XSS Street-Fight: The Only Rule Is There Are No Rules

[Prince]

• XSS Intro

• What is it?

• Real-world compromise of Apache.org

• XSS Remediation

• Strategic vs. Tactical

• When you can’t fix the code

• XSS Street-Fight

• Input Validation

− Whitelist Filtering

− Blacklist Filtering

− Generic Attack Payload Detection

• Identify Output Handling Flaws

− Missing output escaping of user-supplied content

• Application Response Profiling

− Track the # of scripts/iframes in pages

• Defensive JS Injection

− JS Sandbox

• Conclusion/Questions

Please, Log in or Register to view URLs content!