Later archive addition

DOMLeakify: style-attribute ID-existence timing oracle

arkark · 28 December 2023

Five SECCON challenge writeups include DOMLeakify: injected style attributes use Firefox -moz-element() to make costly rendering conditional on a secret DOM ID, exposing it through timing. Other challenges combine parser differences, CSP reporting, prototype pollution, and JavaScript sandbox escapes.

Record

Researcher

arkark

Date

28 December 2023

In the archive

• Added to the 2023 archive after the original list was published

Related sources

• Challenge source and author solvers

Tags

• css-injection
• timing-attack
• xsleak
• dom
• parser-differential
• prototype-pollution
• sandbox-escape
• csp
• owasp-a03-2021
• owasp-a05-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of arkark, first published at the original source. Preserved copies are kept so the citation survives its host.