logo
logo
Sign in

New Attack "XSSJacking" Combines Clickjacking, Pastejacking, and Self-XSS

avatar
Stephanie Bond
New Attack "XSSJacking" Combines Clickjacking, Pastejacking, and Self-XSS

XSSJacking can help attackers reach sensitive information for which they would normally need a more complex security flaw, such as a stored XSS (Cross-Site Scripting) or CSRF (Cross-Site Request Forgery), issues which most websites tend to fix when reported.

Clickjacking is a technique that fools users into taking actions they didn't intend to.

For example, an attacker can place various buttons on a malicious website.

XSSJacking chains together three attack techniques

Here is where the second technique comes in, called Self-XSS, which is a type of XSS that typically can only be triggered by a user typing in an XSS payload which triggers on themselves.

For example, if the attacker aligns his iframe, so the user interacts with a form field on the legitimate website, the user can insert text into that field without even knowing.

collect
0
avatar
Stephanie Bond
guide
Zupyak is the world’s largest content marketing community, with over 400 000 members and 3 million articles. Explore and get your content discovered.
Read more