Collected research

Crippling HTTPS with Unholy PAC

Black Hat USA 2016

An attacker on a shared network forces a victim's browser or OS to load a hostile proxy auto-config file, whose JavaScript is handed the full URL of every request including HTTPS ones, leaking paths and the credentials or session tokens carried in them.

Record

Document

Black Hat USA 2016

Published by

blackhat.com

Topic

HTTP

In the archive

• Collected in the 2016–17 research round

Related sources

• Crippling HTTPs With Unholy PAC
• AppSecIL 2016 - Crippling HTTPS with unholy PAC - Amit Klein

Tags

• info-leak
• proxy
• https
• tls
• javascript
• dos
• owasp-a02-2021

This page is the archive's own catalogue record. The research is the work of blackhat.com, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 August 2026.