Thursday, November 08, 2012

XSS & CSRF with HTML5 - Attack, Exploit and Defense

HTML5 has empowered browser with a number of new features and functionalities. Browsers with this new architecture include features like XMLHttpRequest Object (L2), Local Storage, File System APIs, WebSQL, WebSocket, File APIs and many more. The browser is emerging as a platform like a little operating system and expanded its attack surface significantly. Applications developed in this new architecture are exposed to an interesting set of vulnerabilities and exploits. Both traditional vulnerabilities like CSRF and XSS can be exploited in this new HTML5 architecture. In this talk we will cover following new attack vectors and variants of XSS and CSRF.

HTML5 driven CSRF with XMLHttpRequest (Level 2)
CSRF with two way attack stream
Cross Site Response Extraction attacks using CSRF
Cross Origing Resource Sharing (CORS) policy hacking and CSRF injections
DOM based XSS with HTML5 applications
Exploiting HTML5 tags, attributes and events
DOM variable extraction with XSS
Exploiting Storage, File System and WebSQL with HTML5 XSS
Layered XSS and making it sticky with HTML5 based iframe sandbox
Jacking with HTML5 tags and features

In this session we will cover new methodology and tools along with some real life cases and demonstration. At the end we will cover some interesting defense methodologies to secure your HTML5 applications. My slides are as under (I will post video once get released)

54 comments:

Mary Sears said...

Great blog! Very informative. Html5 is very useful. Thanks.

Do you want to take html5 classes? Then check out Fresh Tilled Soil!

geetha said...

wonderful information, I had come to know about your blog from my friend nandu , hyderabad,i have read atleast 7 posts of yours by now, and let me tell you, your website gives the best and the most interesting information. This is just the kind of information that i had been looking for, i'm already your rss reader now and i would regularly watch out for the new posts, once again hats off to you! Thanks a ton once again, Regards, Html5 online trainingamong the Html5 in Hyderabad. Classroom Training in Hyderabad India

geetha said...

wonderful information, I had come to know about your blog from my friend nandu , hyderabad,i have read atleast 7 posts of yours by now, and let me tell you, your website gives the best and the most interesting information. This is just the kind of information that i had been looking for, i'm already your rss reader now and i would regularly watch out for the new posts, once again hats off to you! Thanks a ton once again, Regards, Html5 online trainingamong the Html5 in Hyderabad. Classroom Training in Hyderabad India

geetha said...

wonderful information, I had come to know about your blog from my friend nandu , hyderabad,i have read atleast 7 posts of yours by now, and let me tell you, your website gives the best and the most interesting information. This is just the kind of information that i had been looking for, i'm already your rss reader now and i would regularly watch out for the new posts, once again hats off to you! Thanks a ton once again, Regards, Html5 online trainingamong the Html5 in Hyderabad. Classroom Training in Hyderabad India

sam guleria said...

sir i am great fan of yours
the way you work please help me out i m stuckd in a problem
plz email me i ll tell you the problm

Arindam Banerjee said...

Thanks for sharing. To Learn HTML5 CSS3is to a new understanding of the responsive web Designing today and its importance moving forward.HTML5 CSS3 Training Institute Noida

jowdjbrown said...

Users could navigate around some French landmarks in a balloon:psd to drupal

Adlearning Technologies said...

Thank You for sharing your article. I like it. We provide TIBCO Online Training in Hyderabad.

Oracle Fusion said...

Thanks for posting the article on oracle apps. I am new for this website I feel happy reading this post.
R12 SCM Online Training

ORACLE FUSION PROCUREMENT said...

it is very valuable topic.this blog is very detailed about topic oracle apps.
Thanks for posting like valuable blogs.

ORACLE FUSION PROCUREMENT said...

it is very valuable topic.this blog is very detailed about topic oracle apps.
Thanks for posting like valuable blogs.
oracle fusion procurement online training

ERP said...

ERPTREE handles oracle fusion HCM training and its modules maintaining classroom based training with the self-paced videos. An expert having ten plus years of self-experience handles the training period through online and explains each and every point perfectly. We recently launched our institute in the USA and getting the best reputation over there.



Oracle fusion HCM Online Training

Oracle Fusion HCM Training

Nicole kristen said...

