libinjection: from sqli to xss
Talkat AppSec California 2014 · on Tuesday, 2014-01-28· at 11:30· Track 1, Annenberg Community Beach House, East Pacific Coast Highway·
summary
libinjection claims fast accurate detection of SQLi and now HTML injection XSS it ships on GitHub under a BSD license and already integrates into WAFs and honeypots the SQLi side grows to ~8,000 fingerprints 30 rules 400 unit tests and 85,000 samples the XSS detector tokenizes inputs against the HTML5 state machine reparses in multiple contexts and catches most of 1,600 real samples while noting IE quoting exceptions and parses HTML5 tokenizer at 500k to 1.3M checks per second and available on GitHub BSD license
AI-written summary · about
chapters (28)
- 0:00Intro
- 0:23What's the Goal?
- 1:03What is Libinjection?
- 1:46Why libinjection?
- 2:14Initial Attempt
- 4:10Go Get It!
- 5:09HTML Injection
- 6:01These are attacks against the HTML tokenization algorithm.
- 6:52Javascript Injection
- 7:35Hard Problem
- 8:35Use a HTML Purifier
- 10:32Sanitization Functions
- 11:22Regular Expressions
- 12:28Web Browsers!
- 15:46Opera
- 16:33XSS Detection for The Future
- 16:55Pick Your Battles Not Covering
- 17:52Technique
- 18:18Shifting the Problem
- 19:50HTML5 Tokenization
- 22:08Problematic Tokens
- 22:30Yeah its a blacklist
- 24:25XSS Cheatsheets
- 26:37Attack / Scanners
- 27:18IE Unbalanced Quote
- 27:46Performance
- 28:32Current Status 2014-01-27
- 30:29What do you expect?
related talks
42mFinding Bad Needles On A Worldwide Scale
54mTaking on the King: Killing Injection Vulnerabilities
40mDifferences Between Web Application Scanning Tools when Scanning for XSS and SQLi
23mBye-Bye False Positives: Using AI to Improve Detection
41mNew Methods in Automated XSS Detection
31m360° View of XSS
22mIntegrating Security Measures Throughout Development
38mInjections - 4 Ways of Penetration