Top 10 winner

BEAST

Thai Duong · Blogger · 25 September 2011

A first-person account of building BEAST. Rizzo's chosen-boundary attack on SSL/TLS CBC was reversed to suit browsers, which needed two records inside one cookie-bearing request; WebSockets and then a Java applet supplied that primitive. A Java same-origin-policy bypass loaded the agent, and optimisation cut decryption of long live cookies to minutes.

Record

Researcher

Thai Duong

Published by

Blogger

Date

25 September 2011

Topic

Crypto

In the archive

• Ranked #1 in the 2011 Top 10 Web Hacking Techniques

Related sources

• BEAST mitigation discussion

Tags

• tls
• https
• cookie
• side-channel
• java
• sop-bypass
• cve
• owasp-a01-2021
• owasp-a02-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Thai Duong, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.