Category Archives: JavaScript

Clickjacking and XSS for reading autocomplete credentials.

Posted on October 26, 2011 by Phil

By combining Cross Site Scripting (XSS) with Clickjacking and JavaScript it is possible to extract passwords and data stored within the browsers Autocomplete cache. Autocomplete is a feature supported by all browsers to cache input field values – it can … Continue reading →

Posted in JavaScript | Tagged , , | Leave a comment

JavaScript and Daylight Savings for tracking users.

Posted on October 2, 2011 by Phil

Each country has their own timezone – although timezones are not generally unique variations in the offset can enable a website using JavaScript to pinpoint your location and operating system to an alarming degree of accuracy. Most countries time differs … Continue reading →

Posted in JavaScript | Tagged , , | Leave a comment

Javascript keylogger in JQuery.

Posted on May 21, 2011 by Phil

I needed to capture someone’s login credentials using cross site scripting. However I had 3 problems. Firstly there was no XSS on the login page, secondly the only XSS was reflected, meaning it only affected the current page and thirdly … Continue reading →

Posted in Exploits, JavaScript | Tagged , , , | Leave a comment