Collected research

Slideshare

Million Browser Botnet

Jeremiah Grossman and Matt Johansen · slideshare.net

Grossman and Johansen show that buying ordinary display-ad impressions is enough to run JavaScript in a million browsers at once. The ad-delivered code performs CSRF, login detection, intranet probing, distributed hash cracking and application-level DDoS, bypassing the six-connections-per-host limit with image loops. They tested it live for cents per thousand impressions.

Record

Document

Million Browser Botnet

Researcher

Jeremiah Grossman and Matt Johansen

Published by

slideshare.net

Format

Slides

Topic

Other

In the archive

• Collected in the 2013 research round

Tags

• csrf
• javascript
• dos
• clickjacking
• info-leak
• iframe
• attack-chain
• owasp-a01-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of Jeremiah Grossman and Matt Johansen, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.