Collected research

Subverting AJAX

Stefano Di Paola and Giorgio Fedon · fahrplan.events.ccc.de

Di Paola and Fedon's 23C3 paper on attacking AJAX applications. Prototype Hijacking overrides the JavaScript prototypes an application relies on, so injected code silently intercepts and rewrites every XMLHttpRequest the page makes. From there they build universal cross-site scripting and a persistent compromised session that survives navigation inside the application.

Record

Researcher

Stefano Di Paola and Giorgio Fedon

Published by

fahrplan.events.ccc.de

Format

Whitepaper

Topic

Other

In the archive

• Collected in the 2006 research round

Related sources

• 23C3: Subverting AJAX

Tags

• javascript
• dom
• cache-poisoning
• request-smuggling
• response-splitting
• sop-bypass
• xss
• proxy
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Stefano Di Paola and Giorgio Fedon, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.