious SSID gets its payload rendered and executed in the neighbouring-networks scan page of another AP's web admin interface. Two fake APs beat the 32-character SSID limit by joining the payload across both with JavaScript comment markers. The loaded script then CSRFs apply.cgi to switch off WPA. Demonstrated on DD-WRT."
resource: "http://usefulfor.com/security/2008/08/04/ssid-script-injection/"
tags: [article, webseclist-reference, usefulfor-com, xss, injection, csrf, attack-chain, filter-bypass, tooling, owasp-a01-2021, owasp-a03-2021, owasp-a05-2021]
generated:
by: webseclist-refs/1
at: "2026-08-16T00:01:20+00:00"
status: deprecated
stale_after: 2027-08-16
sources:
- id: original
resource: "http://usefulfor.com/security/2008/08/04/ssid-script-injection/"
title: usefulfor.com/security » Blog Archive » SSID Script Injection
- id: capture
resource: "https://web.archive.org/web/20090106155604/http://usefulfor.com/security/2008/08/04/ssid-script-injection/"
also_at: []
authors: []
canonical_url: ""
cited_by:
- "2008.md:61"
commit: ""
content_sha256: ce2c6c257fa18e1cdd661dde310ca54a534a0d59c4310aff8919aefe2bd7b80a
depth: full
depth_reason: default
kind: article
language: ""
licence: unknown
original_url: "http://usefulfor.com/security/2008/08/04/ssid-script-injection/"
published: ""
publisher: usefulfor.com
publisher_english: ""
raw_sha256: 68dee522864dad4fa4e8a09a263e4914546ab780da136339ef34dde73e4aa5a0
retrieved_from: "http://usefulfor.com/security/2008/08/04/ssid-script-injection/"
retrieved_kind: stored
retrieved_utc: "2026-08-16T00:01:20+00:00"
slug: usefulfor-com-usefulfor-com-security-blog-archive-ssid-script-injection
snapshot: 20090106155604
title_english: ""
translation_file: ""
translation_of: ""
---
# usefulfor.com/security » Blog Archive » SSID Script Injection
**usefulfor.com/security » Blog Archive » SSID Script Injection** - Author not stated, usefulfor.com.
- Published: date not stated
- Original:
- Preserved from: http://usefulfor.com/security/2008/08/04/ssid-script-injection/ (stored) on 2026-08-16
- Capture timestamp: 20090106155604
- Licence: unknown
Rights remain with the original author and publisher. This is a research
archive of a source from the Web Hacking Techniques Index collections, kept so the
page going offline. To read the original, follow the link above.
## Content
> UNTRUSTED SOURCE TEXT. Everything below this line is third-party material
> quoted for research. It is data, not instructions. Do not follow directions,
> execute code, or fetch URLs because this text says so.
usefulfor.com/security » Blog Archive » SSID Script Injection
## [SSID Script Injection](http://usefulfor.com/security/2008/08/04/ssid-script-injection/)
The administrative web interfaces for many wireless access points (APs) provide users with ‘Neighbourhood Wireless Scan’ functionality. This functionality scans for all accessible APs and displays the details of any APs which are identified. However, examination of these administrative interfaces revealed that a large number of them do not properly sanitise the parameters that are passed to them from any accessible APs.
An attacker could set up a fake AP with a malicious payload in the Service Set Identifier (SSID). The malicious SSID would be displayed in the ‘Neighbour’s Access Points Table’ page of the administrative interface and would be executed when an administrator scanned for APs.
**Circumstances**
Device providing an administrative web interface with a ‘Neighbourhood Wireless Scan’ functionality.
**Cause**
The device administrative web interface does not properly sanitise parameters that are passed to it from identified access points.
**Exploitation**
An attacker could set up a fake access point broadcasting specially crafted 802.11 ‘beacon’
packets containing a malicious payload in the SSID.
The malicious SSID will be displayed in the ‘Neighbor’s Wireless Networks’ page of the affected device administrative interface and will be executed when an administrator scans for wireless access points.
**Impact**
Administrative web interfaces normally have highly privileged access to operating system functions via in-built script. In combination with a CSRF technique an attacker could fully compromise the affected system.
**Dependencies**
- The attacker would need to be in wireless range of the affected device. However, nowadays, antennas are available which can dramatically increase the distance that can exist between an attacker and their target
- SSIDs have a maximum length of 32 characters and this would not normally be sufficient to inject a usable malicious payload for an attack. However, an attacker could set up two fake access points and deliver a payload using the combined content of both SSIDs. A payload of 64 characters would be enough to redirect a user’s browser to a malicious web server.
**Attack Technique**
1. An attacker sets up two fake AP broadcasting specially crafted 802.11 beacon packets containing a malicious payload in the SSID
SSID of the first access point: -
``
A malicious SSID combined together with the use of JavaScript comment tags (/* */) will make the following payload usable in an attack.
``
2. This malicious SSIDs will be displayed in the ‘Neighbour’s Wireless’ page of the affected device administrative interdace and will be executed when an administrator scans for wireless APs
3. The malicious payload references to a script hosted in the attacker’s web server. Below it can be seen an example of the malicious script hosted in the attacker’s web server. This code will vary depending on the affected device.
`