Hostile JavaScript: Attacking and Defending the Browser
summary
Shows concrete browser attacks and defenses: demonstrates a geocities demo that loads third‑party scripts, implements monkey patching to override fetch and clone outgoing data, runs a DOM‑level keylogger, and uses remote.js / BeEF‑style tooling to hijack sessions; cites Magecart’s ~70,000 compromised stores and supply‑chain/typo‑squat NPM incidents. Explains vectors (tag managers, XSS, compromised CDN/npm) and practical mitigations — CSP (under 14% adoption), SRI limits, and a proposed lightweight monitoring agent that enumerates running scripts, sources, and sensitive outgoing fields.
AI-written summary · about
chapters (11)
- 0:00Hostile JavaScript intro
- 1:06Attack vectors for JS
- 4:37JS website attacks
- 6:46Keylogger demo in JS
- 9:40Monkey patching data theft
- 12:36Magecart browser exploits
- 15:49Traditional vs supply chain attacks
- 19:42XSS as a service
- 27:01Defending browser from JS
- 33:46JS security monitoring
- 39:02Conclusion & Q&A
related talks
23mJavaScript attack surface
33mOffensive Javascript Techniques for Red Teamers
33mHacking The Front-End
34mJS Security - A Pentesters Perspective
35mServer-Side Browsers: Exploring the Web’s Hidden Attack Surface
53mA look at how hackers use JS
32mWriting Secure JavaScript Code
28mOffensive and Defensive Strategies for Client-Side JS Security