Other nomination

Large-Scale Analysis of Style Injection by Relative Path Overwrite - www2018rpo_paper.pdf

Sajjad Arshad, Seyed Ali Mirheidari, Tobias Lauinger, Bruno Crispo, Engin Kirda and William Robertson

Relative Path Overwrite makes a page load itself as its own stylesheet by exploiting the different ways browsers and servers resolve relative paths, so a plain text injection becomes CSS injection with no script sink needed. A crawl of the Alexa Top 10,000 found about 9 percent of sites with a vulnerable page, a third of those exploitable, enabling scriptless secret exfiltration.

Record

Researcher

Sajjad Arshad, Seyed Ali Mirheidari, Tobias Lauinger, Bruno Crispo, Engin Kirda and William Robertson

Format

Whitepaper

In the archive

• Nominated for the 2018 Top 10 Web Hacking Techniques

Tags

• css-injection
• css
• url-parsing
• info-leak
• injection
• large-scale-scan
• measurement-study
• prior-art-extension
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Sajjad Arshad, Seyed Ali Mirheidari, Tobias Lauinger, Bruno Crispo, Engin Kirda and William Robertson, first published at the original source. Preserved copies are kept so the citation survives its host.