Hacking The Front-End
summary
Shows concrete attacks and fixes: the MySpace Samy worm and evercookie prove persistent client‑side exploits; CSS visited selectors and GPU timing leaks enable history and password inference; JSONP injects arbitrary scripts while CORS, HSTS and frame‑busting headers limit cross‑origin abuse; SVG overlays plus OCR can read iframes; Content Security Policy and Subresource Integrity stop third‑party script tampering; a targeted campaign once cut Texas roadside litter by 72% — security succeeds when defaults and measurable controls replace vague advice.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:45Security
- 2:50Littering
- 3:02Keep Texas Beautiful
- 6:13Dont Mess With XSS
- 12:10Detect Malicious Scripts
- 14:00CSS Hacks
- 18:40JS Hacks
- 20:10CSRF
- 21:55Cross domain data snooping
- 23:05CSP
- 24:20CoSraya
- 29:10HTTPS
- 30:10Chrome HTTPS
- 31:45Frame busting
