Other nomination

Google Drive SSO Phishing

Ericka Chickowski · Dark Reading

Phishing pages were hosted on Google Drive so the link and its HTTPS certificate look like Google own infrastructure, and the page JavaScript was obfuscated so scanners could not read the HTML or rely on IP blacklists. Harvested Google single sign-on credentials were sent to a separate third-party domain.

Record

Researcher

Ericka Chickowski

Published by

Dark Reading

In the archive

• Nominated for the 2015 Top 10 Web Hacking Techniques

Tags

• sso
• filter-bypass
• javascript
• case-study
• owasp-a05-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Ericka Chickowski, first published at the original source. Preserved copies are kept so the citation survives its host.