Upload File

a talk by 13-06-2014, - owasp · 1. php 2. xss 3. testing methodology 4. per-context xss attack...

  • Home
  • Documents
  • A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
183
A talk by 13-06-2014,

Upload: others

Post on 13-Aug-2020

4 views

Category:

Documents


2 download

Report

TRANSCRIPT

Page 1: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

Atalkby

13-06-2014,

Page 2: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 3: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

http://en.wikipedia.org/wiki/Monkey_test

Page 4: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 5: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 6: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

Aresearcherin uhr niversity ochum,AstudentofXSSwhoisworkingtowardshisPhDinXSSAnXSSer/AnXSSEnthusiast

Listedintopsites'halloffameAproudfatheroftwoSpeaker@HITBKUL2013,@DeepSec2013&OWASPSeminar@RSAEurope2013ATwitterlover

http://www.tubechop.com/watch/2670518

@soaj1664ashar

Page 7: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 8: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 9: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 10: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 11: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

http://slides.com/mscasharjaved/cross-site-scripting-my-love

Page 12: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

https://twitter.com/soaj1664ashar/status/466945529059221504

Page 13: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

50$per-contextbypass(outputreflectsin5contexts)

http://demo.chm-software.com/7fc785c6bd26b49d7a7698a7518a73ed/

http://xssplaygroundforfunandlearn.netai.net/final.html

http://xssplayground.net23.net/final.html

Page 14: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

1. PHP2. XSS3. TestingMethodology4. Per-ContextXSSAttackMethodology5. SummarizePHP'sfindings(includesbuilt-infunctions,

customizedXSSsolutionsandtopPHP-basedwebframeworks)

6. ResultsofAlexaSurveyofTop100sites7. Conclusion

Page 15: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 16: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

http://w3techs.com/technologies/overview/programming_language/all

Page 17: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

http://www.php.net/usage.php

Page 18: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

http://www.php.net/usage.php

Page 19: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

http://w3techs.com/blog/entry/web_technologies_of_the_year_2013

Page 20: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 21: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 22: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)

Page 23: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 24: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

https://www.brighttalk.com/webcast/288/97255

Page 25: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

http://www.osvdb.org/osvdb/show_graph/1

Page 26: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

http://owasptop10.googlecode.com/files/OWASP%20Top%2010%20-

Page 27: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

%202013%20-%20RC1.pdf

Page 28: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 29: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 30: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

https://twitter.com/soaj1664ashar/status/362493382645383168

Page 31: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

http://www.incapsula.com/blog/world-largest-site-xss-ddos-zombies.html

Page 32: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

isthetermcoinedhere:#tweetbleedhttps://twitter.com/pdp/status/476796934062370816

Page 33: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

https://twitter.com/soaj1664ashar/status/476773831928209408

Page 34: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

https://twitter.com/derGeruhn/status/476764918763749376

Page 35: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

https://twitter.com/TweetDeck/status/476770732987252736

Page 36: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 37: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 38: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 39: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

SimulateRealWebApplicationsTestingconductedinfivecommoncontexts(HTML,Script,Attribute,Style&URL)

Page 40: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 41: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

https://twitter.com/soaj1664ashar/status/463960615157915648

Page 42: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

===generaltermfilter_function

Page 43: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 44: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 45: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 46: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 47: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 48: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 49: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 50: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 51: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

DoubleQuotesCase

Page 52: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

SingleQuotesCase

Page 53: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 54: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 55: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 56: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 57: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 58: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 59: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 60: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 61: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 62: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 63: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 64: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 65: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 66: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 67: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 68: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

SystematicinnatureEasytounderstandContext-SpecificAttackmethodologyis` `andonecanguaranteethatthereisanXSSornoXSSinaparticularinjectionpoint.Withthehelpofattackmethodology,onecanmakeasecureper-contextXSSsanitizerCanbeappliedtootherserver-sidelanguagese.g.,ASP,Rubyetc

Page 69: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

Onlyforattendees...:)

Page 70: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

";confirm(1);//

OR

';confirm(1);//

Page 71: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

http://www.dailymail.co.uk/home/search.html

Page 72: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

http://de.eonline.com

Page 73: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 74: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 75: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

Itsimplydoesnotwork.Encodingwillnothelpyouinbreakingthescriptcontextunlessdevelopersaredoing

somesortofexplicitdecoding.

