How I Hacked Your Website and You Didn’t Even Know
summary
A live Magecart-style demo uses ZAP to map third-party supply chains, injects a 5-line payload into a demo analytics script and exfiltrates login fields to a test server, showing the attack succeeds on a realistic site. Findings: 70% of browser-loaded content is third-party, Alexa-1k sites average 34 third parties, an average Magecart infection lasts 46 days, and defenses that work are CSP, SRI and iframe sandboxing.
AI-written summary · about
chapters (22)
- 0:00Intro
- 0:27Session Agenda
- 1:11SolarWinds: Supply Chain Attacks Everywhere
- 2:33Evolution of Web Architecture - Foundation
- 2:53Evolution of Web Architecture - Today's Modern Web
- 5:41Modern Web a Perfect Storm
- 7:30Hacking 101: Exploit the Weakest Link
- 8:42Typical Magecart Attack Sequence
- 13:31Analyze Website through Zed Attack Proxy
- 16:11Infect 3rd Party Server
- 17:03Attack Payload
- 20:19Common Techniques to Evade Detection
- 22:43Magecart - Recent Attacks and Repercussions
- 25:07Resource Inventory
- 25:58Minimize 3rd Party JavaScript Exposure
- 27:37Active Protection Through W3C/HTMLS Standards
- 28:43Client-Side Security Standards Summarized
- 31:38JavaScript Based Solutions
- 32:42Periodic Monitoring
- 33:08A Secure Page Example
- 34:13Apply What You Have Learned Today
- 35:35Thank You for Your Attention! Q&A Session up next
related talks
44mMagecart - The Rising Threat to e-commerce Websites
34mMagecart 2020 The New Face of XSS
40mHostile JavaScript: Attacking and Defending the Browser
01h 10mHack to the Future
30mTargeted Web Skimming on E-Commerce Sites
01h 01mSomething Something Cyber
44mHack Yourself: Intro to pentesting with ZAP
33mHacking The Front-End