Other nomination

CSRF with MS Word Part II

Michael Daw's CSRF-from-Word technique extended: instead of a remote image, embed CSS references that Word fetches when the document is opened. That works where images failed, leaves no visible cue to the victim, and one .doc can carry many requests, making it a quiet web bug and a CSRF platform.

In the archive

• Nominated for the 2006 Top 10 Web Hacking Techniques

Related sources

• Part 1

Tags

• csrf
• css
• abuse-of-functionality
• prior-art-extension
• info-leak
• detection
• owasp-a01-2021
• owasp-a04-2021
• owasp-a09-2021

This page is the archive's own catalogue record. The research is the work of its author, first published at the original source. Preserved copies are kept so the citation survives its host.