I am little confused about this matter. By simply writing a JavaScript code we can go through our browser history and identify visited links. It is fine. But how an attacker use this to identify a victim's history. Essentially, the code should have to be executed on the victim's browser.

I know that there are XSS attack methods, persistent, non-persistent, DOM based etc. Should an attacker use one of these methods? Or is there another way? Can anybody give sample code?

Although, here (XSS attacks cross-site scripting exploits and defense-V et al) the attacking method (history stealing) is clear, how an attacker receive the history is not clear..I am interested in how really attacker receives the history in formation gathered from the code.For an example, in cookie stealing it is sent through a url to the attacker.likewise...

Any help is appreciated.

  • This post explains it very nicely. Jul 3, 2014 at 3:46
  • thanks Rahil Arora, found many other things via your link
    – AnoAPI
    Jul 20, 2014 at 14:36

1 Answer 1


Michal Zalewski aka lcamtuf made some interesting posts recently and showed some pocs and explanation on how to do it with modern browsers:

very impressive research imho

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .