Collected research
Forget sidejacking, clickjacking, and carjacking: enter "Formjacking"
Forget Sidejacking, Clickjacking, and Carjacking: Enter Formjacking
Formjacking, found by Jerry Hoff while testing AntiSamy. An injected self-closing <form/> tag makes FF3 and IE7 ignore the real <form> that follows, so every input on the page submits to the attacker. AntiSamy's tag balancing turned the attacker's unclosed opening tag into the self-closed form that triggers it, alongside the same quirk for <b/> and <i/>.
Record
- Document
- Forget Sidejacking, Clickjacking, and Carjacking: Enter Formjacking
- Researcher
- Arshan Dabirsiaghi
- Published by
- i8jesus.com
- Topic
- Browser
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Arshan Dabirsiaghi, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .