Abusing Bleeding Edge Web Standards for Appsec Glory

on YouTube ↗43m

" summary

Built a tiny library that adds an X-SRI-fallback attribute so third‑party scripts can fallback to a local copy (SRI fallback), demonstrates injecting CSP via meta tags to remove unsafe‑inline after preload (CSP meta hardening), and shows an HPKP pattern that intentionally rekeys to brick server connections so browsers serve a cached service‑worker copy (HPKP suicide). Demos include a Chrome same‑origin SRI caching bug that nets ~$2k, a 32‑subdomain HPKP “supercookie” reconstructing a 32‑bit ID, and mitigation notes: max‑age capped ~60 days, CAA records, and Let’s Encrypt rate limits (5–20/week).

AI-written summary · about

" chapters (11)

1. 0:00Start
2. 3:47Content Security Policy
3. 6:34Ssri Fallback
4. 9:06Csp Metal Hardening
5. 17:40Browser Code Signing
6. 22:50Web Content Gateways
7. 25:05User Tracking
8. 25:17Prereqs
9. 25:53Rapid Key Rotation
10. 26:22General Setup
11. 38:55Mitigations for Hosts

" related talks

• 59mThe Final Frontier: Security APIs in Modern BrowsersChristian Wenz · NDC Oslo 2024
• 40mHostile JavaScript: Attacking and Defending the BrowserTodd H. Gardner · NDC London 2023
• 33mHacking The Front-EndAlex Sexton · Full Stack Fest 2015
• 23mJavaScript attack surfaceDavit Karapetyan · JavaScript Summit Armenia 2023
• 18mWriting an (in)secure webappAdam Baldwin · JSConf US 2011
• 40mContent Security Policy to the RescueDheeraj Joshi · PHP UK Conference 2018
• 44mCache Me If You Can: Messing with Web CachingLouis Dion-Marcil · NorthSec 2019
• 42mModern web application bugsErlend Oftedal · NDC Sydney 2018