Top 10 winner

Mario Heiderich -- Mutation XSS

Mario Heiderich, Jörg Schwenk, Tilman Frosch, Jonas Magazinius and Edward Z. Yang · ACM

Reading innerHTML makes browsers rewrite markup, so a string that passes every server- and client-side XSS filter can be mutated into a live vector. Seven mutations are named - backticks as attribute delimiters, XML namespaces on unknown elements, CSS escapes, entity handling in XML modes - and broke Yahoo! Mail, Roundcube, HTML Purifier and Caja. An 820-byte XMLSerializer shim blocks them.

Record

Researcher

Mario Heiderich, Jörg Schwenk, Tilman Frosch, Jonas Magazinius and Edward Z. Yang

Published by

ACM

In the archive

• Ranked #1 in the 2013 Top 10 Web Hacking Techniques

Related sources

• Paper

Tags

• mutation-xss
• xss
• filter-bypass
• sanitizer-bypass
• dom
• encoding
• css
• mitigation
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Mario Heiderich, Jörg Schwenk, Tilman Frosch, Jonas Magazinius and Edward Z. Yang, first published at the original source. Preserved copies are kept so the citation survives its host.