Client-Side Protection Against DOM-Based XSS Done Right
Comprehensive analysis of Chrome's XSS Auditor, revealing vulnerabilities and proposing an improved filter design using client-side taint tracking for robust DOM-XSS protection.
I Hope This Sticks - Analyzing ClipboardEvent Listeners for XSS
Explore ClipboardEvent listeners as potential XSS vectors in web applications. Learn techniques for identifying and exploiting vulnerabilities to enhance your offensive security skills.
Finding XSS on Apple.com and Building a Proof of Concept to Leak Your PII
Discover how to find XSS vulnerabilities on high-profile websites and create effective proof-of-concept exploits to demonstrate potential data leakage risks.
Getting Single Page Application Security Right
Explore SPA security challenges and solutions, covering XSS, CSP, session management, and CSRF in RESTful APIs. Learn practical strategies for building secure web applications using modern frameworks.
CSP Analysis - Attacking XSS Mitigation
Explore Content Security Policy, its attack types, and effectiveness in mitigating XSS vulnerabilities in web applications.
The Road Towards 365 Bugs in Microsoft Office 365
Discover vulnerabilities in Microsoft 365 applications, including cross-tenant privacy leaks, SQLi, CSRF, SSRF, and XSS. Learn bug hunting techniques and tips for testing new Office 365 features.
Everybody Wants SOME - Advance Same Origin Method Execution
Explore advanced Same Origin Method Execution attacks, demonstrating real-world vulnerabilities and new approaches to exploit callback endpoints across major platforms.
Portable Data exFiltration - XSS for PDFs
Explore PDF vulnerabilities and learn how a single HTTP link can compromise PDF contents, exposing security risks in widely-used document formats and generators.
Hunting Asynchronous Vulnerabilities
Explore techniques for uncovering hidden vulnerabilities in backend systems using exploit-induced callbacks. Learn to detect and exploit asynchronous issues across various technologies and platforms.
Ghosts of XSS Past, Present and Future
Comprehensive exploration of Cross-Site Scripting vulnerabilities, examining historical trends, current threats, and future challenges in web application security.
Game of Chromes - Owning the Web with Zombie Chrome Extensions
Explore how malicious Chrome extensions can create botnets, distribute themselves, and exploit vulnerabilities. Learn about attack patterns, extension capabilities, and security measures.
Call to Arms - A Tale of the Weaknesses of Current Client-Side XSS Filtering
Uncovers 17 flaws in Chrome's XSS Auditor, demonstrating bypasses and presenting a tool for generating attacks. Analyzes filter effectiveness against real-world vulnerabilities, proposing future improvements.
The Defense Rests - Automation and APIs for Improving Security
Explore automation and APIs for enhancing security through centralized management, testing, and evidence-driven approaches. Learn to leverage open-source tools and protocols for efficient vulnerability detection and faster recovery.
Practical Exploitation Using A Malicious Service Set Identifier - SSID
Explore SSID exploitation techniques for wireless device attacks, including XSS, CSRF, and command injection. Learn about limitations, risk factors, and see live demonstrations of these methods.
The Web Is Vulnerable - XSS Defense on the BattleFront
Comprehensive analysis of real-world XSS vulnerabilities and attacks, presenting advanced protection methods and introducing detectXSSlib, a new tool for real-time XSS detection.
Ultimate Dom Based XSS Detection Scanner on Cloud
Learn advanced techniques for detecting DOM-based XSS vulnerabilities using cloud-based scanning tools, enhancing web application security.
The Hidden XSS - Attacking the Desktop
Explore hidden XSS vulnerabilities in desktop applications, focusing on Skype, WebOS, and Android. Learn attack techniques and implications for security.
Bypassing Internet Explorer's XSS Filter
Explore techniques to bypass Internet Explorer's XSS filter, enhancing your understanding of web security vulnerabilities and protective measures.
OWASP 2014 Top 10 Proactive Web Application Controls
Explore proactive web application security controls, focusing on preventing SQL injection, XSS attacks, and implementing robust access controls and password policies.
How to Shot Web - Better Hacking in 2015
Explore advanced web hacking techniques, tools, and methodologies for improved vulnerability discovery and exploitation in modern web applications.
Understanding XSS
Comprehensive exploration of Cross-Site Scripting (XSS) vulnerabilities, covering detection, exploitation, and mitigation strategies for web application security professionals.