Top 10 winner

Million Browser Botnet

Jeremiah Grossman and Matt Johansen · WhiteHat Security

Grossman and Johansen show ad networks will run arbitrary attacker JavaScript, so a $0.15 CPM buy rents a million browsers with no exploit or malware. The rented browsers do CSRF, login detection, deanonymisation, intranet scanning, hash cracking and application-level DDoS; a connection-limit bypass using ftp:// image URLs lifts 6 requests per host to about 300.

Record

Researcher

Jeremiah Grossman and Matt Johansen

Published by

WhiteHat Security

Format

Slides

In the archive

• Ranked #7 in the 2013 Top 10 Web Hacking Techniques

Related sources

• Video
• Briefing
• Talk recording
• Talk recording
• Talk recording

Tags

• csrf
• xss
• clickjacking
• dos
• javascript
• info-leak
• owasp-a01-2021
• owasp-a03-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of Jeremiah Grossman and Matt Johansen, first published at the original source. Preserved copies are kept so the citation survives its host.