Offensive and Defensive Strategies for Client-Side JS Security
summary
Demonstrations use an intentionally vulnerable Node app plus Burp and BeEF to show a stored XSS payload that exfiltrates data and remotely controls a browser (even plays audio), and a chained exploit where a CSRF via forged HTML form creates an admin account on a private server by sending what the server accepts as JSON. The attacker bypasses naive JSON checks. Remediations shown: use a cryptographically secure token tied to session, validate Origin, deploy CSP and plug in csurf middleware.
AI-written summary · about
chapters (14)
- 0:00Start
- 0:16Security Best Practices
- 1:14Cross-Site Scripting
- 3:42Intercepting Proxy
- 9:01Cross-Site Request Forgery
- 15:05Browser Exploitation Framework
- 17:14Kali Linux
- 19:54Cryptographically Secure Synchronizer Token Pattern
- 20:48Secondary Defense
- 21:08Csp
- 22:31Method Interchange
- 24:14Cross Origin Recut Resource Sharing
- 25:32Resources for Different Javascript Based Servers
- 26:10Major Takeaways
