Other nomination

Google Maps XSS (by fiddling with Protobuf)

Marin Moulinier · Medium · 24 April 2017

Google Maps encodes its URL and AJAX parameters in an undocumented text form of Protobuf. Reverse-engineering it with a Chrome debugger script and a Qt request editor exposed a tile format served as Content-Type text/html with encryption and compression switchable off, so attacker-chosen marker text executed as script on www.google.com; base64 field encoding evaded browser XSS filters.

Record

Researcher

Marin Moulinier

Published by

Medium

Date

24 April 2017

In the archive

• Nominated for the 2016–17 Top 10 Web Hacking Techniques

Related sources

• Research toolkit

Tags

• xss
• filter-bypass
• content-type
• mime
• url-parsing
• bug-bounty
• tooling
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Marin Moulinier, first published at the original source. Preserved copies are kept so the citation survives its host.