Other nomination

PXSS on long length videos to DOS

Dennis Fisher · Threatpost | The first stop for security news · 4 April 2014

Incapsula traced a DDoS to stored XSS on a major video site: script hidden in a commenter's profile image ran for every viewer and opened a hidden iframe to the attacker's control domain, making each browser issue a request per second at a target. Comments on hundreds of long, popular videos turned visitors into a browser botnet.

Record

Researcher

Dennis Fisher

Published by

Threatpost | The first stop for security news

Date

4 April 2014

In the archive

• Nominated for the 2014 Top 10 Web Hacking Techniques

Tags

• xss
• dos
• iframe
• javascript
• injection
• case-study
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Dennis Fisher, first published at the original source. Preserved copies are kept so the citation survives its host.