Collected research

Stealing User Information Via Automatic Form Filling

ha.ckers.org web application security lab - Archive » Stealing User Information Via Automatic Form Filling

Browser and toolbar autofill features populate fields by name without asking the user, so an XSS payload can inject a hidden form carrying common field names and harvest whatever autofill supplies: name, address, card number, expiry. No social engineering is needed and the form need never be visible.

Record

Document

ha.ckers.org web application security lab - Archive » Stealing User Information Via Automatic Form Filling

Published by

ha.ckers.org

Topic

Other

In the archive

• Collected in the 2006 research round

Tags

• xss
• info-leak
• phishing
• abuse-of-functionality
• dom
• owasp-a03-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of ha.ckers.org, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.