Web Application Security Trends
summary
Cross-site scripting defects are increasing — the talk cites a record year for XSS — and shows concrete bypasses: HTML-escaped values in JS strings, AngularJS expression injection via constructor.constructor, and client-side template eval requiring CSP/eval tradeoffs. Server-side issues include XML External Entities leading to local file reads and SSRF unless parsers call setFeature to disable external entities, insecure deserialization enabling remote code execution (JSON.NET ObjectDataProvider demos), mass assignment overposting, opener-based phishing via window.opener and the fix rel="noopener noreferrer", plus regex backtracking DoS and practical mitigations.
AI-written summary · about
chapters (12)
- 0:00Start
- 2:19Cross-Site Scripting
- 4:01Types of Cross-Site Scripting
- 4:25Dom-Based
- 7:28Cross-Site Scripting Protection
- 22:11Template Injection
- 22:33Angularjs
- 22:58Expression Binding in Angularjs
- 27:50Xml External Entities
- 36:43Server Side Request Forgery
- 39:01Security Serialization
- 58:04Single Page Applications
related talks
50mModern WebApp Vulnerabilities
34mJS Security - A Pentesters Perspective
19mFrontend Security is a Thing
48mSecurity Risk: Single-Page Applications.
37mFront-end Security
52mDemystifying Front-End Security
43mNo Excuses Anymore: The Demise of Cross Site Scripting
55mWeb Application Security: Browsers Fight Back!