Top 10 Web Hacking Techniques

2022

The 2022 Top 10 Web Hacking Techniques: all 10 winners and 80 nominated and collected techniques, each with its researcher, summary and preserved source.

80 records · 10 in the top ten · open this year in the interactive archive

The top ten

#1 Account hijacking using "dirty dancing" in sign-in OAuth-flows Frans Rosén
Deliberately breaking an OAuth sign-in flow - an invalid state, a switched response type, a tampered redirect_uri - leaves the code or token in the victim's URL on an error page. The attacker then reads that URL via a…
#2 Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling James Kettle
A browser-issuable POST whose Content-Length the server ignores lets an attacker page desync the victim browser's own connection pool and prepend an arbitrary request, so request smuggling reaches single-server sites…
#3 Zimbra Email - Stealing Clear-Text Credentials via Memcache injection Simon Scannell
Zimbra built Memcached lookup keys from usernames taken out of request URLs without escaping CRLF, so an unauthenticated attacker could inject arbitrary Memcached commands. Overwriting a user's IMAP route entry…
#4 Hacking the Cloud with SAML Felix Wilhelm
A SAML service provider must run attacker-supplied XMLDsig transforms before it knows the signature can be trusted, putting XML canonicalisation, XSLT and their parsers on the pre-authentication attack surface. The talk…
#5 Bypassing .NET Serialization Binders codewhitesec.blogspot.com
A .NET SerializationBinder that validates type names as strings, or returns null when it cannot resolve one, can be bypassed: BinaryFormatter then falls back to its own resolver. An assembly-qualified name parsed…
#6 Making HTTP header injection critical via response queue poisoning James Kettle
Turns a CRLF header injection into a full HTTP desync: the injected headers cleanly terminate the first request and set Connection keep-alive, so a second attacker-controlled request can be appended. That poisons the…
#7 Worldwide Server-side Cache Poisoning on All Akamai Edge Nodes Jacopo Tediosi
Listing Content-Length in the Connection header marks it hop-by-hop, so Akamai's first proxy stripped it and the request body became a second request. The surplus response desynchronised the connection and was served to…
#8 Psychic Signatures in Java @neilmaddog
The Java 15 rewrite of ECDSA verification from C++ into Java dropped the check that signature values r and s are non-zero, so an all-zero signature verifies against any message and any public key. On Java 15 to 18 that…
#9 Practical client-side path-traversal attacks @medi_0ne
Client side path traversal: JavaScript builds a resource URL by concatenating a user-controlled query parameter into the path, so encoded traversal sequences point the request at a different endpoint. Chained with an…
#10 Exploiting Web3’s Hidden Attack Surface: Universal XSS on Netlify’s Next.js Library Sam Curry and @samwcyo
Netlify's ipx image-optimisation route builds its upstream fetch URL from the attacker-controlled X-Forwarded-Proto header, so a full URL ending in a question mark replaces the target entirely. Because the response is…

Also collected

.NET Remoting Revisited Markus Wulftange
.NET Remoting publishes objects over HTTP, named pipes and TCP and deserialises client messages with BinaryFormatter or SoapFormatter. The post shows its security options failing, and how an ObjRef reference, a forged…
{JS-ON: Security-OFF}: Abusing JSON-Based SQL to Bypass WAF Noam Moshe
Appending JSON operators such as @> to a SQL injection payload keeps the statement valid to the database while the firewall's SQL parser, which had no JSON support, stops recognising it as an attack. The payload passes…
A Magic Way of XSS in HTTP/2 tttang.com
Where two domains share one TLS certificate, an HTTP/2 server controlling one of them can use Server Push to push a response for the other, because the connection is authoritative for every name in the certificate. The…
A story of leaking uninitialized memory from Fastly Emil Lerner and @emil_lerner
A bug in the H2O web server's HTTP/3 handling: a RESET_STREAM frame makes the Quicly library forget which byte ranges of a request body actually arrived, so H2O forwards the uninitialised remainder of its receive buffer…
Apache Pinot SQLi and RCE Cheat Sheet Ben Caller
A cheat sheet for injecting into Apache Pinot, an OLAP database whose Calcite-based SQL lacks UNION, stacked queries and information schema. Its OPTION(...) clause is stripped from anywhere in a query, even inside…
Arbitrary File Upload Tricks In Java pyn3rd
Filename normalisation differs across Java upload paths: getSubmittedFileName drops backslashes, Spring StringUtils.cleanPath collapses slash-dot sequences, and commons-io FilenameUtils.getName treats a trailing slash…
Bypass CSP Using WordPress By Abusing Same Origin Method Execution Paulos Yibelo
Every WordPress install exposes a REST endpoint whose _jsonp callback is reflected into a same-origin script response, restricted to word characters and dots. Same Origin Method Execution turns that into script…
Bypassing CSP with dangling iframes Gareth Heyes
A dangling iframe name captures following HTML, including secrets. An attacker-controlled outer frame navigates the victim iframe to about:blank, gains access, and reads the preserved window.name. This extracts data…
Caching the Un-cacheables - Abusing URL Parser Confusions Harel Security Research
URL parser confusion between a CDN and its origin: the caching front end normalises dot segments in a path while the backend does not, so a request to /Job/../Award/x is served by the vulnerable /Job/ handler but cached…
Characterizing the Security of GitHub CI Workflows Igibek Koishybayev, Aleksandr Nahapetyan, Raima Zachariah, Siddharth Muralee, Bradley Reaves, Alexandros Kapravelos and Aravind Machiry
A study of GitHub Actions security against four properties: admittance control, execution control, code control and access to secrets. Across 447,238 workflows it finds 99.8 percent hold read-write repository tokens and…
Counting in Regexes Considered Harmful: Exposing ReDoS Vulnerability of Nonbacktracking Matchers Lenka Turoňová, Lukáš Holík, Ivan Homoliak, Ondřej Lengál, Margus Veanes and Tomáš Vojnar
Nonbacktracking regex engines are assumed immune to ReDoS, but bounded repetition such as (ab){100} forces them into costly simulation of a counting automaton. The authors generate inputs that maximise that cost…
CSRF Resurrections Starring the Unholy Trinity Dongsung Kim
A DEF CON 30 talk arguing that SameSite cookies did not kill CSRF. Chaining three interacting web features, a PWA service worker, the Fetch API and SameSite's own rules, lets cross-site requests reach a target with…
Cypher Query Injection: The New “SQL Injection” We Aren't Aware Of Noy Pearl
Explains Cypher injection in graph databases, including blind extraction, chained LOAD CSV requests that send internal response data to an external endpoint, and APOC procedures. The slides cover Neo4j and RedisGraph…
Deep understand ASPX file handling and some related attack vectors @rskvp93 and rskvp93
Reverse-engineers how IIS compiles ASPX pages into cached DLLs under Temporary ASP.NET Files, including the code generation directory and the eight-character cache key algorithms. An attacker able to write there plants…
Disclosing information with a side-channel in Django Dennis Brinkrolf
Django's dictsort template filter resolved a user-supplied sort key through the full variable-lookup machinery, so an attacker could sort a list of users by an individual character of a field never shown, such as a…
Discovering Domains via a Time-Correlation Attack on Certificate Transparency Arseniy Sharoglazov and @_mohemiv
Servers that auto-renew TLS certificates issue them for all their domains at the same moment, so certificates whose validity timestamps fall within seconds of each other in Certificate Transparency logs likely belong to…
DRAWN APART: A Device Identification Technique based on Remote GPU Fingerprinting Tomer Laor, Naif Mehanna, Vitaly Dyadyuk, Antonin Durey, Pierre Laperdrix, Clémentine Maurice, Yossi Oren, Romain Rouvoy, Walter Rudametkin and Yuval Yarom
DrawnApart fingerprints a device by timing the individual execution units inside its GPU from unprivileged JavaScript; manufacturing variation makes some units consistently faster, producing a signature stable enough to…
ElectroVolt - Pwning Popular Desktop Apps Mohan Sri Rama Krishna, Max Garrett, Aaditya Purani and William Bowling
