Other nomination

Steal History without JavaScript

Jeremiah Grossman · blog.jeremiahgrossman.com

Points at RSnake's rework of CSS history stealing that needs no JavaScript: rather than reading link colour from script, the a:visited rule drives a display: property so the browser itself requests a per-link resource, leaking the visit to the server. Notes SafeHistory as partial mitigation and pdp's improved proof of concept.

Record

Researcher

Jeremiah Grossman

Published by

blog.jeremiahgrossman.com

In the archive

• Nominated for the 2007 Top 10 Web Hacking Techniques

Tags

• css
• xsleak
• info-leak
• side-channel
• deanonymization
• prior-art-extension

This page is the archive's own catalogue record. The research is the work of Jeremiah Grossman, first published at the original source. Preserved copies are kept so the citation survives its host.