Other nomination
Exploitation of "Self-Only" Cross-Site Scripting in Google Code
Google Code’s Maps example executed XSS only after a user entered a payload. Amol Naik combined HTML5 drag-and-drop with clickjacking: a game placed an invisible vulnerable frame beneath draggable content, inserting attacker-chosen script into its input and tricking the victim into pressing Go. The full payload transfers cookies to an attacker URL.
Record
- Researcher
- AMol NAik
- Date
In the archive
Related sources
Tags
This page is the archive's own catalogue record. The research is the work of AMol NAik, first published at the original source. Preserved copies are kept so the citation survives its host.