How an XSS in an Electron renderer is escalated to remote code execution: prototype pollution gadgets leak the internal IPC and remote modules, weak contextIsolation and nodeIntegration settings expose Node APIs, and…
Experimental Security Analysis of the App Model in Business Collaboration Platforms Yunang Chen, Yue Gao, Nick Ceccio, Rahul Chatterjee, Kassem Fawaz and Earlence Fernandes
An analysis of the third-party app model in Slack and Microsoft Teams finding that its access control violates least privilege and complete mediation. A malicious app can eavesdrop on messages it has no permission to…
Exploiting Arbitrary Object Instantiations in PHP without Custom Classes Arseniy Sharoglazov and @_mohemiv
Exploiting PHP arbitrary object instantiation, where an attacker controls the class name and first constructor argument in new $a($b), using only built-in classes. Passing ImageMagick scheme strings such as…
Exploiting Inter-Process Communication in SAP's HTTP Server Martin Doyhenard
SAP's Internet Communication Manager moves HTTP messages to its Java/ABAP backend through fixed-size shared-memory buffers. Oversized requests and a use-after-free on those buffers let an unauthenticated attacker…
Exploiting Java's XML Signature Verification Felix Wilhelm
CVE-2022-34169: an integer truncation bug in the XSLTC JIT compiler that Java reaches during XML signature verification. Because XMLDsig lets a signature embed an XSLT transform, an unauthenticated attacker can overflow…
Exploiting Static Site Generators: When Static Is Not Actually Static assetnote.io
Netlify's IPX image optimizer built the upstream URL from the attacker-controlled X-Forwarded-Proto header, so a value such as https://evil.com/? redirected the fetch off-site and skipped the host allowlist entirely…
Exploring Prompt Injection Attacks Jose Selvi
Explores prompt injection against model-backed applications through imperative instructions and attacker-supplied examples. Contrasting failed and successful payload variants, delimiters and retry behavior shows how…
Exploring the World of ESI Injection Sudhanshu Rajbhar
Edge Side Include injection, where ESI tags reflected into a page are executed by the edge cache rather than the browser. ESI variables and functions such as HTTP_COOKIE, add_header and url_decode let an attacker read…
Finding client-side prototype pollution with DOM Invader Gareth Heyes
Introduces DOM Invader support for finding client-side prototype pollution sources and exploitable gadgets in Burp Suite 2022.6. It scans query, fragment and message inputs, traces polluted values into dangerous sinks…
FRAMESHIFTER: Security Implications of HTTP/2-to-HTTP/1 Conversion Anomalies Bahruz Jabiyev, Steven Sprecher, Anthony Gavazzi, Tommaso Innocenti, Kaan Onarlioglu and Engin Kirda
A grammar-based fuzzer for HTTP/2 that mutates frame sequences and frame contents to find anomalies in how CDNs and reverse proxies convert HTTP/2 requests into HTTP/1 for the origin. Testing 12 proxy technologies…
FuzzOrigin: Detecting UXSS vulnerabilities in Browsers through Origin Fuzzing Sunwoo Kim, Young Min Kim, Jaewon Hur, Suhwan Song, Gwangmu Lee and Byoungyoung Lee
FuzzOrigin fuzzes browsers for universal cross-site scripting, generating HTML and JavaScript that drives frequent navigations and chained event handlers, then detecting when a script executes under an origin it should…
GET /out: Automated Discovery of Application-Layer Censorship Evasion Strategies Michael Harrity, Kevin Bock, Frederick Sell and Dave Levin
Automated search for censorship evasion strategies in application-layer messages rather than TCP/IP headers, so the resulting evasions need no elevated socket privileges to deploy. Applied to HTTP and DNS censorship in…
Hacking Salesforce-backed WebApps blog.hypn.za.net
Attacks on custom web apps that use Salesforce as their backend. Salesforce record IDs are partly sequential so they can be enumerated for IDOR, user-controlled field and filter parameters allow SoQL injection to pull…
Hand Sanitizers in the Wild: A Large-scale Study of Custom JavaScript Sanitizer Functions David Klein, Thomas Barber, Souphiane Bensalim, Ben Stock and Martin Johns
