The Insecurity Caused By Trusting Your Client-Side Storage

on YouTube ↗41m

" summary

Client-side stores like cookies localStorage and IndexedDB lead to persistent client-side XSS when developer code later writes those values into the DOM. The authors build a taint-tracking Chromium and an exploit candidate generator that records flows, crafts payloads and verifies them in browsers. Scanning top sites finds ~2,000 using client-side stores, 418 exploitable domains (30% of cookie flows 24% of localStorage flows) and a simple check finds 60 IndexedDB vulnerabilities validated end to end.

AI-written summary · about

" chapters (16)

1. 0:00Intro
2. 3:02Cookies
3. 4:21Web Storage
4. 6:55What we are doing
5. 8:55The tainted chromium
6. 12:04Exploiting web applications
7. 13:26Exploit patterns
8. 15:40Attack vectors
9. 20:30Demo
10. 22:04IndexDB Credibility
11. 24:23Exploitable Data
12. 27:03JSON Objects
13. 28:47Cold Cashing
14. 30:20Solutions
15. 32:49Host Names
16. 34:00Conclusion

" related talks

• 01h 01mClient-Side Protection Against DOM-Based XSS Done Right (tm)Sebastian Lekies, Martin Johns, Ben Stock · Black Hat Asia 2015
• 40mClient-Side Protection Against DOM-Base...Sebastian Lekies, Martin Johns, Ben Stock · OWASP AppSec Research (AppSecEU) 2015
• 41mDon't Trust The Locals: Exploiting Persistent ...Ben Stock, Marius Steffens · RuhrSec 2019
• 26mWhere Hackers Go Hunting: Frontend Storage SecurityHila Kraisler · ReactNext 2025
• 55mCall To Arms: A Tale of the Weaknesses of Current Client-Side XSS FilteringSebastian Lekies, Martin Johns, Ben Stock · Black Hat USA 2014
• 23mJavaScript attack surfaceDavit Karapetyan · JavaScript Summit Armenia 2023
• 42mEverything you need to know about client-side malicious code executionLavakumar Kuppan · JSFoo 2018
• 34mJS Security - A Pentesters PerspectivePrasanna Kanagasabei · JSConf.Asia 2015