Hacker News new | past | comments | ask | show | jobs | submit login
Google YOLO clickjacking (2018) (innerht.ml)
142 points by _Microft on Jan 29, 2020 | hide | past | favorite | 13 comments



> Update. Shortly after thie article was published, Google silently prevented my domain from using the API

That will certainly make the problem go away Google ;)


Security reports at google are the same as any user interaction: they blow you off until you prove your point on Hacker News



Hey HN! I really enjoy this type of App Security, anyone know any blogs devoted to this? Or any other places to learn more tricks like this?


You might check out writeups for CTF challenges in the web category.

Also check out the Youtube channel LiveOverflow. A lot of the stuff is binary exploitation, but some is web.

https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w



You may want to edit your comment so the links are not inside a code block (and thus clickable). Thanks.


Updated accordingly. :)


Unenumerated


Are you saying there's a blog named Unenumerated that has stuff like this? I can't find it.


Obviously related to the Facebook comment jacking post from yesterday: https://news.ycombinator.com/item?id=22176180


I feel like the cookie button is shady AF


This is definitely a grey hat blog post.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: