Skip to content
Abusing jQuery for CSS powered timing attacks
portswigger.net | research | #browser-security | #portswigger | #side-channel | #red-hat | #timing-attack | #jquery | #css-selectors
Summary
Gareth Heyes turns jQuery's :has and :contains selectors into a timing side-channel, extracting data such as a logged-in user's full name on sites passing location.hash to $().
- Published
- Collected