Attacking Modern Web Technologies
Talkat OWASP AppSec Europe 2018 · on Thursday, 2018-07-05· at 15:30· Fleming - 3rd Floor, QEII Centre Broad Sanctuary, Westminster·
summary
Shows concrete exploits and tools: a live postMessage tracker extension that logs cross-frame listeners and finds anonymous handlers, demos extracting CSRF and secret links from Dropbox leading to a $12,000 bounty, concrete S3 bucket de‑cloaker techniques, broken upload policy patterns that allow arbitrary file overwrite and signed‑URL leakage, client‑side race conditions that inject payment providers, and notes on appcache/serviceworker pitfalls and misconfigured AWS/Google Cloud policies allowing full asset takeover.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 0:27Attacking Modern Web Technologies
- 0:52About Frans Rosen
- 1:52Outline of the talk
- 2:28AppCache
- 8:28Dropbox
- 11:30Upload Policies
- 15:50Custom Policies
- 18:13Postmessage
- 24:45Document Service
- 25:53Clientside Race Conditions
- 28:39Example
- 34:50Speed Bumps
- 36:37jQuery
- 38:13What could I add to it
- 39:30One more thing
- 41:23Questions
