Everything you need to know about client-side malicious code execution
summary
Shows that DOM XSS is now the most common XSS in modern apps, demonstrates the hands‑on lab DomGoat for finding DOM sources and sinks, and claims practical fixes: CSP with script‑src 'self' plus nonces/hashes, outbound CSP limits, encoding by context, sandboxing untrusted libraries in iframes and using Subresource Integrity. Gives concrete examples (Twitter localStorage misuse, SVG/third‑party script incidents), explains attack vectors and tradeoffs, and recommends starting with CSP then fixing DOM APIs.
AI-written summary · about
chapters (19)
- 0:00Start
- 4:15Client-side Code Execution
- 4:46Attacker-controlled JavaScript Evaluation
- 5:27Attacker-controlled HTML Evaluation
- 8:08Attacker-controlled CSS Evaluation
- 9:15Server XSS
- 10:48DOM XSS is a growing, prevalent problem
- 13:14Types of Attacker Controlled Data
- 17:19We are an app-only company. No you are not!!!
- 20:35Types of Stores
- 21:04Client XSS - Indirect On Twitter
- 23:50SVG with Embedded JS
- 28:28Content Security Policy -Blocking Scripts
- 31:44But what if need to load script dynamically?
- 32:52Things might get out of hand sometimes!
- 33:23Limit Damage in case of Code Execution
- 36:48Context-Aware Output Encoding
- 39:08Malicious or vulnerable libraries
- 41:23Untrusted SVG files
related talks
23mJavaScript attack surface
01h 01mClient-Side Protection Against DOM-Based XSS Done Right (tm)
40mClient-Side Protection Against DOM-Base...
43mNo Excuses Anymore: The Demise of Cross Site Scripting
31m360° View of XSS
41mThe Last XSS Defense Talk: Why XSS Defense has radically changed in the past 7 years
34mJS Security - A Pentesters Perspective
39mElectron - Build cross platform desktop XSS, it’s easier than you think