Navigating The Landscape Of Client-Side Request Hijacking On The Web
summary
Claims that client-side request hijacking is widespread and practical: analysis of ~1M pages finds 7.9M API calls, 202,000 verified data flows across 961 sites (~99.6%), and 31,000 DOM clobbering markups; 49 real-world sites yield exploitable flows including Microsoft Azure and Google doubleclick. A detection stack combines jaw static analysis with runtime edges from the Foxon instrumented browser to build Sheriff graphs. Ten request APIs and seven new vulnerability variants are documented; CSP and COOP reduce but do not eliminate risk.
AI-written summary · about
chapters (25)
- 0:00Introduction
- 0:48Web Applications
- 1:31User Input
- 1:55Input Validation
- 3:16Who Should We Trust
- 3:39Authentication Authorization
- 4:18Confused Request Flow
- 5:17CrossSide Request Forgery
- 8:47First Party Requests
- 9:04ClientSide Cerf
- 16:46Information leakage
- 17:41Dclobbering
- 19:40Legacy Feature
- 21:25Request Hijacking In Gmail
- 22:29How To Prevent Request Hijacking
- 24:06How Many Request API Calls Are There
- 25:20JavaScript Analysis Framework JAW
- 28:31PFlow Hybrid Property Graphs
- 29:53Empirical Study
- 30:57Exploitability
- 33:55Dynamic Analysis
- 35:01Business Applications
- 36:58Defenses
- 41:10Summary
- 41:30Questions
related talks
54mEverything You Wanted to Know About Client side CSRF But Were Afraid to Ask
47mKeynote: Request Forgery on the Web - SSRF, CSRF and Clickjacking
33mHacking The Front-End
40mContent Security Policy to the Rescue
35mServer-Side Browsers: Exploring the Web’s Hidden Attack Surface
48mA Weakness In Chrome & A New Hacking Technique
59mWeb Application Security Trends
43mAttacking Modern Web Technologies