Other nomination

Hacking CSRF Tokens using CSS History Hack

CSRF tokens carried in URLs can be brute-forced entirely on the client using the CSS visited-link history hack, generating no server traffic for an IDS or WAF to see. A five-character base16 token space was exhausted in under two minutes. Defences given: longer tokens, hidden form fields, per-submission tokens, SafeHistory or private browsing.

In the archive

• Nominated for the 2009 Top 10 Web Hacking Techniques

Related sources

• Independent extension

Tags

• csrf
• css
• side-channel
• info-leak
• javascript
• mitigation
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of its author, first published at the original source. Preserved copies are kept so the citation survives its host.