Later archive addition

JSON hijacking for the modern web

Gareth Heyes · PortSwigger · 25 November 2016

Combines JavaScript Proxy traps with UTF-16BE script decoding to turn cross-origin JSON into undeclared variable names and recover their contents. Browser-specific prototype-chain tricks expose data in Edge, Chrome and Safari. The article also develops an injection-assisted variant without proxies and a CSP bypass, and explains why explicit response charsets prevent the charset attacks.

Record

Researcher

Gareth Heyes

Published by

PortSwigger

Date

25 November 2016

In the archive

• Added to the 2016–17 archive after the original list was published

Related sources

• OWASP London slides
• Demonstration: Edge variables
• Demonstration: second method
• Demonstration: Edge JSON
• Demonstration: Chrome 53
• Demonstration: Safari JSON
• Demonstration: without proxies
• Earlier variable-disclosure research
• Demonstration: multiple variables
• UTF-16BE CSP bypass demo

Tags

• javascript
• charset
• encoding
• info-leak
• sop-bypass
• csp
• owasp-a01-2021
• owasp-a02-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Gareth Heyes, first published at the original source. Preserved copies are kept so the citation survives its host.