Off-path TCP injection attacks

Yossi Gilad*, Amir Herzberg

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review

22 Scopus citations


We present practical off-path TCP injection attacks for connections between current, nonbuggy browsers and Web servers. The attacks allow Web-cache poisoning with malicious objects such as spoofed Web pages and scripts; these objects can be cached for a long period of time, exposing any user of that cache to cross-site scripting, cross-site request forgery, and phishing attacks. In contrast to previous TCP injection attacks, we do not require MitM capabilities or malware running on the client machine. Instead, our attacks rely on a weaker assumption, that the user only enters a malicious Web site, but does not download or install any application. Our attacks exploit subtle details of the TCP and HTTP specifications, and features of legitimate (and very common) browser implementations. An empirical evaluation of our techniques with current versions of browsers shows that connections with most popular Web sites are vulnerable. We conclude this work with practical client- and server-end defenses against our attacks.

Original languageAmerican English
Article number13
JournalACM Transactions on Information and System Security
Issue number4
StatePublished - Apr 2014
Externally publishedYes


  • Browser security
  • Web and network security


Dive into the research topics of 'Off-path TCP injection attacks'. Together they form a unique fingerprint.

Cite this