SlideShare a Scribd company logo

JavaScript Security

Jason Harwig, profile picture
Jason Harwig

This document summarizes security issues with JavaScript and discusses vulnerabilities like cross-site scripting (XSS) and cross-site request forgery (CSRF). It provides examples of how XSS can be used to steal cookies and hijack sessions. It also discusses challenges with securing JSON responses and preventing code injection attacks. Countermeasures discussed include escaping output, adding random tokens to forms, and using a secure comment syntax to wrap sensitive JSON responses.

Technology
1 of 81
Downloaded 479 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security
JavaScript Security

More Related Content

PPTX
Javascript Security
jgrahamc
 
PPTX
Java script, security and you - Tri-Cities Javascript Developers Group
Adam Caudill
 
PPTX
Client-side JavaScript Vulnerabilities
Ory Segal
 
PPTX
Javascript Security - Three main methods of defending your MEAN stack
Ran Bar-Zik
 
PPTX
Case Study of Django: Web Frameworks that are Secure by Default
Mohammed ALDOUB
 
PPTX
Django Web Application Security
levigross
 
PDF
Integrity protection for third-party JavaScript
Francois Marier
 
PDF
Practical django secuirty
Andy Dai
 
Javascript Security
jgrahamc
 
Java script, security and you - Tri-Cities Javascript Developers Group
Adam Caudill
 
Client-side JavaScript Vulnerabilities
Ory Segal
 
Javascript Security - Three main methods of defending your MEAN stack
Ran Bar-Zik
 
Case Study of Django: Web Frameworks that are Secure by Default
Mohammed ALDOUB
 
Django Web Application Security
levigross
 
Integrity protection for third-party JavaScript
Francois Marier
 
Practical django secuirty
Andy Dai
 

What's hot (20)

PDF
Integrity protection for third-party JavaScript
Francois Marier
 
PDF
Two scoops of Django - Security Best Practices
Spin Lai
 
PDF
Neat tricks to bypass CSRF-protection
Mikhail Egorov
 
PPT
Django (Web Applications that are Secure by Default)
Kishor Kumar
 
PDF
Polyglot payloads in practice by avlidienbrunn at HackPra
Mathias Karlsson
 
PDF
Ekoparty 2017 - The Bug Hunter's Methodology
bugcrowd
 
PDF
Web Security Horror Stories
Simon Willison
 
PPTX
XSS - Do you know EVERYTHING?
Yurii Bilyk
 
PDF
Defeating Cross-Site Scripting with Content Security Policy (updated)
Francois Marier
 
PPT
Xss is more than a simple threat
Avădănei Andrei
 
PDF
Breaking AngularJS Javascript sandbox
Mathias Karlsson
 
PDF
Flash умер. Да здравствует Flash!
Positive Hack Days
 
PPTX
Web Application Security in front end
Erlend Oftedal
 
PDF
New Methods in Automated XSS Detection & Dynamic Exploit Creation
Ken Belva
 
PDF
Building Advanced XSS Vectors
Rodolfo Assis (Brute)
 
PPTX
MITM Attacks on HTTPS: Another Perspective
GreenD0g
 
PDF
How to Shot Web - Jason Haddix at DEFCON 23 - See it Live: Details in Descrip...
bugcrowd
 
PDF
Google chrome presentation
reza jalaluddin
 
PDF
URL to HTML
Francois Marier
 
PDF
XXE Exposed: SQLi, XSS, XXE and XEE against Web Services
Abraham Aranguren
 
Integrity protection for third-party JavaScript
Francois Marier
 
Two scoops of Django - Security Best Practices
Spin Lai
 
Neat tricks to bypass CSRF-protection
Mikhail Egorov
 
Django (Web Applications that are Secure by Default)
Kishor Kumar
 
Polyglot payloads in practice by avlidienbrunn at HackPra
Mathias Karlsson
 
Ekoparty 2017 - The Bug Hunter's Methodology
bugcrowd
 
Web Security Horror Stories
Simon Willison
 
XSS - Do you know EVERYTHING?
Yurii Bilyk
 
Defeating Cross-Site Scripting with Content Security Policy (updated)
Francois Marier
 
Xss is more than a simple threat
Avădănei Andrei
 
Breaking AngularJS Javascript sandbox
Mathias Karlsson
 
Flash умер. Да здравствует Flash!
Positive Hack Days
 
Web Application Security in front end
Erlend Oftedal
 
New Methods in Automated XSS Detection & Dynamic Exploit Creation
Ken Belva
 
Building Advanced XSS Vectors
Rodolfo Assis (Brute)
 
