XXSS: Exotic Cross-Site Scripting vectors
summary
Starts from a concrete historical exploit (Samy MySpace worm infects 1,000,000 profiles in ~20 hours) and demonstrates techniques that actually work: non-JS injections (CSS selectors and attribute scraping, a CSS-only keylogger), mutation XSS against template/noscript parsing (Google search mXSS via template + noscript), blind exfiltration via images and CSRF through injected links/forms, subdomain-cookie takeover and React attribute leakage. Covers mitigations: sanitize bytes not strings, host uploaded images as binaries, use frameworks and audit deps.
AI-written summary · about
chapters (22)
- 0:00Intro
- 0:50Security
- 6:26Flow
- 7:31Types of attacks
- 8:46Attack flow
- 9:26Attack transformation
- 10:30Namings
- 11:27User inputs
- 12:05Browsers are weird
- 13:00Browsers are completely different
- 14:54How it works
- 17:12How it happened
- 20:08JavaScript
- 20:37What is XSS
- 21:07CSS Injection
- 25:11Onsite request forgery
- 27:15HTML injection
- 28:16Script alert
- 30:40Images
- 33:39User Input
- 37:00TLDR
- 39:31Outro