Thanks for this information This site is a fantastic resource. Keep up the great share. here i found all about oracle apps. The training explores each topic through the lens of a real-world example application.
oracle fusion hcm training at Mindmajix

oracle34 said...

Thanks for sharing
Grow your career in Oracle Fusion Financials Online Training with iGofusion self-paced videos

calfre search said...

Nice information. I was searching for the same. It helped me a lot and saved my time. For more information about Oracle Fusion PPM Training in Hyderabad

murali krishna said...

Thank you for sharing such a nice and interesting blog with us. I have seen that all will say the same thing repeatedly. But in your blog, I had a chance to get some useful and unique information.

Oracle Fusion HCM Online Training

murali krishna said...

Awesome post. your article is really informative and helpful for me and other bloggers too

Oracle Fusion SCM Online Training

murali krishna said...

Really very helpful article and Thank you for sharing

Oracle Fusion Technical Online Training

murali krishna said...

I would like to thank you for the efforts you have made in writing this article. I am hoping the same best work from you in the future as well.
Oracle Fusion Financials Online Training

RainbowTrainings Rajkumar said...

Thank you for providing useful information and this is the best article blog for the students. learn Oracle Fusion Financials Online Training.

Oracle Fusion Financials Online Training

RainbowTrainings Rajkumar said...

Thank you for sharing such a valuable article with good information containing in this blog. learn Oracle Fusion Technical Online Training.

Oracle Fusion Technical Online Training

jyothi kits said...

this is very good nice article. this is very useful
business analysis online course

jyothi kits said...

excellent blog
Devops Online Training

murali krishna said...

Very interesting blog Awesome post. your article is really informative and helpful for me and other bloggers too
Oracle Fusion Financials Online Training

murali krishna said...

Thank you for sharing such a nice and interesting blog and really very helpful article
Oracle Fusion SCM Online Training

suma chinni said...

This is the information that I was looking for. Thanks for the efforts you put to gather such a nice content and posted here.
Oracle Fusion SCM Training in Hyderabad

mahi eswari said...

Great info. I love all the posts, I really enjoyed,
nice post and site, good work!
I would like more information about this, because it is very nice.
AS/400 Training in hyderabad

shivani said...

Excellent blog I visit this blog it's really awesome. The important thing is that in this blog content written clearly and understandable. plz keep sharing...
Workday HCM Online Training!
Oracle Fusion Financials Online Training
Oracle Fusion HCM Online Training
Oracle Fusion SCM Online Training

shivani said...

Amazing web journal I visit this blog it's extremely marvelous. Interestingly, in this blog content composed plainly and reasonable. The substance of data is educational.
Oracle Fusion Financials Online Training
Oracle Fusion HCM Online Training
Oracle Fusion SCM Online Training

shivani said...

An astounding web diary I visit this blog, it's inconceivably magnificent. Strangely, in this current blog's substance made point of fact and sensible. The substance of information is instructive.
Oracle Fusion Financials Online Training
Oracle Fusion HCM Online Training
Oracle Fusion SCM Online Training
oracle Fusion Technical online training

shivani said...

Thanks for sharing a useful information.. we have learned so much information from your blog..... keep sharing
Oracle Fusion Financials Online Training
Oracle Fusion HCM Online Training
Oracle Fusion SCM Online Training

shivani said...

Excellent blog I visit this blog it's really awesome. The important thing is that in this blog content written clearly and understandable. The content of information is very informative.
Oracle Fusion Financials Online Training
Oracle Fusion HCM Online Training
Oracle Fusion SCM Online Training

shivani said...

Excellent blog I visit this blog it's really awesome. The important thing is that in this blog content written clearly and understandable. The content of information is very informative.
Oracle Fusion Financials Online Training
Oracle Fusion HCM Online Training
Oracle Fusion SCM Online Training

Rainbow Training Institute said...

Thanks for providing a useful article containing valuable information. start learning the best online software courses.

Workday Online Training

QuickBooks Payroll Support Phone Number said...

you are able to take the help of experts making a call at QuickBooks Payroll Support Phone Number Well! If you’re not in a position to customize employee payroll in.

jameswill11 said...

A lot of us is responsible and makes sure to deliver hundred percent assistance by working 24*7 to meet your requirements. Go ahead and mail us at our QuickBooks Customer Support Number email id whenever you are in need. You might reach us via call at our toll-free number.

jameswill11 said...