http://issuu.com/mscasharjaved/docs/urlwriteup

Page 76: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

http://jsfiddle.net/4eqK4/2/

Page 77: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

http://xssplaygroundforfunandlearn.netai.net/series7.html

Page 78: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 79: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

https://twitter.com/soaj1664ashar/status/469442421148119040

Page 80: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

Onlyforattendees:)

Page 81: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 82: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

http://www.ea.com/

Page 83: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

http://www.drudgereportarchives.com/dsp/search.htm

Page 84: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

http://www.biblegateway.com

Page 85: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

``onmouseover=alert(1)

``===backtick

Page 86: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

https://twitter.com/hasegawayosuke

Page 87: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

Veryusefulinbreakingattributecontextifsiteisproperlyfilteringsingleanddoublequotes

Page 88: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

MarioHeiderichhttps://twitter.com/0x6D6172696F

Anotherusefultoolbyhimishttp://html5sec.org/innerhtml/

andmustreadresearchpaperbyhimifyouareinterestedin

innerHTMLandmutationXSShttp://www.nds.rub.de/media/emma/veroeffentlichungen/2013/12/10/mXSS-

CCS13.pdf

Page 89: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 90: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 91: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 92: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 93: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 94: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 95: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 96: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 97: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 98: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 99: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 100: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

http://xssplaygroundforfunandlearn.netai.net/innerHTMLtesting.html

Page 101: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 102: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

http://view.officeapps.live.com/op/view.aspx?src=%20http%3a%2f%2fvideo.ch9.ms%2fsessions%2fbuild%2f2014%2f2-

559.pptx

Page 103: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

seedemohttp://jsfiddle.net/9t8UM/2/

Page 104: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

Onlyforattendees:)

Page 105: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

http://www.scribd.com/doc/226925089/Stylish-XSS-in-Magento-When-Style-helps-you

Page 106: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

Onlyforattendees:)

Page 107: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

http://www.scribd.com/doc/211362856/Stored-XSS-in-Twitter-Translation

Page 108: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 109: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 110: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 111: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 112: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 113: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

AquicksearchonGitHubreveals...

http://xssplayground.net23.net/clean6.html

Page 114: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

AquicksearchonGitHubreveals...(falsepositivesarealsotherebutstillgiveyouanideaofpopularity)

http://xssplayground.net23.net/clean20.html

Page 115: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

AquicksearchonGitHubshows...

http://xssplayground.net23.net/clean21.html

Page 116: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

Onlyforattendees:)

Page 117: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 118: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

Developersarealsocallingitwithnameslike and

AquicksearchonGitHubreveals

http://xssplayground.net23.net/clean.html

Page 119: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

Twoarraysofblack-listedkeywords:)

Page 120: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 121: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

http://xssplayground.net23.net/clean.html

Page 122: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

Alleventhandlersthatarenotpartofblack-listedarraywillbypassthisprotectione.g.,

Page 123: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

https://twitter.com/soaj1664ashar/status/470843406521237504

Page 124: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 125: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 126: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 127: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

AverypopularbutsorrytosayBADXSSprotection...

AquicksearchonGitHubreveals...

http://xssplayground.net23.net/clean1.html

Page 128: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 129: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 130: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 131: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

http://xssplayground.net23.net/clean1.html

Page 132: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 133: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

ThegoalofthisfunctionistostopJavaScriptexecutionviastyle.

http://xssplayground.net23.net/clean2.html

Page 134: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 135: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 136: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 137: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 138: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

AnotherpopularcustomizedXSSprotectionsolution.

http://xssplayground.net23.net/clean3.html

Page 139: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 140: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

ApopularXSLT-poweredopensourcecontentmanagementsystemisusing function.

Page 141: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 142: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 143: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 144: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 145: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 146: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 147: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 148: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

AFullyBakedPHPFrameworkhttp://ellislab.com/codeigniter

Page 149: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

https://github.com/EllisLab/CodeIgniter/issues/2667

Page 150: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

(SnapshotfromthelatestCodeIgniterversionavailableatGitHub)

https://github.com/EllisLab/CodeIgniter/blob/develop/system/core/Security.php#L438

Page 151: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 152: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

http://xssplayground.net23.net/clean11.html

Page 153: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 154: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

(oldtest-bed)http://xssplayground.net23.net/clean11.html(newtest-

bed)http://xssplayground.net23.net/clean100.html

Page 155: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

SanitizeNaughtyHTMLelements

OldlistofnaughtyelementsbeforeIstartedbypassing...

Page 156: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

<math><a/xlink:href=javascript&colon;confirm(1)>click</a>

(oldtest-bed)http://xssplayground.net23.net/clean11.html

(newtest-bed)

http://xssplayground.net23.net/clean100.html

Page 157: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 158: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 159: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

https://github.com/EllisLab/CodeIgniter/blob/develop/system/core/Security.php#L592

Page 160: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

RemovesInvisiblecharacterse.g.,%00i.e.,NULL

Page 161: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 162: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 163: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 164: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 165: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 166: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

https://twitter.com/kinugawamasato

https://zdresearch.com/zdresearch-xss1-challenge-writeup/

Page 167: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

http://websec.ca/kb/sql_injection#MySQL_Fuzzing_Obfuscation

Page 168: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

demo:http://jsfiddle.net/GTxVt/5/

Page 169: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

HxDhttp://mh-nexus.de/en/hxd/

Page 170: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

https://twitter.com/soaj1664ashar/status/358574268386246656

Page 171: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 172: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

https://github.com/EllisLab/CodeIgniter/issues/2667

Page 173: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

https://github.com/EllisLab/CodeIgniter/issues/2667

Page 174: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

Onlyforattendees:)

Page 175: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

Isurveyedtop10sitesfromthefollowing10categories...

Page 176: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 177: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 178: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

http://www.scribd.com/doc/210121412/XSS-is-not-going-anywhere

Page 179: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

OurlargescalesurveyofPHP-basedsanitisationroutinesshowsSADstateofwebsecurityasfarasXSSisconcerned.Theproposedattackandtestingmethodologyisgeneralandmaybeappliedtootherserver-sidelanguages.Whatifweautomatethiscontext-specificattackmethodologyandunleashautomationtoolonalargescalesurveyofdeepweb...:)

Page 180: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

@padraicb

@enygma

@metromoxie

Page 181: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 182: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS
Page 183: A talk by 13-06-2014, - OWASP · 1. PHP 2. XSS 3. Testing Methodology 4. Per-Context XSS Attack Methodology 5. Summarize PHP's findings (includes built-in functions, customized XSS

Universal XSS via IE8s XSS Filters - Black Hat | Home

Combinatorial XSS Attack Grammars - SBA Research · Combinatorial XSS Attack Grammars XSS Vectors for ... SBA Research April 10, 2015 SBA Research, Vienna. Outline Introduction XSS

XSS Documentation

DOM-based XSS

Xss con javascript

XSS ATACKS

Encontrando Vulnerabilidades XSS

XSS Without Browser

Dom based xss

PRELIMINARY SLIDESconference.hackinthebox.org/hitbsecconf2012kul... · • 2007 - Orkut Worm • 2008 - Yahoo IM XSS • 2009 - Twitter hit by multiple XSS variants, Memova XSS •

Xss attacks

Java Security Mythen - Berlin Expert Days · XSS Stored! XSS Reflected! XSS Browser executes ... JavaServer Faces automatically escape all output. XSS in action. Don‘t take framework

XSS Desvendado

PHP's Filter Module

Grails vs XSS: Defending Grails against XSS attacks

XSS-GUARD : Precise Dynamic Prevention of Cross Site Scripting (XSS) Attacks

Shibuya xss lt

OWASP - Top Ten 2010 rc1OWASP OWASP Top 10 Risk Rating Methodology 15 OWASP Example for Cross Site Scripting (XSS) XSS Score = Weighted risk rating = Average of Exploitability, Prevalence

CSP - the panacea for XSS - owasp.org another security blogger . XSS. 4 XSS ... Over 12 million email messages daily ... CSP Based IDS Magic XSS XSS XSS Test & Fix . 29

Evolution Xss

Universal XSS via IE8s XSS Filters - Black Hat Briefings · Universal XSS via IE8s XSS Filters the sordid tale of a wayward hash sign slides:

Stylish XSS

Xss a fondo

XSS - brutelogic.com.brbrutelogic.com.br/docs/XSS-FTW.pdf · Agenda Fast Intro to XSS Dangers of XSS Virtual Defacement LSD - Leakage, Spying and Deceiving Account Stealing Memory

XSS Attacks Exploiting XSS Filter by Masato Kinugawa - CODE BLUE 2015

XSS SQLi sigurnost

XSS Google Persistentes

XSS Lightning talk

Chuyên đề XSS

Is XSS Solvable?

PHP's FIG and PSRs

Srikar Nadipally. Outline Finding and Exploiting XSS Vulnerabilities Standard Reflected XSS Stored XSS DOM based XSS Prevention of XSS attack Reflect

Ess xss homepage_framework_ecc_50_erp_2004

Xss Desvendado!

Complete xss walkthrough