XSS is dead. We just don't get it.
Talkat OWASP AppSec Europe 2018 · on Friday, 2018-07-06· at 09:00· Fleming - 3rd Floor, QEII Centre Broad Sanctuary, Westminster·
summary
Claim: XSS is technically solvable — specific defenses exist and catch most cases — yet it persists because of implementation gaps and incentives. Concrete tools are content transformation (escaping/encoding), DomPurify browser-side sanitizer, and CSP and sandbox iframes. Real-world failures are wrong escapes, outdated or server-side sanitizers with bypasses, odd MIME/plugin edge cases, legacy sites and ad/CDN whitelists, and a market that rewards finding bugs more than fixing them despite two decades and thousands of papers.
AI-written summary · about
chapters (65)
- 0:00Intro
- 0:55Welcome
- 1:40Whos here
- 2:07Agenda
- 2:45Crosssite scripting
- 3:44Crosssite scripting types
- 4:34Looking at the past
- 6:00Cert Advisory
- 6:45Web Security
- 8:17HTML Entities
- 8:52HTTP Only Cookies
- 9:53Advanced Attacks
- 10:22Trust
- 11:18Two tools
- 11:52Trustworthy scripting
- 12:36XSS worms
- 12:51Sammyswarm
- 13:15Wade Alcorn
- 13:35We need new tools
- 14:14HTML is complex and grows
- 14:35There are so many XSS tools
- 16:14Cases
- 16:58Bypasses
- 17:22Maybe XSS is dead
- 17:51The tools we have
- 18:29Academia is always busy
- 19:07Other kinds of fix success
- 19:33Mind sniffing crosssite scripting
- 20:57Adobe Reader bug
- 21:58Stronger tools
- 22:22CSP
- 23:43CDNs
- 24:33CSPs
- 25:32More tools
- 26:07Content sanitization
- 26:41Trust crumbling
- 26:58We forgot the seatbelt
- 27:40We are the color restriction
- 28:13Its about money
- 28:33We now have
- 29:03Why dont we kill
- 29:21Legacy system
- 30:05We keep finding excuses
- 30:42We cant fix XSS
- 31:01I dont think its management
- 32:00I would lose a lot of money
- 32:33What do we actually want
- 33:04Thats a good sign
- 33:27Whats next
- 33:49Do we need more
- 34:24SEC metadata
- 34:59Google Scholar
- 35:22Motivation
- 35:48Punishment
- 36:43Responsibility
- 37:59Stop the buck finish
- 39:09Fix bounties
- 39:44The glorification goes overboard
- 40:22Doctor please
- 40:47Solutions
- 41:23Start being honest
- 42:05Lets start panel
- 42:52Crosssite scripting is dead
- 43:20We are in a very good position
- 43:45Questions
