Other nomination

Who Are You? A Statistical Approach to Protecting LinkedIn Logins(CSS UI Redressing Issue)

Jovon Itwaru · LinkedIn

LinkedIn publishing platform stripped dangerous tags but allowed the class attribute through, so an author could point a link at a site-hosted CSS class that stretches an element across the whole page. The invisible full-page link turns any click on the article into navigation to an attacker-chosen phishing or malware site.

Record

Researcher

Jovon Itwaru

Published by

LinkedIn

In the archive

• Nominated for the 2015 Top 10 Web Hacking Techniques

Related sources

• Play Framework security advisory
• Netty patch and discussion

Tags

• ui-redress
• clickjacking
• css
• filter-bypass
• sanitizer-bypass
• open-redirect
• bug-bounty
• case-study
• owasp-a04-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Jovon Itwaru, first published at the original source. Preserved copies are kept so the citation survives its host.