Web Security for Newcomers: how to avoid getting hacked as a software developer
summary
Prepared insecure Python backend and a tiny JavaScript frontend expose concrete attacks: a non-persistent XSS from echoing a query param into the page DOM via innerHTML, a dom‑based XSS from client-side manipulation, a persistent XSS introduced by a typoed Google Tag Manager snippet that serves phishing popups over the checkout, and an SQL injection via unsanitized GET filters; demonstrations run end‑to‑end and the fixes shown are escaping templates and using ORMs/bound parameters.
AI-written summary · about
chapters (11)
- 0:00Start
- 6:30Non-Persistent Xss
- 7:57The Inner Html Property
- 10:33Cross-Site Scripting
- 11:39The Google Tag Manager Snippet
- 12:36Persistent Xss Attack
- 17:40Phishing Attack
- 20:31Open Web Application Security Project
- 21:41Sanitize Your Html Markup
- 22:57Prevent Dom Based Xss
- 24:25Run an Sql Injection Attack
related talks
59mWeb Application Security Trends
01h 04mWeb Security And You
34mJS Security - A Pentesters Perspective
19mCritical Security Mistakes in Frontend Applications
19mFrontend Security is a Thing
33mHacking The Front-End
30mWeb Security Engineering - Protect all layers of your project
52mDemystifying Front-End Security