Don't Trust The Locals: Exploiting Persistent ...
summary
Defines and measures a new class called persistent client-side XSS by combining taint tracking with an automated exploit-generation pipeline. Reports an empirical study of the Alexa Top 5,000 (finding ~2,000 sites that persist client-side data and >20% of those insecure), evaluates exploitability under two attacker models (≥70% infectable), presents real-world case studies, categorizes four intended use classes for persisted data, and outlines tailored countermeasures.
AI-written summary · about
related talks
41mThe Insecurity Caused By Trusting Your Client-Side Storage
40mClient-Side Protection Against DOM-Base...
01h 01mClient-Side Protection Against DOM-Based XSS Done Right (tm)
55mCall To Arms: A Tale of the Weaknesses of Current Client-Side XSS Filtering
31m360° View of XSS
52mDemystifying Front-End Security
33mHacking The Front-End
01h 02meXential XSS (Cross Site Scripting)