New Methods in Automated XSS Detection – Ken Belva – AppSecUSA 2015
Text to Speech
Recorded at AppSecUSA 2015 in San Francisco
https://2015.appsecusa.org/
New Methods in Automated XSS Detection: Dynamic XSS Testing without Using Static Payloads
For the past 15+ years all major automated XSS detection methods rely on payloads. Payloads are static exploit strings with previously known variations of exploits and exploit syntaxes. This presentation shows examples dynamic methods that do not rely on payloads to figure out if an XSS vulnerability exists. Furthermore these methods can be extended to provide, for the first time, accurate Stored XSS detection and generate dynamic custom XSS exploits. This presentation will show the current well-known automated XSS detection methods and the short comings of using a static payload methodology. It will then describe a number of methods and techniques that are used to provide dynamic XSS analysis. Finally, it will demonstrate how to create dynamic custom XSS exploits based on the dynamic detection XSS method described earlier in the presentation.
Ken Belva
Owner, XSS Warrior, LLC
I'm a 15+ year cyber security veteran. Please speak with me about opportunities for my XSS tool xssWarrior and my CyberSec Analytics tool currently named Spire as well as Pen Testing.
-
Managed by the official OWASP Media Project https://www.owasp.org/index.php/OWASP_Media_Project
2015-10-20 13:43:49
source
Gloss