Modern WebApp Vulnerabilities

on YouTube ↗50m

" summary

Walks through concrete bugs and exploit paths: XXE via XSLT onParsedText exfiltrates files and internal HTTP metadata, deserialization gadgets (why so serial/why so serious) enable remote code execution and reverse shells, template injection leads to server‑side RCE and client‑side sandbox bypasses, CORS misconfigurations echoing Origin allow credentialed theft, SSRF tricks (numeric/hex/octal/overflow IPs) leak cloud metadata, subdomain takeovers capture cookies and certs, and web‑cache poisoning using X‑Forwarded‑Host turns self‑XSS into widespread exploit.

AI-written summary · about

" chapters (10)

1. 0:00Intro
2. 0:34OS Top 10
3. 3:44XML
4. 11:02Binding and serialization
5. 16:25Template injection
6. 24:40Crossorigin resource sharing
7. 28:08Serverside request forgery
8. 34:57Subdomain takeover
9. 39:10Web cache poisoning
10. 43:26Poisoning the cache

" related talks

• 42mModern web application bugsErlend Oftedal · NDC Sydney 2018
• 58mModern web application bugsErlend Oftedal · NDC Minnesota 2019
• 56mModern Web Vulnerabilities 2020Erlend Oftedal · NDC Security Oslo 2020
• 59mWeb Application Security TrendsChristian Wentz · NDC Oslo 2018
• 34m"The magic of XSS - not only in web applications"Michał Bentkowski · CONFidence 2019
• 01h 02meXential XSS (Cross Site Scripting)Alex Mackey · NDC Melbourne 2022
• 23mJavaScript attack surfaceDavit Karapetyan · JavaScript Summit Armenia 2023
• 30mHow to hack a web app?Asim Hussain · Render Conference 2018