Tag Info

New answers tagged


It's potentially a DOS attack, though only for some very specific scenarios. If Alice wants to give Bob access to her Netflix account, but doesn't want to reveal the password she can login to Netflix on Bobs computer. If Bob visits MaliciousLogoutSite.com, he'll get logged out of Netflix even though he didn't intend to. There's also some potential for ...


No potential threats yet. It helps if you want someone to force login. But there is a case. When you find a stored xss or you allow images from external sources in your website page with good number of viewers(such as home page) . You can use it for denial of service attacks


The only threat I see there is someone logging a user out by CSRF to force the victim to enter his credentials again. But this would only be useful if the attacker had a way to capture the credentials. This would require one of these possibilities: The attacker has found a XSS weakness in the targeted website that allows extraction of credentials by ...


Regarding question 2 (How is it possible to create a browser intent, without user interaction, via ads?): If the ad is server as whole HTML, it could use a meta refresh (<meta http-equiv="refresh" content="5; url=http://example.com/">). If JavaScript is allowed, it could use it to redirect current location to an URI of choice. But that's not all, ...

Top 50 recent answers are included