Collected research

DOMLeakify: style-attribute ID-existence timing oracle

SECCON CTF 2023 Finals: Author Writeups

arkark · blog.arkark.dev · 28 December 2023

Five SECCON challenge writeups include DOMLeakify: injected style attributes use Firefox -moz-element() to make costly rendering conditional on a secret DOM ID, exposing it through timing. Other challenges combine parser differences, CSP reporting, prototype pollution, and JavaScript sandbox escapes.

Record

Document

SECCON CTF 2023 Finals: Author Writeups

Researcher

arkark

Published by

blog.arkark.dev

Date

28 December 2023

Topic

Browser

In the archive

• Collected in the 2023 research round

Related sources

• my-ctf-challenges

Tags

• css-injection
• timing-attack
• xsleak
• dom
• parser-differential
• prototype-pollution
• sandbox-escape
• csp
• owasp-a03-2021
• owasp-a05-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of arkark, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 September 2026.