MITM Attacks on HTTPS: Another Perspective
GreenD0g
 
How to Shot Web - Jason Haddix at DEFCON 23 - See it Live: Details in Descrip...
bugcrowd
 
Google chrome presentation
reza jalaluddin
 
URL to HTML
Francois Marier
 
XXE Exposed: SQLi, XSS, XXE and XEE against Web Services
Abraham Aranguren
 
Ad

Viewers also liked (13)

PPTX
Testing web application firewalls (waf) accuracy
Ory Segal
 
PDF
Web Vulnerabilities_NGAN Seok Chern
Quek Lilian
 
PPSX
06 asp.net session08
Vivek Singh Chandel
 
PPTX
Cyber Security Predictions 2016
Quick Heal Technologies Ltd.
 
PDF
STUDY: Website Vulnerability Assessment
Symantec
 
PPT
Client Side Exploits using PDF
n|u - The Open Security Community
 
PPTX
15 Years of Web Security: The Rebellious Teenage Years
Jeremiah Grossman
 
PPTX
Client side exploits
nickyt8
 
PDF
Statistics - Top Website Vulnerabilities
Jeremiah Grossman
 
PDF
Secure development automatic identification and mitigation of application v...
peihsin1980
 
PPTX
Slideshare.Com Powerpoint
guested929b
 
PDF
Alphorm.com Formation Hacking et Sécurité, l'essentiel
Alphorm
 
PDF
JavaScript Security
Johann-Peter Hartmann
 
Testing web application firewalls (waf) accuracy
Ory Segal
 
Web Vulnerabilities_NGAN Seok Chern
Quek Lilian
 
06 asp.net session08
Vivek Singh Chandel
 
Cyber Security Predictions 2016
Quick Heal Technologies Ltd.
 
STUDY: Website Vulnerability Assessment
Symantec
 
Client Side Exploits using PDF
n|u - The Open Security Community
 
15 Years of Web Security: The Rebellious Teenage Years
Jeremiah Grossman
 
Client side exploits
nickyt8
 
Statistics - Top Website Vulnerabilities
Jeremiah Grossman
 
Secure development automatic identification and mitigation of application v...
peihsin1980
 
Slideshare.Com Powerpoint
guested929b
 
Alphorm.com Formation Hacking et Sécurité, l'essentiel
Alphorm
 
JavaScript Security
Johann-Peter Hartmann
 
Ad

Similar to JavaScript Security (20)

KEY
DVWA BruCON Workshop
testuser1223
 
PDF
Rich Web App Security - Keeping your application safe
Jeremiah Grossman
 
PPT
Penetration Testing Basics
Rick Wanner
 
PPTX
Post XSS Exploitation : Advanced Attacks and Remedies
Adwiteeya Agrawal
 
PPTX
Security testing
Khizra Sammad
 
PDF
Ajax Security
Joe Walker
 
PPTX
Cross site scripting
kinish kumar
 
PPTX
6 - Web Application Security.pptx
AlmaOraevi
 
PDF
Security Vulnerabilities: How to Defend Against Them
Martin Vigo
 
KEY
Application Security for Rich Internet Applicationss (Jfokus 2012)
johnwilander
 
