Other nomination

Socket Capable Browser Plugins Result In Transparent Proxy Abuse

Announcement of a paper behind CERT VU#435052. Where a transparent proxy routes by destination host header rather than IP, a socket-capable plug-in such as Flash can open a raw connection and forge that header, reaching any host the proxy can reach. The result is a partial same-origin policy bypass affecting enterprise, hotel and ISP networks.

In the archive

• Nominated for the 2009 Top 10 Web Hacking Techniques

Tags

• flash
• proxy
• sop-bypass
• same-origin-policy
• http
• mitigation
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of its author, first published at the original source. Preserved copies are kept so the citation survives its host.