Revisiting XSS Sanitization

on YouTube ↗01h 02m

" summary

Breaks the sanitization of 25 WYSIWYG editors (TinyMCE, CKEditor, Froala, Jive and more) to produce stored XSS on sites including Amazon, GitHub, Twitter and eBay, and earns multiple bounties ($1,000, $11,000) and forces Magento forum posting offline. Delivers concrete vectors — SVG/data URIs, javascript: URIs, CSS expression, backtick and attribute injections, SWF uploads — and builds a sanitizer based on '11 chars + 3 regular expressions' that resists 82,000 attack attempts and is deployed in the mod_security core rule set.

AI-written summary · about

" chapters (6)

1. 0:00Start
2. 7:05Cross-Site Scripting (XSS)
3. 28:30Attacking Attributes in WYSIWYG Editors
4. 32:01Attacking Insert/Edit Link Feature
5. 46:33Developers Comments
6. 56:15General Guideline for XSS Protectio black hat

" related talks

• 33mXXSS: Exotic Cross-Site Scripting vectorsBenedek Gagyi · RuhrJS 2019
• 57mThe Last XSS Defense TalkJim Manico · NDC Porto 2022
• 52mDemystifying Front-End SecurityIlya Verbitskiy · NDC Sydney 2020
• 40mXXSS: Exotic Cross-Site Scripting vectorsBenedek Gagyi · Øredev 2019
• 47mXSS is dead. We just don't get it.Mario Heiderich · OWASP AppSec Europe 2018
• 30mXXSS: Exotic Cross Site Scripting VectorsBenedek Gagyi · revo.js 2019
• 41mThe Last XSS Defense Talk: Why XSS Defense has radically changed in the past 7 yearsJim Manico · OWASP AppSec Europe 2018
• 31m1; mode=attack XSS Attacks By Abusing the XSS FilterMasato Kinugawa · CODE BLUE 2015