Other nomination

CSRF token disclosure via iFRAME and CAPTCHA trickery

Lucian Constantin · Computerworld · 3 December 2012

A news report on Sergiu Dragos Bogdan's DefCamp talk: the Yahoo Developer Network YQL console can be framed, showing the victim a session-bound "crumb" token. Same-origin rules stop the attacker reading the frame, so he dressed the crumb up as a CAPTCHA challenge; typing it back authorised YQL queries against the victim's own mail and contacts.

Record

Researcher

Lucian Constantin

Published by

Computerworld

Date

3 December 2012

In the archive

• Nominated for the 2012 Top 10 Web Hacking Techniques

Related sources

• Bug Hunter Finds 'Blended Threat' Targeting Yahoo Web Site

Tags

• csrf
• iframe
• same-origin-policy
• ui-redress
• info-leak
• case-study
• owasp-a01-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of Lucian Constantin, first published at the original source. Preserved copies are kept so the citation survives its host.