Extracts custom JavaScript sanitizers from observed DOM XSS data flows, then applies symbolic string analysis to generate bypasses and validates them in browsers. SemAttack models sanitizer operations and HTML contexts…
Hertzbleed: Turning Power Side-Channel Attacks Into Remote Timing Attacks on x86 Yingchen Wang, Riccardo Paccagnella, Elizabeth Tang He, Hovav Shacham, Christopher W. Fletcher and David Kohlbrenner
On modern Intel and AMD x86 CPUs, dynamic voltage and frequency scaling makes clock frequency depend on the data being processed, so power side-channel leakage becomes wall-clock timing leakage observable remotely with…
Hijacking service workers via DOM Clobbering Gareth Heyes
Service workers configured from the page, by a query-string parameter or by the innerText of an element fetched with document.getElementById, can be made to pass an attacker host to importScripts(). Injecting an html or…
HTTP/3 connection contamination: an upcoming threat? James Kettle
Browsers coalesce requests for different hostnames onto one HTTP/2 or HTTP/3 connection when the hosts share an IP address and certificate, while a reverse proxy that picks its backend from the first request on a…
Identity Confusion in WebView-based Mobile App-in-app Ecosystems Lei Zhang, Zhibo Zhang, Ancong Liu, Yinzhi Cao, Xiaohan Zhang, Yanjun Chen, Yuan Zhang, Guangliang Yang and Min Yang
Super-apps that host third-party sub-apps in a WebView decide access to privileged native APIs from three identity types: web domain, sub-app ID, and capability. The checks are routinely too broad, so a sub-app or a…
In GUID We Trust Daniel Thatcher
Version 1 UUIDs encode a timestamp, a constant clock sequence and a MAC-derived node ID instead of random data. An attacker who obtains one GUID from an account they control can recover those fields and enumerate every…
Jetty Features for Hacking Web Apps Mikhail Klyuchnikov and @m1ke_n1
A survey of Jetty behaviours useful against apps deployed on it: an error path that lists every deployed context, RCE by dropping a JSP shell, a WAR or a Jetty XML context file into the hot-deploy directory, XSS from…
Leaky Forms: A Study of Email and Password Exfiltration Before Form Submission Asuman Senol, Gunes Acar, Mathias Humbert and Frederik Zuiderveen Borgesius
A crawl of the top 100,000 sites measuring third-party scripts that read email addresses and passwords out of forms before the user submits them. Emails leaked to trackers on 1,844 EU and 2,950 US sites without consent…
Let's Dance in the Cache - Destabilizing Hash Table on Microsoft IIS! Orange Tsai
Three flaws in Microsoft IIS hash tables: a key-splitting bug amplifying hash-flooding until a default install is unresponsive at about 30 connections per second; an output cache that keys on the first duplicate query…
Measuring and Mitigating the Risk of IP Reuse on Public Clouds Eric Pauley, Ryan Sheatsley, Blaine Hoak, Quinn Burke, Yohan Beugin and Patrick McDaniel
Measures how reassigned public-cloud IP addresses receive traffic from residual configurations, including cloud services and applications beyond DNS. The study analyses observed traffic and evaluates IP-allocation…
Melting the DNS Iceberg: Taking over your infrastructure Kaminsky style Timo Longin and Clemens Stockenreitner
A survey of closed, non-publicly-reachable DNS resolvers, reached indirectly by sending mail that forces a target mail server to query an attacker-controlled authoritative nameserver for SPF, DKIM and DMARC records…
Mining Node.js Vulnerabilities via Object Dependence Graph and Query Song Li, Mingqing Kang, Jianwei Hou and Yinzhi Cao
The Object Dependence Graph is a flow- and context-sensitive graph of JavaScript objects and their relations, built by abstract interpretation and queried the way a code property graph is, so one engine finds many…
Miracle - One Vulnerability To Rule Them All Peterjson and @peterjson
Oracle ADF Faces exposes a resource servlet that deserialises attacker-controlled data taken straight from the URL path, giving unauthenticated remote code execution across every Oracle Fusion Middleware product built…
Persistent PHP payloads in PNGs: How to inject PHP code in an image Quentin Roland
