XSS Horror Show

on YouTube ↗41m

" summary

Dives into concrete browser bugs and working exploits: demonstrates Relative Path Overwrite (RPO) where a single slash or pretty-URL rewrite causes a stylesheet request to load the page as CSS and execute injected selectors and expressions (works on legacy IE); documents mutation XSS chains where innerHTML rewrite decodes entities and turns safe attributes into script; shows fuzzing with Shaza shared fuzzing and a MentalJS sandbox, gives live bypasses of IE/Chrome auditors, and provides proof-of-concept URLs and detection heuristics.

AI-written summary · about

" chapters (6)

1. 0:00Start
2. 2:44Absolute Urls
3. 17:01Legacy Ie Bugs
4. 18:03Reassign Functions from within the Arguments of a Javascript Function Call
5. 23:23Vulnerable to Meta Charset Injection
6. 24:07Blocking Anchor Injections

" related talks

• 23mJavaScript attack surfaceDavit Karapetyan · JavaScript Summit Armenia 2023
• 33mXXSS: Exotic Cross-Site Scripting vectorsBenedek Gagyi · RuhrJS 2019
• 34mJS Security - A Pentesters PerspectivePrasanna Kanagasabei · JSConf.Asia 2015
• 40mXXSS: Exotic Cross-Site Scripting vectorsBenedek Gagyi · Øredev 2019
• 58mModern web application bugsErlend Oftedal · NDC Minnesota 2019
• 34m"The magic of XSS - not only in web applications"Michał Bentkowski · CONFidence 2019
• 42mModern web application bugsErlend Oftedal · NDC Sydney 2018
• 31m360° View of XSSSviatoslav Lohyn · QA fwdays'20 online conference