Where Hackers Go Hunting: Frontend Storage Security

on YouTube ↗26m

" summary

Frontend storage routinely exposes real exploits: attackers use DevTools and one-line console edits to flip a localStorage tokens flag and unlock premium features, change an isAdmin cookie to perform admin actions when backends lack checks, or grab API keys in client code to inject data and corrupt a database. Public examples include stolen Tesla access tokens, exposed coupon arrays in global variables, and a working local LLM poisoning proof‑of‑concept that exfiltrates full therapy sessions via crafted sessionStorage/tab isolation values.

AI-written summary · about

" chapters (5)

1. 0:00Introduction to frontend storage risks
2. 2:37Overview of frontend storage types
3. 13:25Real-world storage vulnerabilities
4. 19:58AI era and local LLM threats
5. 25:01Key takeaways and security lessons

" related talks

• 33mHacking The Front-EndAlex Sexton · Full Stack Fest 2015
• 41mThe Insecurity Caused By Trusting Your Client-Side StorageBen Stock, Marius Steffens · OWASP Global AppSec Amsterdam 2019
• 35mInside a hacker’s mindMaria Shoaib · Øredev 2019
• 19mCritical Security Mistakes in Frontend ApplicationsDan Neciu · UtahJS Conf 2023
• 43mAttacking Modern Web TechnologiesFrans Rosén · OWASP AppSec Europe 2018
• 01h 01mHow hacking works - Web editionEspen Sande-Larsen · NDC Oslo 2023
• 28mOffensive and Defensive Strategies for Client-Side JS SecurityAnand Vemuri · JSConf Budapest 2016
• 40mHow to hack an Angular app?Asim Hussain · ngVikings 2018