New Methods in Automated XSS Detection
summary
Claim is that automated XSS detection no longer relies on static payload signatures but on traced character tables built by mapping input to output and testing which characters survive filters. A prototype uses one unique slug per field, an automated browser to inspect the DOM, and generates dynamic custom XSS exploits including stored cases; real testing finds issues across dozens of domains (Yahoo example shows ~17) and demos validate by checking assigned variables rather than external callbacks.
AI-written summary · about
chapters (27)
- 0:00Introduction
- 0:57Overview
- 1:32State of Automated XSS Detection
- 2:45Key Idea
- 2:58History
- 5:21Different Syntax
- 6:14Techniques
- 6:32Payload Slam
- 6:55Signature Bass
- 7:26completeness
- 8:00string transformation
- 13:00unique slugs
- 14:59sandwich method
- 15:42detection logic
- 16:52trace
- 17:25real life example
- 19:20browser considerations
- 19:44key takeaways
- 20:17practice
- 20:29input output
- 21:00getpost
- 21:19dom
- 22:52dynamic
- 24:28dynamic payload
- 24:55dynamic exploit
- 32:04bash shell
- 33:17should deploy
related talks
31m360° View of XSS
42mFinding Bad Needles On A Worldwide Scale
47mXSS is dead. We just don't get it.
55mCall To Arms: A Tale of the Weaknesses of Current Client-Side XSS Filtering
40mClient-Side Protection Against DOM-Base...
01h 01mClient-Side Protection Against DOM-Based XSS Done Right (tm)
41mThe Last XSS Defense Talk: Why XSS Defense has radically changed in the past 7 years
33mXXSS: Exotic Cross-Site Scripting vectors