Collected research
Dancer in the Dark: Synthesizing and Evaluating Polyglots for Blind Cross-Site Scripting
Addresses blind cross-site scripting, where injected input reaches an internal backend that returns no feedback, leaving conventional detection with nothing to observe. The paper synthesises polyglot payloads that execute across all common injection contexts; seven of them suffice to cover a state-of-the-art XSS testbed, and exploitation is confirmed through blind code execution. A study of the Tranco Top 100,000 sites found 20 vulnerabilities in 18 backend systems.
Record
- Researcher
- Robin Kirchner, Jonas Möller, Marius Musch, David Klein, Konrad Rieck and Martin Johns
- Published by
- usenix.org
- Topic
- XSS
In the archive
Related sources
Tags
This page is the archive's own catalogue record. The research is the work of Robin Kirchner, Jonas Möller, Marius Musch, David Klein, Konrad Rieck and Martin Johns, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .