JS Security - A Pentesters Perspective
summary
Shows that DOM XSS is exploitable in realistic settings: a reflected filename on an admin-upload path becomes a weapon when the attacker encodes payload as base64, decodes with atob and executes via an eval workaround, which successfully steals a Rails CSRF token. Demonstrates browser takeover with BeEF, automated discovery of sources and sinks with the Chrome extension hookes, a templating-engine bypass via string-replace/mutation causing an onerror execution, and a window.opener = null mitigation.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 0:49Agenda
- 2:34What is DOM excesses
- 3:10Why I like DOM excesses
- 3:36A simple DOM manipulation
- 4:24Source and Sink
- 5:38Sources and Sink
- 6:35Adamek Sucess
- 7:00Low Priority Issues
- 7:54Exploit Demo
- 10:46Solution
- 11:26Exploit
- 12:26Templating Engines
- 18:12Tab Nabbing
- 20:33Window Dot Name
- 26:12How do you automate
- 27:19Chrome extension
- 28:05How it works
- 30:51DomCobra
- 32:24Insecure Blog
related talks
23mJavaScript attack surface
28mOffensive and Defensive Strategies for Client-Side JS Security
41mXSS Horror Show
59mWeb Application Security Trends
40mHostile JavaScript: Attacking and Defending the Browser
31m360° View of XSS
01h 02meXential XSS (Cross Site Scripting)
40mXXSS: Exotic Cross-Site Scripting vectors