JSON hijacking is a security weakness where a website leaks sensitive data in JSON format. The attacker exploits the JSONP’s cross-domain capabilities to hijack data with a malicious JavaScript code.

The JSON hijacking attack process involves creating a malicious website that lures the victim’s browser to request the target website. Then, the attacker’s JavaScript code is injected into the victim’s page, and the target website loads the JSON response as a JavaScript file. So, the attacker’s code accesses the JSON data to extract sensitive information.

Real-life Examples of JSON Hijacking

An example of a JSON hijacking involved social networking sites that leaked user data via JSNOP endpoints that lacked sufficient security measures. Hackers exploited this weakness to harvest user’s data and perform targeted phishing attacks.

How JSON Hijacking Works

JSON hijacking takes place using the following steps:

JSON Hijacking Prevention Tips