XXSS: Exotic Cross Site Scripting Vectors
summary
Shows concrete exotic XSS: the Samy MySpace worm hijacks 1 million profiles in 20 hours, mXSS arises when browsers mutate HTML (using template tag vs div differences) and Google Search stayed exploitable for three months, CSS injections exfiltrate data via background-image URLs and Facebook tracking pixels, selectors like :visited or attribute checks can leak state, forms and image src trigger CSRF, and blind XSS appears through User-Agent fields. Defenses are practical: validate and sanitize inputs, prefer frameworks that escape output, update deps, and store uploaded images as server-side image data.
AI-written summary · about
chapters (12)
- 0:00Introduction and motivation
- 4:39Basics of XSS attacks
- 6:46Stored vs reflected XSS
- 9:20Input sanitization challenges
- 12:10Mutation XSS explained
- 14:19Google search bar M-XSS attack
- 17:11CSS-based XSS vectors
- 21:26HTML injection and CSRF
- 22:52Image upload security risks
- 25:40Beyond visible user inputs
- 27:50Defense against exotic XSS
- 29:58Closing remarks and safety