PHP code can be hidden inside valid PNG files so it survives server-side image processing: in a comment or appended raw, in the critical PLTE chunk to survive PHP-GD compression, in IDAT pixel data to survive resizing…
Phish in Sheep's Clothing: Exploring the Authentication Pitfalls of Browser Fingerprinting Xu Lin, Panagiotis Ilia, Saumya Solanki and Jason Polakis
Risk-based login systems decide whether to demand a second factor by comparing browser fingerprints, so a phishing page harvesting exactly the attributes a target site measures lets an attacker replay the victim's…
PHP filters chain: What is it and how to use it Rémi Matasse
Chaining PHP php://filter iconv conversions so that each step prepends a chosen character, letting an attacker build arbitrary base64 content byte by byte. This turns any file inclusion or require primitive into remote…
Port Contention Goes Portable: Port Contention Side Channels in Web Browsers Thomas Rokicki, Clémentine Maurice, Marina Botvinnik and Yossi Oren
A port contention side channel running entirely in a web browser: WebAssembly instructions chosen to saturate specific Intel execution ports let a page time contention from code sharing the same SMT core. It gives a 200…
PPE — Poisoned Pipeline Execution Omer Gil and Daniel Krivelevich
Explains poisoned pipeline execution through direct changes to CI configuration and indirect control of scripts, tests or other build inputs. The analysis connects repository permissions and execution triggers to…
Pre-hijacked Accounts: An Empirical Study of Security Failures in User Account Creation on the Web Avinash Sudhodanan and Andrew Paverd
Account pre-hijacking: an attacker knowing only a victim's email address creates or primes an account at a service before the victim signs up, then regains access after the victim registers or recovers it. Five variants…
Probe the Proto: Measuring Client-Side Prototype Pollution Vulnerabilities of One Million Real-world Websites Zifeng Kang, Song Li and Yinzhi Cao
ProbeTheProto instruments a browser to follow joint taint flows, where a property lookup and an assignment meet on a prototype object, then generates inputs that drive a polluted property into a sink. A scan of one…
Problem with Shared Storage’s described use of k-anonymity gtanzer
Shows how the proposed Shared Storage k-anonymity check could reveal cross-site bits when selectURL falls back to an unchecked default URL. Encoding a first-party identifier in that URL links the bit to a user, and…
Rendering Contention Channel Made Practical in Web Browsers Shujiang Wu, Jianjia Yu, Min Yang and Yinzhi Cao
A rendering contention side channel: a page applies stable, self-adjusting pressure to the browser rendering pipeline and times a sequence of frames to detect co-rendering events elsewhere. The SIDER prototype uses it…
Silent Spring: Prototype Pollution Leads to Remote Code Execution in Node.js Mikhail Shcherbakov, Musard Balliu and Cristian-Alexandru Staicu
Prototype pollution lets an attacker write properties onto Object.prototype, and Node.js's own standard library then reads them back as trusted input. Combining CodeQL taint analysis with dynamic property probing, the…
SoK: Exploring Current and Future Research Directions on XS-Leaks through an Extended Formal Model Tom Van Goethem, Gertjan Franken, Iskander Sanchez-Rola, David Dworken and Wouter Joosen
Models XS-Leaks as state changes followed by observable state retrieval, classifying 38 attacks and examining defense gaps. Derives request-count oracles from HTTP connection limits and server rate limits, then studies…
SpEL Casting and Evil Beans wya.pl
Unsafe Spring Expression Language evaluation in the Spring Cloud Gateway actuator: a route filter argument wrapped in a SpEL block is parsed with StandardEvaluationContext, so adding a route and refreshing it runs…
SSRF vulnerabilities caused by SNI proxy misconfigurations invicti.com
SSRF against load balancers that route by the TLS SNI field. When a proxy such as nginx with ssl_preread passes the client-supplied server name straight into proxy_pass, or matches it with a loose regex, an attacker…
Targeted Deanonymization via the Cache Side Channel Mojtaba Zaheri, Yossi Oren and Reza Curtmola
