Other nomination

HaXmas: The True Meaning(s) of Metasploit

@todb and Tod Beardsley · Rapid7 Blog · 25 December 2017

Samsung Internet Browser let JavaScript that opened a new tab rewrite that tab's contents after the destination site had loaded, breaking the same-origin policy. An attacker whose page the victim visits can inject arbitrary script into any domain, which the write-up traces from bug report to a shipped Metasploit module.

Record

Researcher

@todb and Tod Beardsley

Published by

Rapid7 Blog

Date

25 December 2017

In the archive

• Nominated for the 2016–17 Top 10 Web Hacking Techniques

Related sources

• Exploit module and review
• Original issue report

Tags

• sop-bypass
• same-origin-policy
• android
• javascript
• tooling
• case-study
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of @todb and Tod Beardsley, first published at the original source. Preserved copies are kept so the citation survives its host.