Server-Side Browsers: Exploring the Web’s Hidden Attack Surface

on YouTube ↗35m

" summary

Automated headless browsers replace curl for link previews and expand attack surface: a Puppeteer/Playwright setup crawls ~100,000 sites (2.6M pages), triggers ~170k callbacks, finds ~3,000 fast JS-enabled hits reducing to ~250 distinct domains, and shows about two thirds vulnerable to public exploits with many browsers 6+ months out of date. Practical methods: form/referrer/query injection and feature-fingerprinting to identify bundled Chromium versions. Defenses: frequently update project dependencies, isolate and sandbox the renderer, run it unprivileged, and don’t trust npm audit alone.

AI-written summary · about

" chapters (6)

1. 0:00Introduction
2. 3:35Server-side browser dangers
3. 14:12Outdated browsers in the wild
4. 27:43How outdated were the browsers we found
5. 31:16Countermeasures
6. 34:02Summary

" related talks

• 40mHostile JavaScript: Attacking and Defending the BrowserTodd H. Gardner · NDC London 2023
• 44mHeadless Browser Hide and SeekSergey Shekyan · OWASP AppSecUSA 2014
• 48mA Weakness In Chrome & A New Hacking TechniqueGil Cohen, Omri Inbar · Global AppSec Dublin 2023
• 23mJavaScript attack surfaceDavit Karapetyan · JavaScript Summit Armenia 2023
• 33mOffensive Javascript Techniques for Red TeamersDylan Ayrey, Christian Frichot · BSidesSF 2019
• 40mClient-Side Protection Against DOM-Base...Sebastian Lekies, Martin Johns, Ben Stock · OWASP AppSec Research (AppSecEU) 2015
• 29mYour Scripts In My Page - What Could Possibly Go Wrong?Sebastian Lekies, Martin Johns, Ben Stock · Black Hat Europe 2015
• 01h 04mServer-Side Browsing Considered HarmfulNicolas Gregoire · OWASP AppSec Research (AppSecEU) 2015