Targeted deanonymization that tells a malicious page whether its visitor holds a given public identifier such as an email address or a Twitter handle. It reads the CPU cache side channel rather than a cross-site leak…
Testability Tarpits: the Impact of Code Patterns on the Security Testing of Web Applications Feras Al Kassar, Giulia Clerici, Luca Compagna, Davide Balzarotti and Fabian Yamaguchi
Certain coding patterns stop static application security testing tools from following data flow, so vulnerabilities stay hidden behind what the authors call testability tarpits. They catalogue over 270 such patterns in…
The Danger of Falling to System Role in AWS SDK Client Francesco Lacerenza and Mohamed Ouad
The AWS SDK credential provider chain silently falls back to the host machine's own IAM role when a client is initialised with nil credentials. A web application whose import-from-S3 feature set credentials to nil in…
The Dangers of Human Touch: Fingerprinting Browser Extensions through User Actions Konstantinos Solomos, Panagiotis Ilia, Soroush Karami, Nick Nikiforakis and Jason Polakis
Browser extensions can be identified by page changes they make only once a user interacts with them, so this work derives user-action templates from static analysis and replays them dynamically to trigger otherwise…
The great SameSite confusion Julien Cretel
SameSite cookies are scoped to the site, meaning the registrable domain or eTLD+1, and not to the origin, so a request from a sibling host or subdomain is same-site and still carries the cookies. A subdomain takeover…
The OWASSRF + TabShell exploit chain @rskvp93
Setting X-OWA-ExplicitLogonUser to an address starting with owa/ makes Exchange strip that prefix when proxying, turning the request into authenticated SSRF onto backend endpoints such as /powershell. Inside the…
The Security Lottery: Measuring Client-Side Web Security Inconsistencies Sebastian Roth, Stefano Calzavara, Moritz Wilhelm, Alvise Rabitti and Ben Stock
A measurement of inconsistency in client-side security policies: the same site can ship different security headers depending on User-Agent, network access method, language or region, so some visitors silently get weaker…
The Underrated Bugs, Clickjacking, CSS Injection, Drag-Drop XSS, Cookie Bomb... Renwa and @RenwaX23
Three bug-bounty chains built from bugs usually dismissed as low severity: CSS injection that hides a page and relabels a button so a clickjacked victim confirms an attacker's email; a dragged image whose data is…
Till REcollapse: : Fuzzing the web for mysterious bugs 0xacb
REcollapse fuzzes single bytes at regex pivot positions - the start and end of an input, either side of separators, and characters that normalisation folds - to get past validation and sanitisation that a later…
Timing-Based Browsing Privacy Vulnerabilities Via Site Isolation Zihao Jin, Ziqiao Kong, Shuo Chen and Haixin Duan
Because Chromium's site isolation gives each site its own renderer process, load timing leaks cross-site state: an attacker page can learn which of a chosen set of sites are already loaded in the browser and which one…
WAF bypasses via 0days terjanq and @terjanq
Content-Type parsing differences between ModSecurity CRS and the backend let an attacker present a form-urlencoded body as XML or JSON, hiding the injection inside an XML comment that the firewall skips. Multipart…
WebSpec Lorenzo Veronese, Benjamin Farinier, Mauro Tempesta, Marco Squarcina and Matteo Maffei
WebSpec models browser behavior in Coq, compiles security invariants into constrained Horn clauses, and checks generated attack traces with machine-checked proofs. It exposes flaws involving Host cookies and domain…
What is prototype poisoning? Prototype bugs explained Christoffer Jerkeby
Prototype poisoning happens when parsing user input lets a __proto__ key set the prototype of the object being built, replacing implicit members such as toString on that object and its children. Consequences include…
Wobfuscator: Obfuscating JavaScript Malware via Opportunistic Translation to WebAssembly Alan Romano, Daniel Lehmann, Michael Pradel and Weihang Wang
Wobfuscator rewrites parts of malicious JavaScript - string literals, array initialisers, function names, calls and control flow - into equivalent WebAssembly modules loaded at runtime. Behaviour is preserved but the…