JSFoo 2018

On JavaScript and Security

Tickets

Everything you need to know about Client-side Malicious Code Execution

Submitted by Lavakumar Kuppan (@lavakumark) on Thursday, 31 May 2018


Preview video

Section: Full Talk Technical level: Intermediate

View proposal in schedule

Abstract

Malicious Code Execution is considered to be one of the most serious security issues across any technology. This has plagued client-side JavaScript in the form of Cross-site Scripting. Though this issue has been around since the early days of the web, its variations, prevention techniques and detection mechanisms have evolved over time. This talk will cover everything a modern developer absolutely must know about on client-side malicious code execution.

Outline

- Introduction to Client-side Code Execution and all of its variants
    ○ Reflected Server XSS
    ○ Reflected Client XSS
    ○ Stored Client XSS
      □ Server-side Store
      □ Client-side Store
    ○ Cross-origin Client XSS

- Code patterns and APIs that cause Client-side Code Execution

- Client-side Code Execution in modern frameworks like Angular, React etc.

- Detection of Client-side Code Execution

- Recommendations to prevent Client-side Code Execution
    ○ Proper use of APIs
    ○ Encoding
    ○ Content Security Policy

Speaker bio

Lavakumar Kuppan is the founder of Ironwasp Security. He is a security researcher and a product developer. He has done extensive research on web security with special focus on JavaScript security. He has discovered several novel attacks vectors and vulnerabilities and has spoken about his research in several international conferences.
He has also done extensive work on developing open source tools to discover security issues in JavaScript, through both static and dynamic analysis.

Links

Preview video

https://vimeo.com/272820862

Comments

  • Eddie yadav (@eddie007) 6 months ago

    Hello friends if you use bing search engine and you earn the more external are use in this website http://bingrewards.info bing rewards points

Login with Twitter or Google to leave a comment