Creepy frontend mistakes

on YouTube ↗21m

" summary

Shows a working clickjacking iframe overlay that clicks hidden buttons, a live demo of autocomplete exfiltration via drag‑and‑drop, and concrete DOM XSS vectors like DOM XSS via window.name that let injected scripts read client only storage. Finds real sites sending price and admin flags from the browser, demonstrates how webSQL and cached dynamic pages leak sensitive data, and verifies fixes: X-Frame-Options, strict CORS, disable autocomplete for sensitive fields, no caching of user pages, and encode/validate in JavaScript.

AI-written summary · about

" chapters (13)

1. 0:00Start
2. 4:42What's the Plan?
3. 5:24Browsing History
4. 6:19The Autocomplete Repository
5. 6:29Password Autocomplete
6. 8:12Caching
7. 8:57UI Redressing
8. 12:40Cross Site Scripting - Examples
9. 12:50DOM Cross Site Scripting
10. 14:05Sample White List HTML Encoder
11. 15:40DOM WebSQL Injection
12. 16:32HIDDEN Tags
13. 19:25Client Side Security Enhancments

" related talks

• 34mJS Security - A Pentesters PerspectivePrasanna Kanagasabei · JSConf.Asia 2015
• 23mJavaScript attack surfaceDavit Karapetyan · JavaScript Summit Armenia 2023
• 36mHTML5 JS SecurityMaty Siman · AppSec California 2014
• 42mModern web application bugsErlend Oftedal · NDC Sydney 2018
• 34m"The magic of XSS - not only in web applications"Michał Bentkowski · CONFidence 2019
• 41mXSS Horror ShowGareth Heyes · OWASP AppSec Research (AppSecEU) 2015
• 33mHacking The Front-EndAlex Sexton · Full Stack Fest 2015
• 40mHostile JavaScript: Attacking and Defending the BrowserTodd H. Gardner · NDC London 2023