Collected research

About CSS Attacks

sirdarckcat · sirdarckcat.blogspot.com

Releases the clickjacking proofs of concept held back from Bluehat v8. Ghost Mirror clones the target page's HTML and hides everything but the button, giving a size-independent cross-browser overlay; Frame Cropping uses two iframes with negative offsets, overflow:hidden and no border. Also covers Flash webcam overlays and a CSS attribute reader, dubbed Cross Site Styling.

Record

Researcher

sirdarckcat

Published by

sirdarckcat.blogspot.com

Topic

Other

In the archive

• Collected in the 2009 research round

Related sources

• BlueHat CSS research
• The Sexy Assassin

Tags

• clickjacking
• ui-redress
• css
• css-injection
• iframe
• flash
• info-leak
• owasp-a03-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of sirdarckcat, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.