XSS, CSRF, CSP, JWT, Wtf? Idk
summary
A vulnerable Node JSON Web Token setup lets an attacker flip the role to admin by switching the token to the JWT none algorithm exploit and pasting a manipulated auth cookie, a simple form autosubmit demonstrates a real CSRF that posts as the user, a sloppy JSONP callback allows arbitrary JavaScript that installs a JSONP → service worker implant to persist compromise, and a few demos show marked sanitizer bypass encodings; fixes used: whitelist algorithms, HTTPOnly signed cookies, csurf tokens, CSP reporting, and Snyk scans.
AI-written summary · about
chapters (19)
- 0:00Intro
- 2:03HTTPS
- 3:06JWT
- 5:58Cookies
- 6:30JSON Web Tokens
- 7:30Social Network
- 8:13CSRF
- 9:31Target Blank
- 10:16No Opener
- 12:09Little Bobby
- 12:37Myspace worm
- 13:27CSS inline CSS
- 14:59XSS demo
- 17:34JSONP
- 21:28CSP
- 23:36CSP should be your safety net
- 24:05Avoid clickjacking
- 25:38Security audits
- 26:54Summary
