Collected research
SurveyMonkey: IP Spoofing
ChrisJohnRiley noticed RFC1918 addresses among SurveyMonkey respondent IPs and traced it to the site trusting the X-Forwarded-For header. Setting that header let him record any IP against a survey response, including foreign ones, and inject a 20-character HTML payload such as an iframe src into the field shown to the survey owner.
Record
- Researcher
- ChrisJohnRiley
- Published by
- Cатсн²² (in)sесuяitу / ChrisJohnRiley
- Date
- Topic
- Other
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of ChrisJohnRiley, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .