“Debug Thugs”
summary
Shows that everyday functional testers find XSS in input boxes by trying HTML/JS in search fields, using DVWA as a safe playground and a browser console to probe URLs. Demonstrates a working alert via <h1> then <script> and finally an onerror image payload that bypasses naive script stripping, and explains how stepwise security levels fail. Argues that simple tests of input fields catch real risks (500,000 Zoom passwords, 45 Twitter account takeovers, 65,000 Magellan patients affected).
AI-written summary · about
related talks
41mXSS Horror Show
34mJS Security - A Pentesters Perspective
47mFrom Theory To Practice: Navigating The Challenges Of Vulnerability Research
23mJavaScript attack surface
21mCreepy frontend mistakes
34m"The magic of XSS - not only in web applications"
57mThe Last XSS Defense Talk
52mDemystifying Front-End Security