Collected research

The Underrated Bugs, Clickjacking, CSS Injection, Drag-Drop XSS, Cookie Bomb...

The Underrated Bugs, Clickjacking, CSS Injection, Drag-Drop XSS, Cookie Bomb, Login+Logout CSRF…

Renwa and @RenwaX23 · Medium · 10 May 2022

Three bug-bounty chains built from bugs usually dismissed as low severity: CSS injection that hides a page and relabels a button so a clickjacked victim confirms an attacker's email; a dragged image whose data is rewritten and passed to jQuery html() for XSS, with a cookie bomb to stop an OAuth code being consumed; and login-logout CSRF that turns self-XSS into takeover.

Record

Document

The Underrated Bugs, Clickjacking, CSS Injection, Drag-Drop XSS, Cookie Bomb, Login+Logout CSRF…

Researcher

Renwa and @RenwaX23

Published by

Medium

Date

10 May 2022

Topic

XSS

In the archive

• Collected in the 2022 research round

Related sources

• Cookie Bomb prerequisite Slides

Tags

• clickjacking
• css-injection
• xss
• csrf
• ui-redress
• cookie
• oauth
• attack-chain
• bug-bounty
• owasp-a01-2021
• owasp-a03-2021
• owasp-a04-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Renwa and @RenwaX23, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 August 2026.