XSS: The 3 Letter Monster

•

0 j'aime•1,033 vues

Nishant Das Patnaik

I presented this at BarCamp 5 at PayPal Office Chennai.

Technologie

</XSS>: The 3 Letter Monster Nishant Das Patnaik Venue: PayPal 4th December 2010

~# whoami Security Analyst, eBay IPC Author, Software Hacking (with AnkitFadia) Guest Columnist, The Times of India; The Telegraph Researcher, ClubHack; NullCon Core Developer, SHANK (Portable Multi-Boot Security OS) President, N.E.H.A. Cyber Espionage Specialist Contributing Member, CorelanTeam; IHP Trained 3000+ Students, Professionals on Security Audit … a fun-loving guy who lives down the lane!

./agenda ./scenario: The scene so far ./details: What is XSS? ./impact: What can XSS do? ./victims: Who are suffering? ./targets: Who are being exploited? ./entrypoints: Where does XSS live? ./detection: How to find XSS? ./protection: How to protect from XSS? ./resources: Where to learn more? Q & A

./details What is XSS? XSS is NOT a vulnerability! It's an attack, an injection attack. The strcpy() of Web! Exploits your trust on the site. Types: ,[object Object]

Persistent (Recurring; Less Common; More Dangerous)

Can make me your girlfriend’s boyfriend!

… anything else I missed? ;),[object Object]

Recommandé

What is IT security[1]justin johnson

JavaScript Static Analysis Tools and Techniques - STP Online Session 2013Noah Sussman

Ethical HackingPushkar Pashupat

OpenSourceIntelligence-OSINT.pptxanonymousanonymous428352

Why do women love chasing down bad guys? SITA

Threat Hunting with Splunk Hands-onSplunk

Xss talk, attack and defensePrakashchand Suthar

Ethical hacking for information securityJayanth Vinay

Recommandé

What is IT security[1]justin johnson

JavaScript Static Analysis Tools and Techniques - STP Online Session 2013Noah Sussman

Ethical HackingPushkar Pashupat

OpenSourceIntelligence-OSINT.pptxanonymousanonymous428352

Why do women love chasing down bad guys? SITA

Threat Hunting with Splunk Hands-onSplunk

Xss talk, attack and defensePrakashchand Suthar

Ethical hacking for information securityJayanth Vinay

ShadyRAT: Anatomy of targeted attackVladyslav Radetsky

HackingDianna Marie Manalo

HackingYhannah

Rishi Malik - How to write insecure software: It's easier then you think!Rishi Malik

Hack the book MiniKhairi Aiman

Weaponizing OSINT – Hacker Halted 2019 – Michael James EC-Council

Threat Hunting with SplunkSplunk

Down The Rabbit Hole, From Networker to Security ProfessionalSatria Ady Pradana

Ethical Hacking, Its relevance and Its ProspectsRwik Kumar Dutta

Ethical Hacking by Krutarth VasavadaKrutarth Vasavada

Ethical Hacking & Network Security Lokender Yadav

Network SecurityPuneet Abichandani

Cyber Security Awareness Program.pptxDinesh582831

Effective 2FA - Part 1: the technical stuffConorGilsenan1

HackingPaidi Dinesh

Secure encryption in a wiretapped futureMichael Renner

Threat Hunting with SplunkSplunk

Agile Chennai 2022 - Shyam Sundar | Everything there is to know about Cyber s...AgileNetwork

RSA 2015 Bitcoin's Future Threats: Expert's Roundtable based on 150 Case StudiesWayne Huang

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoffsammart93

Exploring Multimodal Embeddings with MilvusZilliz

Contenu connexe

Similaire à XSS: The 3 Letter Monster

ShadyRAT: Anatomy of targeted attackVladyslav Radetsky

HackingDianna Marie Manalo

HackingYhannah

Rishi Malik - How to write insecure software: It's easier then you think!Rishi Malik

Hack the book MiniKhairi Aiman

Weaponizing OSINT – Hacker Halted 2019 – Michael James EC-Council

Threat Hunting with SplunkSplunk

Down The Rabbit Hole, From Networker to Security ProfessionalSatria Ady Pradana

Ethical Hacking, Its relevance and Its ProspectsRwik Kumar Dutta

Ethical Hacking by Krutarth VasavadaKrutarth Vasavada

Ethical Hacking & Network Security Lokender Yadav

Network SecurityPuneet Abichandani

Cyber Security Awareness Program.pptxDinesh582831

Effective 2FA - Part 1: the technical stuffConorGilsenan1

HackingPaidi Dinesh

Secure encryption in a wiretapped futureMichael Renner

Threat Hunting with SplunkSplunk

Agile Chennai 2022 - Shyam Sundar | Everything there is to know about Cyber s...AgileNetwork

RSA 2015 Bitcoin's Future Threats: Expert's Roundtable based on 150 Case StudiesWayne Huang

Similaire à XSS: The 3 Letter Monster (20)

ShadyRAT: Anatomy of targeted attack

Hacking

Rishi Malik - How to write insecure software: It's easier then you think!

Hack the book Mini

Weaponizing OSINT – Hacker Halted 2019 – Michael James

Threat Hunting with Splunk

Down The Rabbit Hole, From Networker to Security Professional

Ethical Hacking, Its relevance and Its Prospects

Ethical Hacking by Krutarth Vasavada

Ethical Hacking & Network Security

Network Security

Cyber Security Awareness Program.pptx

Effective 2FA - Part 1: the technical stuff

Hacking

Secure encryption in a wiretapped future

Threat Hunting with Splunk

Agile Chennai 2022 - Shyam Sundar | Everything there is to know about Cyber s...

RSA 2015 Bitcoin's Future Threats: Expert's Roundtable based on 150 Case Studies

Dernier

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoffsammart93

Exploring Multimodal Embeddings with MilvusZilliz

Boost Fertility New Invention Ups Success Rates.pdfsudhanshuwaghmare1

AWS Community Day CPH - Three problems of TerraformAndrey Devyatkin

Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...apidays

AXA XL - Insurer Innovation Award Americas 2024The Digital Insurer

TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc

MINDCTI Revenue Release Quarter One 2024MIND CTI

How to Troubleshoot Apps for the Modern Connected WorkerThousandEyes

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...?#DUbAI#??##{{(☎️+971_581248768%)**%*]'#abortion pills for sale in dubai@

Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...apidays

presentation ICT roal in 21st century educationjfdjdjcjdnsjd

CNIC Information System with Pakdata Cf In Pakistandanishmna97

Corporate and higher education May webinar.pptxRustici Software

Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...Orbitshub

ICT role in 21st century education and its challengesrafiqahmad00786416

Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...Jeffrey Haguewood

Ransomware_Q4_2023. The report. [EN].pdfOverkill Security

Why Teams call analytics are critical to your entire businesspanagenda

Spring Boot vs Quarkus the ultimate battle - DevoxxUKJago de Vreede

Dernier (20)

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff

Exploring Multimodal Embeddings with Milvus

Boost Fertility New Invention Ups Success Rates.pdf

AWS Community Day CPH - Three problems of Terraform

Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...

AXA XL - Insurer Innovation Award Americas 2024

TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery

MINDCTI Revenue Release Quarter One 2024

How to Troubleshoot Apps for the Modern Connected Worker

+971581248768>> SAFE AND ORIGINAL ABORTION PILLS FOR SALE IN DUBAI AND ABUDHA...

Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...

presentation ICT roal in 21st century education

CNIC Information System with Pakdata Cf In Pakistan

Corporate and higher education May webinar.pptx

Navigating the Deluge_ Dubai Floods and the Resilience of Dubai International...

ICT role in 21st century education and its challenges

Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...

Ransomware_Q4_2023. The report. [EN].pdf

Why Teams call analytics are critical to your entire business

Spring Boot vs Quarkus the ultimate battle - DevoxxUK

XSS: The 3 Letter Monster

1. </XSS>: The 3 Letter Monster Nishant Das Patnaik Venue: PayPal 4th December 2010

2. ~# whoami Security Analyst, eBay IPC Author, Software Hacking (with AnkitFadia) Guest Columnist, The Times of India; The Telegraph Researcher, ClubHack; NullCon Core Developer, SHANK (Portable Multi-Boot Security OS) President, N.E.H.A. Cyber Espionage Specialist Contributing Member, CorelanTeam; IHP Trained 3000+ Students, Professionals on Security Audit … a fun-loving guy who lives down the lane!

3. ./agenda ./scenario: The scene so far ./details: What is XSS? ./impact: What can XSS do? ./victims: Who are suffering? ./targets: Who are being exploited? ./entrypoints: Where does XSS live? ./detection: How to find XSS? ./protection: How to protect from XSS? ./resources: Where to learn more? Q & A

4. ./scenario

6. Persistent (Recurring; Less Common; More Dangerous)

8. Can make me your girlfriend’s boyfriend!

9. Order 1000 pizzas for you!

10. Can fetch me your Credit Card number.

11. Take a snap of your bedroom.

12. Download Google.com’s Source Code

13.

14. ./targets YOU!

15. … anything I missed? ./entrypoints

16. ./detection Manual “><script>prompt(11)</script> <object data=“javascript:prompt(1)”> <imgsrc=x:alert(alt) onerror=eval(src) alt=123> Automated Skipfish Ratproxy W3AF Burp Suite WebScarab WebSecurify XSSF XSS Me

17.

18. NoScript

19. Chrome XSS Filter

20.

21. OWASPAntiSamy (Java, .NET)

22. HTMLPurifier (PHP)

23. OWASP ReFormer (Various)

24. PHPIDS (PHP)

25. mod_security (Apache)

26.

27. ./thankyou Questions? Google “Nishant Das Patnaik” @dpnishant facebook.com/nishant.dp youtube.com/nishantdp in.linkedin.com/in/nishantdaspatnaik