Other nomination

Slideshare

Jeremiah Grossman and Matt Johansen · slideshare.net

Grossman and Johansen show that buying ordinary display-ad impressions is enough to run JavaScript in a million browsers at once. The ad-delivered code performs CSRF, login detection, intranet probing, distributed hash cracking and application-level DDoS, bypassing the six-connections-per-host limit with image loops. They tested it live for cents per thousand impressions.

Record

Researcher

Jeremiah Grossman and Matt Johansen

Published by

slideshare.net

Format

Slides

In the archive

• Nominated for the 2013 Top 10 Web Hacking Techniques

Tags

• csrf
• javascript
• dos
• clickjacking
• info-leak
• iframe
• attack-chain
• owasp-a01-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of Jeremiah Grossman and Matt Johansen, first published at the original source. Preserved copies are kept so the citation survives its host.