Call To Arms: A Tale of the Weaknesses of Current Client-Side XSS Filtering
summary
Analysis shows Chrome's XSS Auditor has concrete weaknesses: a static code review finds 17 flaws, an automatic exploit generator (taint-tracking patched Chromium + extension) produces real payloads, and a large-scale run against DOM XSS in Alexa Top 10k succeeds on first try in roughly 80% bypass cases. Bypass techniques exploit auditor invocation gaps (eval, innerHTML, cookies, postMessage) and string-matching rules (partial, trailing, double injections); the tools reliably reproduce and demonstrate practical exploitation.
AI-written summary · about
chapters (24)
- 0:00Start
- 0:18About us
- 2:04The Same-Origin Policy
- 2:47XSS- the underlying problem
- 3:21XSS- what an attacker can do
- 4:12Types of XSS
- 5:39Stopping XSS attacks
- 7:24Finding and exploiting DOMXSS vulnerabilities automatically at scale
- 13:24Motivation
- 15:44Reflected XSS (revisited)
- 17:45XSS Filter Strategies
- 19:21How the XSS Auditor works
- 23:44Auditor matching rules (simplified)
- 28:06How to bypass the XSS Auditor
- 29:42Bypass invocation using eval
- 32:33Bypass invocation in the HTML Parser
- 34:34HTML-free injections
- 37:48Partial Injections
- 41:13Trailing content
- 45:40Double injections
- 51:40Empirical study
- 52:24Results of our study
- 53:16What to take away?
- 53:55What else to take away?
related talks
01h 01mClient-Side Protection Against DOM-Based XSS Done Right (tm)
40mClient-Side Protection Against DOM-Base...
31m360° View of XSS
34m"The magic of XSS - not only in web applications"
23mJavaScript attack surface
34mJS Security - A Pentesters Perspective
42mDon't trust the DOM: Bypassing XSS mitigations via script gadgets
48mA Weakness In Chrome & A New Hacking Technique