PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Abusing jQuery for CSS powered timing attacks

portswigger.net | research | #browser-security | #portswigger | #side-channel | #red-hat | #timing-attack | #jquery | #css-selectors
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Gareth Heyes turns jQuery's :has and :contains selectors into a timing side-channel, extracting data such as a logged-in user's full name on sites passing location.hash to $().
Published
Collected

Related coverage

research · portswigger.net
What's in a tag name? JavaScript, apparently
This research provides technical context that security teams can use for monitoring and validation.
research · portswigger.net
Hackability inspector
Gareth Heyes presents the Hackability inspector, a browser tool that enumerates JavaScript objects and flags security-relevant properties like cross-domain leaks and Java bridges.
research · portswigger.net
DOM based AngularJS sandbox escapes
Gareth Heyes develops a DOM-based AngularJS sandbox escape in the previously unexploitable orderBy filter, tracing the framework's sandbox history and exploit development.
research · portswigger.net
Evading CSP with DOM-based dangling markup
Gareth Heyes evades restrictive CSP and XSS Auditor with DOM-based dangling markup, using base target and form elements to leak page contents via window.name.
research · portswigger.net
CSS:the bomb inside your inbox
PortSwigger breaks webmail CSS sanitizers to cross trust boundaries, exfiltrate tokens, control AI browsers by email and steal passwords, with attacks spanning Yahoo, Fastmail, ProtonMail and Gmail.
research · portswigger.net
CRLF-Powered Desync Attacks: Beheading HTTP Streams
PortSwigger turns HTTP header injection into a desync worm, with novel methods that shift IP- and connection-locked desyncs into the victim's browser to create XSS and steal HTTPOnly cookies.
Back