Your Scripts In My Page - What Could Possibly Go Wrong?
summary
Demonstrates a practical attack called cross-domain script inclusion and a browser extension that fetches scripts with and without cookies to detect server‑side generated JavaScript. Study scans 150 top sites, finds 49 dynamic scripts, 34 containing unique identifiers, 15 with personal data and 7 with CSRF tokens. Exploitation succeeds against 40 of 49 (~80% exploited): identifiers leaked from 28/34, personal data from 11/15, CSRF/OAuth tokens from 4/7. Recommends separating data from static JS and using tokens or referrer checks; demo and disclosure effort are reported.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 0:27Agenda
- 0:57SameOrigin Policy
- 2:13JavaScript
- 3:24Gmail
- 6:52Detection System
- 8:11Registration
- 9:37Results
- 10:49Attacker Model
- 12:18Methods
- 14:17Exploit Results
- 15:46Demo
- 15:58Website
- 18:45More Examples
- 20:06File Hosting Script
- 21:01How To Prevent These Vulnerabilities
- 21:36Dynamic Scripts
- 22:26Content Security Policy
- 23:26Conclusion
- 24:19Questions
related talks
40mHostile JavaScript: Attacking and Defending the Browser
35mServer-Side Browsers: Exploring the Web’s Hidden Attack Surface
40mXXSS: Exotic Cross-Site Scripting vectors
23mJavaScript attack surface
33mHacking The Front-End
25mPracticing Safe Script
21mCreepy frontend mistakes
30mGDPR and Third Party JS - Can It Be Done?