Question

There is a page: http://renren.com/echo (not real) that will return JSON style data like:

{"candidate":[{"id":251574647,"name":"Jack"}]}  

Now I’m at http://my-server.com and I’d like to do a cross domain Ajax request.
Due to the page at http://renren.com have to be log-in ed to view, I can’t use server proxy.
The returned JSON data doesn’t have a function call or assignment, so I can’t use JSONP.
I doesn’t have the right to modify the page at renren.com. What can I do in this condition?

Answer 1

The technique described by Brian Chess et. al. in the following paper might be of use in this case. In short you override the javascript setter that is used to process the incoming JSON.

https://www.fortify.com/downloads2/public/JavaScript_Hijacking.pdf

When the JSON array arrives on the
client, it will be evaluated in the
context of the malicious page. In
order to witness the evaluation of the
JSON, the malicious page has redefined
the JavaScript function used to create
new objects. In this way, the
malicious code has inserted a hook
that allows it to get access to the
creation of each object and transmit
the object’s contents back to the
malicious site.