Collected research

Exploitation of "Self-Only" Cross-Site Scripting in Google Code

Exploitation of “Self-Only” Cross-Site Scripting in Google Code

AMol NAik · amolnaik4.blogspot.com · 22 March 2011

Google Code’s Maps example executed XSS only after a user entered a payload. Amol Naik combined HTML5 drag-and-drop with clickjacking: a game placed an invisible vulnerable frame beneath draggable content, inserting attacker-chosen script into its input and tricking the victim into pressing Go. The full payload transfers cookies to an attacker URL.

Record

Document

Exploitation of “Self-Only” Cross-Site Scripting in Google Code

Researcher

AMol NAik

Published by

amolnaik4.blogspot.com

Date

22 March 2011

Topic

XSS

In the archive

• Collected in the 2011 research round

Related sources

• Make Profit with UI Redressing

Tags

• xss
• clickjacking
• ui-redress
• iframe
• javascript
• bug-bounty
• case-study
• owasp-a03-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of AMol NAik, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.