QuickBooks Payroll Tech Support Number software may be the better option. You can certainly do WCA, PAYE, SDL along with UIF calculations. This generates annual IT3A as well as IRP5. Employees also result in the loan.

jameswill11 said...

It gives you the facility of automated data backup and recovery. These features are actually perfect for the development of a person's business. QuickBooks Customer Support Number will likely be two versions Premier and Premier Plus. Both in the versions you will want to select the industry type during the time of installation.

kevin32 said...

QuickBooks Support Phone Number Premier is an accounting software which includes helped you grow your business smoothly. It provides some luring features which can make this software most desirable.

steffan said...

For such type of information, be always in contact with us through our blogs. To find the reliable supply of help to create customer checklist in QB desktop, QuickBooks online and intuit online payroll? Our Quickbooks Support Number might help you better.

accountingwizards said...

If you are aa QuickBooks enterprise user, you are able to reach us out immediately at our QuickBooks Enterprise Support Phone Number. QuickBooks technical help is present at our QuickBooks tech support number dial this and gets your solution from our technical experts. QuickBooks enterprise users will get support at our QuickBooks Support Phone Number if they're having difficulty with their software copy.

xpert said...

Encountering a slip-up or Technical break down of your QuickBooks or its functions can be associate degree obstacle and put your work on a halt. this can be not solely frustrating however additionally a heavy concern as all of your crucial information is saved on the code information. For the actual reason, dig recommends that you simply solely dial the authentic QuickBooks Support Phone Number sign anytime you would like any facilitate along with your QuickBooks.

steffan said...

For the rectification of the issue call Quickbooks Support Phone Number is can help the Quickbooks users are right people to pin point and fix the issue completely. They assure resolution in the minimum wait time that saves your time.

Mathew said...

QuickBooks Enterprise Customer Support Number to assist you because of the problem and solve QuickBooks Customer Support Number immediately. They often have a dedicated team of professionals who are designed for the issues and you'll be in a position to restore your software to its old working condition.

kevin32 said...

QuickBooks Phone Support Number troubleshooting team will allow you to in eradicating the errors which will pop-up quite often. There is certainly common problems that are encountered on daily basis by QuickBooks users.

kevin32 said...

Looking financial section of a company is the most essential and inconvenient task. Once you may take proper care of the running business and would like to bring your business to a different height then maintaining the QuickBooks Payroll Tech Support Number budgetary info is important.

jameswill11 said...

If are importing a file before saving it, QuickBooks Error 3371 can happen. quickbooks Error code 3371 can also happen if the latest OS updates are yet to be installed.

jameswill11 said...

If the data you provide is perhaps all correct together with your fund is sufficient in that case your whole taxes must be paid on time that may help save you from almost any penalty.QuickBooks Payroll Support Phone Number

kevin32 said...

You'll be able to very easily keep an eye on 50 employees at the same time and you also can monitor the sheer number of working hours of each employee. QuickBooks Payroll Support Phone Number helps you in calculating the complete soon add up to be paid to a worker depending through to the number of hours he/she has contributed in their work.

QuickBooks Customer Service Phone Number said...

Errors like data protection problem prevent QuickBooks Support Number from continuing in verify data utility. QuickBooks shuts down suddenly once you try to power down QuickBooks when you attempt to delete or save the transaction Faults in reports-Sometimes balance sheets try not to match total liabilities & equity. Entries & transactions are missing through the list.

QuickBooks Customer Service Phone Number said...

The unmatchable services by our supportive technical workers. Attributes of QuickBooks client Service We gives you QuickBooks 24/7 Support Phone Number Team. Our technicians be sure you the security of the vital business documents. We have a propensity to never compromise utilising the safety of your customers.

jameswill11 said...

If you are a business owner, you really must be aware of the fact that Payroll calculation does demands lot of time and man force. Then came into existence QuickBooks Enterprise Technical Support Number and Quickbooks Payroll customer care telephone number team.

steffan said...

QuickBooks Error 6000-301 encounters while trying to use a desktop company file. This may be either resolved by fixing manually with guidance received from QuickBooks experts or availing contact support through the specialist.

QuickBooks Customer Service Phone Number said...

There are various complaints which people have got with the American tax system and on 15 th April, the tax day, the chairman of Online Tax Revolt tells that QuickBooks Support he wants to rip out the tax from roots and replace it completely.