360° View of XSS

on YouTube ↗31m

" summary

Examines why XSS remains prevalent (~40% scanner rate) and still yields bounties (~$100) by showing overlooked DOM injection points. Presents concrete exploit chains that convert a popup into cookie theft, a keylogger, or remote control using frameworks like EF, vulnerable demo apps bWAPP/BEEf, and proxy-driven scanning, and gives practical payloads that close attributes to bypass naive filters. Differentiates reflected vs. stored XSS and explains why fixes limited to frameworks are insufficient.

AI-written summary · about

" chapters (10)

1. 0:00Introduction
2. 1:04What is XSS and danger
3. 3:14XSS types: reflected, stored, DOM
4. 10:26Practical XSS examples
5. 14:23Bypassing XSS filters
6. 19:53XSS consequences and leaks
7. 23:25XSS tools: Burp Suite, ZAP
8. 28:24Automating XSS testing
9. 29:06Defending against XSS
10. 30:11Q&A

" related talks

• 01h 02meXential XSS (Cross Site Scripting)Alex Mackey · NDC Melbourne 2022
• 40mXXSS: Exotic Cross-Site Scripting vectorsBenedek Gagyi · Øredev 2019
• 33mXXSS: Exotic Cross-Site Scripting vectorsBenedek Gagyi · RuhrJS 2019
• 34mJS Security - A Pentesters PerspectivePrasanna Kanagasabei · JSConf.Asia 2015
• 52mDemystifying Front-End SecurityIlya Verbitskiy · NDC Sydney 2020
• 23mJavaScript attack surfaceDavit Karapetyan · JavaScript Summit Armenia 2023
• 30mXXSS: Exotic Cross Site Scripting VectorsBenedek Gagyi · revo.js 2019
• 34m"The magic of XSS - not only in web applications"Michał Bentkowski · CONFidence 2019