XXSS: Exotic Cross-Site Scripting vectors
summary
Covers concrete, surprising exploits: Samy’s MySpace worm infects 1M profiles in 20 hours, browsers’ HTML mutation enables mXSS that bypasses naïve sanitizers, Google Search once exposed a mutation XSS bug, and the Google sanitizer sat vulnerable for three months. Demonstrates CSS selector exfiltration, image-based CSRF and form/formless request tricks, and log-based blind XSS. Shows defenses that actually work: use the template tag, CSP, vetted sanitizers and framework output escaping, and avoid reinventing sanitizers.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:27Security
- 2:16Movie analogy
- 3:36Tea analogy
- 6:41Classification
- 11:21Browsers are weird
- 12:32How to defend against XXSS
- 15:01Google Search Bar vulnerability
- 16:37No script tags
- 19:06Injections
- 22:22AllSurf
- 24:45Bank
- 25:49Images
- 28:11User input
- 28:38Internal apps
