Demystifying Front-End Security
summary
Claims that XSS is a leading front-end risk are backed by specifics: about 40% of logged attacks, Samy worm infected ~1 million users, WordPress plugin flaws hit ~700,000 sites, and Jenkins plugins show 20+ vulnerabilities. Demonstrations use tools like BeEF to hijack sessions, XSSer (1,200 payloads) to evade filters, and browser-miners/keyloggers to monetize or exfiltrate data. Recommended defenses are CSP report-only for tuning, strict input whitelisting, output sanitizers (Secure Filters), npm audit or Snyk, and avoiding unsafe HTML/js patterns.
AI-written summary · about
chapters (42)
- 0:00Start
- 0:21About me
- 0:49Agenda
- 1:27Attacks per day
- 1:51Attacks distribution by type
- 2:13OWASP TOP 10 2017
- 4:57JS/Spacehero-A or Samy
- 6:09The latest XSS news
- 8:19Account hijacking
- 9:03Stealing credentials
- 10:28Sensitive data
- 11:31Drive-by Downloads
- 12:24Cryptojacking
- 13:38Keylogger
- 14:06Port scan
- 15:03Web site defacement
- 16:05BeEF
- 17:32Reflected XSS
- 19:43Stored XSS
- 21:22DOM-based XSS
- 24:20Attacking SVG
- 25:08JavaScript in SVG
- 25:54Attacking Markdown
- 27:05Attacking frameworks
- 27:57Vulnerabilities in React
- 29:20XSS filter evasion
- 31:08XSS automation
- 32:05Turning XSS into RCE
- 33:08More JavaScript
- 34:17Main rules of XSS prevention
- 36:37When isn't HTML encoding enough?
- 37:28Sanitize input data
- 38:18Preventing DOM based XSS
- 39:37Secure JavaScript development
- 40:43Static code analysis
- 41:12ESLint
- 42:25The State on Open Source Security in 2016
- 42:50NPM malicious packages
- 43:19Using Components with known Vulnerabi
- 44:02Content Security Policy (CSP)
- 47:48Useful HTTP security headers
- 50:32Summary
