How does the attacker include input before compression and encryption in CRIME? I have read this article about the CRIME attack against TLS and SPDY. The article says that:


  What is not yet clear is how the attacker is including their input in the source material before it gets compressed and encrypted.


And this is my question: How does the attacker include their input before compression and encryption?

Also, I have the feeling that this is an inconsistency: If the attacker can insert their input before compression and encryption in TLS, isn't it necessary that the attacker is the real client itself?

Please explain what I am missing here in order to understand the CRIME attack.
Malicious JavaScript could trigger calls against any SSL server. Although this JavaScript is not able to actually read the cookie for that server directly, the browser will send that cookie through the SSL tunnel.

The JavaScript will then alter the URL, keeping the server but changing the path or request parameters. In that way it can inject data before compression and try to identify parts of the cookie.