JSFoo 2018

On JavaScript and Security

Everything you need to know about Client-side Malicious Code Execution

Submitted by Lavakumar Kuppan (@lavakumark) on Thursday, 31 May 2018

videocam
Preview video

Technical level

Intermediate

Section

Full Talk

Status

Confirmed & Scheduled

View proposal in schedule

Vote on this proposal

Login to vote

Total votes:  +1

Abstract

Malicious Code Execution is considered to be one of the most serious security issues across any technology. This has plagued client-side JavaScript in the form of Cross-site Scripting. Though this issue has been around since the early days of the web, its variations, prevention techniques and detection mechanisms have evolved over time. This talk will cover everything a modern developer absolutely must know about on client-side malicious code execution.

Outline

- Introduction to Client-side Code Execution and all of its variants
    ○ Reflected Server XSS
    ○ Reflected Client XSS
    ○ Stored Client XSS
      □ Server-side Store
      □ Client-side Store
    ○ Cross-origin Client XSS

- Code patterns and APIs that cause Client-side Code Execution

- Client-side Code Execution in modern frameworks like Angular, React etc.

- Detection of Client-side Code Execution

- Recommendations to prevent Client-side Code Execution
    ○ Proper use of APIs
    ○ Encoding
    ○ Content Security Policy

Speaker bio

Lavakumar Kuppan is the founder of Ironwasp Security. He is a security researcher and a product developer. He has done extensive research on web security with special focus on JavaScript security. He has discovered several novel attacks vectors and vulnerabilities and has spoken about his research in several international conferences.
He has also done extensive work on developing open source tools to discover security issues in JavaScript, through both static and dynamic analysis.

Links

Preview video

https://vimeo.com/272820862

Comments

Login with Twitter or Google to leave a comment