PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

JSON hijacking for the modern web

portswigger.net | research | #web-security | #proxy | #json-hijacking | #edge | #cross-origin | #utf-16be
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Gareth Heyes revives cross-domain JSON hijacking with JS proxies that capture undefined variables, plus an Edge bypass via Object.setPrototypeOf. A UTF-16BE charset trick makes JSON arrays stealable.
Published
Collected

Related coverage

research · portswigger.net
Making HTTP header injection critical via response queue poisoning
How a path-based header injection was upgraded into critical response queue poisoning: injecting Connection: keep-alive and a smuggled request poisons other users' responses, earning a $12,500 bounty.
research · portswigger.net
Bypassing AngularJS bind HTML
Gareth Heyes abuses the SVG use element to include cross-origin SVG on legacy Edge, achieving script execution that bypasses AngularJS ng-bind-html in versions before 1.5.0.
research · portswigger.net
Bypassing CSP with policy injection
Gareth Heyes injects directives into PayPal's CSP via a token parameter in report-uri, dropping Edge's whole policy with a stray semicolon and overriding Chrome's script-src for a $900 bounty.
research · portswigger.net
Attacking and defending JavaScript sandboxes
Attacking and defending JavaScript sandboxes: with-statement breakouts, prototype tampering and generator constructors defeat naive proxy sandboxes; checkSyntax and a hardened design are proposed.
research · portswigger.net
XS-Leak: Leaking IDs using focus
Gareth Heyes leaks element IDs cross-domain by abusing URL fragment scrolling and focus events in an iframe, brute-forcing IDs with just a single page load.
research · portswigger.net
Edge XSS filter bypass
Gareth Heyes explains an unfixed Edge XSS filter bypass combining a legacy IE location-object trick with ES6 computed property names to obfuscate toString/valueOf. Reported to Microsoft in 2015.
Back