Other nomination

The Underrated Bugs, Clickjacking, CSS Injection, Drag-Drop XSS, Cookie Bomb...

Renwa and @RenwaX23 · Medium · 10 May 2022

Three bug-bounty chains built from bugs usually dismissed as low severity: CSS injection that hides a page and relabels a button so a clickjacked victim confirms an attacker's email; a dragged image whose data is rewritten and passed to jQuery html() for XSS, with a cookie bomb to stop an OAuth code being consumed; and login-logout CSRF that turns self-XSS into takeover.

Record

Researcher

Renwa and @RenwaX23

Published by

Medium

Date

10 May 2022

In the archive

• Nominated for the 2022 Top 10 Web Hacking Techniques

Related sources

• Cookie Bomb prerequisite

Tags

• clickjacking
• css-injection
• xss
• csrf
• ui-redress
• cookie
• oauth
• attack-chain
• bug-bounty
• owasp-a01-2021
• owasp-a03-2021
• owasp-a04-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Renwa and @RenwaX23, first published at the original source. Preserved copies are kept so the citation survives its host.