Practicing Safe Script
summary
Argues that content injection is the practical attack vector — demonstrates the Sammy worm infecting ~60% of MySpace and shows client-side persistence like evercookie that survives cookie clearing. Covers concrete attacks: CSS visited and timing attacks via requestAnimationFrame, SVG+OCR cross‑domain text exfiltration, CSRF leakage via attribute selectors. Recommends specific defenses that work today: Content Security Policy with reporting, iframe sandboxing, HSTS and strict HTTPS redirects.
AI-written summary · about
chapters (12)
- 0:00Introduction to web security
- 1:27The Don't Mess with Texas
- 3:47The reality of web security
- 5:42Content injection risks
- 7:57The Sammie worm and cookies
- 11:11Detecting malicious scripts
- 12:58CSS exploitation techniques
- 15:11Timing and rendering attacks
- 17:27CSRF and data exfiltration
- 18:58SVG filters for data theft
- 20:32Content Security Policy
- 23:12Conclusion and next steps
related talks
33mHacking The Front-End
40mXXSS: Exotic Cross-Site Scripting vectors
33mHacking your Front-End Apps
33mXXSS: Exotic Cross-Site Scripting vectors
40mHostile JavaScript: Attacking and Defending the Browser
23mJavaScript attack surface
43mNo Excuses Anymore: The Demise of Cross Site Scripting
24mSecuring your site like it's 1999