Beyond the Basics: Securing JavaScript Applications
summary
Shows a working eval-based injection where user input creates a file then spawns a reverse shell, demonstrating how a single vulnerable JS handler can lead to full host compromise. Recommends concrete defenses: implement Content Security Policy early, run automated vulnerability scanners on deploy, enforce network segmentation and IAM least-privilege, and protect serverless with rate limits and billing caps to avoid denial-of-wallet; prefers backend inference for sensitive ML models.
AI-written summary · about
chapters (13)
- 0:00JavaScript security intro
- 6:25Speaker intro
- 7:30Security deprioritized in dev
- 10:00Content Security Policy
- 13:51Secure staging early
- 14:13Backend JS vulnerabilities
- 18:49Attackers exploit JS code
- 19:11Automated vuln management
- 20:14Network isolation for apps
- 22:05IAM privilege risks
- 23:30Denial of wallet attacks
- 24:33ML-powered JS apps security
- 26:19Summary
related talks
26mBeyond the Basics: Securing JS Applications
58mPractical Secure Development and Operations with JavaScript in 2020
34mJS Security - A Pentesters Perspective
40mHostile JavaScript: Attacking and Defending the Browser
23mJavaScript attack surface
28mOffensive and Defensive Strategies for Client-Side JS Security
33mOffensive Javascript Techniques for Red Teamers
35mInside a hacker’s mind