PPT
Web Apps Security
Victor Bucutea
 
PDF
The top 10 security issues in web applications
Devnology
 
PPTX
Cross-Site Scripting (XSS)
Daniel Tumser
 
PDF
Appsec XSS Case Study
Mohamed Ridha CHEBBI, CISSP
 
PPTX
Html5 security
Krishna T
 
PPTX
Web Exploitation Security
Aman Singh
 
PPTX
Web application security
Jin Castor
 
PPTX
Attacking Web Applications
Sasha Goldshtein
 
PDF
Web Security - Introduction v.1.3
Oles Seheda
 
PDF
Web Security - Introduction
SQALab
 
DVWA BruCON Workshop
testuser1223
 
Rich Web App Security - Keeping your application safe
Jeremiah Grossman
 
Penetration Testing Basics
Rick Wanner
 
Post XSS Exploitation : Advanced Attacks and Remedies
Adwiteeya Agrawal
 
Security testing
Khizra Sammad
 
Ajax Security
Joe Walker
 
Cross site scripting
kinish kumar
 
6 - Web Application Security.pptx
AlmaOraevi
 
Security Vulnerabilities: How to Defend Against Them
Martin Vigo
 
Application Security for Rich Internet Applicationss (Jfokus 2012)
johnwilander
 
Web Apps Security
Victor Bucutea
 
The top 10 security issues in web applications
Devnology
 
Cross-Site Scripting (XSS)
Daniel Tumser
 
Appsec XSS Case Study
Mohamed Ridha CHEBBI, CISSP
 
Html5 security
Krishna T
 
Web Exploitation Security
Aman Singh
 
Web application security
Jin Castor
 
Attacking Web Applications
Sasha Goldshtein
 
Web Security - Introduction v.1.3
Oles Seheda
 
Web Security - Introduction
SQALab
 

Recently uploaded (20)

PDF
Agricultural_Statistics_at_a_Glance_2022_0.pdf
SandeepSingh286037
 
PPTX
Big Data Technologies - Introduction.pptx
kuthubussaman1
 
PDF
Empathic Computing: Creating Shared Understanding
Mark Billinghurst
 
PPTX
20250228 LYD VKU AI Blended-Learning.pptx
DatVoNgoc
 
PDF
Mobile App Security Testing_ A Comprehensive Guide.pdf
flufftailshop
 
DOCX
The AUB Centre for AI in Media Proposal.docx
GAONE9
 
PDF
Diabetes mellitus diagnosis method based random forest with bat algorithm
IAESIJAI
 
PPTX
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
PPTX
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 
PPTX
Spectroscopy.pptx food analysis technology
nawahassan45
 
PDF
Review of recent advances in non-invasive hemoglobin estimation
IAESIJAI
 
PDF
Architecting across the Boundaries of two Complex Domains - Healthcare & Tech...
Peter Tan
 
PDF
Dropbox Q2 2025 Financial Results & Investor Presentation
Dropbox
 
PPTX
VMware vSphere Foundation How to Sell Presentation-Ver1.4-2-14-2024.pptx
blackmambaettijean
 
PDF
Per capita expenditure prediction using model stacking based on satellite ima...
IAESIJAI
 
PDF
Chapter 3 Spatial Domain Image Processing.pdf
Getnet Tigabie Askale -(GM)
 
PPTX
Effective Security Operations Center (SOC) A Modern, Strategic, and Threat-In...
ReZa AdineH
 
PDF
Build a system with the filesystem maintained by OSTree @ COSCUP 2025
Jian-Hong Pan
 
PPTX
MYSQL Presentation for SQL database connectivity
Swati270511
 
PPTX
Programs and apps: productivity, graphics, security and other tools
4mqw9zch22
 
Agricultural_Statistics_at_a_Glance_2022_0.pdf
SandeepSingh286037
 
Big Data Technologies - Introduction.pptx
kuthubussaman1
 
Empathic Computing: Creating Shared Understanding
Mark Billinghurst
 
20250228 LYD VKU AI Blended-Learning.pptx
DatVoNgoc
 
Mobile App Security Testing_ A Comprehensive Guide.pdf
flufftailshop
 
The AUB Centre for AI in Media Proposal.docx
GAONE9
 
Diabetes mellitus diagnosis method based random forest with bat algorithm
IAESIJAI
 
Digital-Transformation-Roadmap-for-Companies.pptx
David Malick Dieng
 
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
muhammadmuneebnaeem7
 
Spectroscopy.pptx food analysis technology
nawahassan45
 
Review of recent advances in non-invasive hemoglobin estimation
IAESIJAI
 
Architecting across the Boundaries of two Complex Domains - Healthcare & Tech...
Peter Tan
 
Dropbox Q2 2025 Financial Results & Investor Presentation
Dropbox
 
VMware vSphere Foundation How to Sell Presentation-Ver1.4-2-14-2024.pptx
blackmambaettijean
 
Per capita expenditure prediction using model stacking based on satellite ima...
IAESIJAI
 
Chapter 3 Spatial Domain Image Processing.pdf
Getnet Tigabie Askale -(GM)
 
Effective Security Operations Center (SOC) A Modern, Strategic, and Threat-In...
ReZa AdineH
 
Build a system with the filesystem maintained by OSTree @ COSCUP 2025
Jian-Hong Pan
 
MYSQL Presentation for SQL database connectivity
Swati270511
 
Programs and apps: productivity, graphics, security and other tools
4mqw9zch22