Read Time:23 Second

Posted by Jonathan Gregson via Fulldisclosure on Apr 28

Hi Georgi,

As you suggested, this is a CSRF attack. Using such techniques to attack or enumerate local applications has been known
for some time and is a very difficult issue to address. Browsers have done well in preventing malicious _authenticated_
cross-site requests, but as you’ve found, attackers can still use such techniques for enumeration and information

Fortunately, it’s not very practical except in targeted…

Read More

Generated by Feedzy