Performing Dynamic Analysis of JS Apps
summary
Covers using JavaScript meta-programming techniques—Proxies, overriding native DOM APIs and built-in functions, and IIFEs—to perform dynamic analysis of web apps and answer questions like whether ads use document.write or untrusted sources write to the DOM. Explains practical pitfalls encountered and demonstrates an open-source proxy module the speaker wrote to facilitate applying these dynamic-analysis techniques to real-world sites.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 0:46JavaScript Re-writing
- 2:03Static analysis advantages
- 3:03Dynamic analysis advantages
- 7:01DOM-Based XSS
- 8:24Taint Analysis
- 9:50Inserting your analysis statements
- 11:08Where to insert analysis statements?
- 11:34Comma Operator
- 12:58Immediately Invoked Function Expression (IFE)
- 14:03Storing analysis information
- 15:49Overloading operators in JavaScript?
- 16:32Key takeaways
- 16:57Function Reflection
- 18:09How to re-write
- 18:34The results
- 19:36Rewriting JS for performance
- 20:44Automatic transpilation by Dexecure
related talks
21mAsk not what JavaScript can do for you
40mHostile JavaScript: Attacking and Defending the Browser
08mHack Proofing Your JavaScript A Fun And Engaging Guide To Enhancing Security
26mInvisible Code: Building JavaScript Libraries For Non-Technical People
32mWriting Secure JavaScript Code
55m6 Ways to Hack Your JavaScript Application
47mDebugging, Profiling, & Rocking Out with Browser-Based Developer Tools!
53mArchitecting Robust JavaScript Applications