Collected research
Pop-Ups in a good-world
Popup windows, popunders and drag or clipboard events are chained to upgrade a self-XSS into an attacker-triggered one. Writing a payload into the victim's clipboard or drag data and then opening the vulnerable page auto-focuses the input, while frame counting and Same Origin Method Execution extend the attack past X-Frame-Options.
Record
- Researcher
- Guilherme Keerok
- Published by
- gccybermonks.com
- Topic
- Other
In the archive
Related sources
- Full proof of concept
- CSS timing proof of concept
- eu 14 Hayak Same Origin Method Execution Exploiting A Callback For Same Origin Policy Bypass wp Whitepaper
Tags
This page is the archive's own catalogue record. The research is the work of Guilherme Keerok, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .