XSS: The 3 Letter Monster

•

0 recomendaciones•1,033 vistas

Nishant Das Patnaik

I presented this at BarCamp 5 at PayPal Office Chennai.

Tecnología

</XSS>: The 3 Letter Monster Nishant Das Patnaik Venue: PayPal 4th December 2010

~# whoami Security Analyst, eBay IPC Author, Software Hacking (with AnkitFadia) Guest Columnist, The Times of India; The Telegraph Researcher, ClubHack; NullCon Core Developer, SHANK (Portable Multi-Boot Security OS) President, N.E.H.A. Cyber Espionage Specialist Contributing Member, CorelanTeam; IHP Trained 3000+ Students, Professionals on Security Audit … a fun-loving guy who lives down the lane!

./agenda ./scenario: The scene so far ./details: What is XSS? ./impact: What can XSS do? ./victims: Who are suffering? ./targets: Who are being exploited? ./entrypoints: Where does XSS live? ./detection: How to find XSS? ./protection: How to protect from XSS? ./resources: Where to learn more? Q & A

./details What is XSS? XSS is NOT a vulnerability! It's an attack, an injection attack. The strcpy() of Web! Exploits your trust on the site. Types: ,[object Object]

Persistent (Recurring; Less Common; More Dangerous)

Can make me your girlfriend’s boyfriend!

… anything else I missed? ;),[object Object]

Más contenido relacionado

Similar a XSS: The 3 Letter Monster

ShadyRAT: Anatomy of targeted attackVladyslav Radetsky

HackingDianna Marie Manalo

HackingYhannah

Rishi Malik - How to write insecure software: It's easier then you think!Rishi Malik

Hack the book MiniKhairi Aiman

Weaponizing OSINT – Hacker Halted 2019 – Michael James EC-Council

Threat Hunting with SplunkSplunk

Down The Rabbit Hole, From Networker to Security ProfessionalSatria Ady Pradana

Ethical Hacking, Its relevance and Its ProspectsRwik Kumar Dutta

Ethical Hacking by Krutarth VasavadaKrutarth Vasavada

Ethical Hacking & Network Security Lokender Yadav

Network SecurityPuneet Abichandani

Cyber Security Awareness Program.pptxDinesh582831

Effective 2FA - Part 1: the technical stuffConorGilsenan1

HackingPaidi Dinesh

Secure encryption in a wiretapped futureMichael Renner

Threat Hunting with SplunkSplunk

Agile Chennai 2022 - Shyam Sundar | Everything there is to know about Cyber s...AgileNetwork

RSA 2015 Bitcoin's Future Threats: Expert's Roundtable based on 150 Case StudiesWayne Huang

Similar a XSS: The 3 Letter Monster (20)

ShadyRAT: Anatomy of targeted attack

Hacking

Rishi Malik - How to write insecure software: It's easier then you think!

Hack the book Mini

Weaponizing OSINT – Hacker Halted 2019 – Michael James

Threat Hunting with Splunk

Down The Rabbit Hole, From Networker to Security Professional

Ethical Hacking, Its relevance and Its Prospects

Ethical Hacking by Krutarth Vasavada

Ethical Hacking & Network Security

Network Security

Cyber Security Awareness Program.pptx

Effective 2FA - Part 1: the technical stuff

Hacking

Secure encryption in a wiretapped future

Threat Hunting with Splunk

Agile Chennai 2022 - Shyam Sundar | Everything there is to know about Cyber s...

RSA 2015 Bitcoin's Future Threats: Expert's Roundtable based on 150 Case Studies

Último

HTML Injection Attacks: Impact and Mitigation StrategiesBoston Institute of Analytics

Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024The Digital Insurer

Connector Corner: Accelerate revenue generation using UiPath API-centric busi...DianaGray10

AWS Community Day CPH - Three problems of TerraformAndrey Devyatkin

Real Time Object Detection Using Open CVKhem

The 7 Things I Know About Cyber Security After 25 Years | April 2024Rafal Los

Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoffsammart93

Exploring the Future Potential of AI-Enabled Smartphone Processorsdebabhi2

Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUK Journal

Boost PC performance: How more available memory can improve productivityPrincipled Technologies

04-2024-HHUG-Sales-and-Marketing-Alignment.pptxHampshireHUG

Boost Fertility New Invention Ups Success Rates.pdfsudhanshuwaghmare1

Scaling API-first – The story of a global engineering organizationRadu Cotescu

Tech Trends Report 2024 Future Today Institute.pdfhans926745

Partners Life - Insurer Innovation Award 2024The Digital Insurer

Tata AIG General Insurance Company - Insurer Innovation Award 2024The Digital Insurer

Automating Google Workspace (GWS) & more with Apps Scriptwesley chun

Handwritten Text Recognition for manuscripts and early printed textsMaria Levchenko

ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProduct Anonymous

Data Cloud, More than a CDP by Matt RobisonAnna Loughnan Colquhoun

XSS: The 3 Letter Monster

1. </XSS>: The 3 Letter Monster Nishant Das Patnaik Venue: PayPal 4th December 2010

2. ~# whoami Security Analyst, eBay IPC Author, Software Hacking (with AnkitFadia) Guest Columnist, The Times of India; The Telegraph Researcher, ClubHack; NullCon Core Developer, SHANK (Portable Multi-Boot Security OS) President, N.E.H.A. Cyber Espionage Specialist Contributing Member, CorelanTeam; IHP Trained 3000+ Students, Professionals on Security Audit … a fun-loving guy who lives down the lane!

3. ./agenda ./scenario: The scene so far ./details: What is XSS? ./impact: What can XSS do? ./victims: Who are suffering? ./targets: Who are being exploited? ./entrypoints: Where does XSS live? ./detection: How to find XSS? ./protection: How to protect from XSS? ./resources: Where to learn more? Q & A

4. ./scenario

6. Persistent (Recurring; Less Common; More Dangerous)

8. Can make me your girlfriend’s boyfriend!

9. Order 1000 pizzas for you!

10. Can fetch me your Credit Card number.

11. Take a snap of your bedroom.

12. Download Google.com’s Source Code

13.

14. ./targets YOU!

15. … anything I missed? ./entrypoints

16. ./detection Manual “><script>prompt(11)</script> <object data=“javascript:prompt(1)”> <imgsrc=x:alert(alt) onerror=eval(src) alt=123> Automated Skipfish Ratproxy W3AF Burp Suite WebScarab WebSecurify XSSF XSS Me

17.

18. NoScript

19. Chrome XSS Filter

20.

21. OWASPAntiSamy (Java, .NET)

22. HTMLPurifier (PHP)

23. OWASP ReFormer (Various)

24. PHPIDS (PHP)

25. mod_security (Apache)

26.

27. ./thankyou Questions? Google “Nishant Das Patnaik” @dpnishant facebook.com/nishant.dp youtube.com/nishantdp in.linkedin.com/in/nishantdaspatnaik