Other nomination

Hacking without 0days: Drive-by Java

pdp

A cryptographically signed Java applet gets full desktop privileges from the browser once the user clicks through one dialog, with no vulnerability involved. pdp argues the applet name and certificate CN can be forged to make the prompt look legitimate, giving roughly a coin-flip success rate, and that this beats signed JavaScript, browser extensions or a downloaded executable for reliability.

Record

Researcher

pdp

In the archive

• Nominated for the 2007 Top 10 Web Hacking Techniques

Tags

• java
• abuse-of-functionality
• sandbox-escape
• privilege-escalation
• rce
• tooling
• phishing
• owasp-a01-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of pdp, first published at the original source. Preserved copies are kept so the citation survives its host.