Tradecraft Security Weekly Subscribe

HTML5 Storage Exfil via XSS – Tradecraft Security Weekly #23

January 8, 2018

It is fairly common for pentesters to discover Cross-Site Scripting (XSS) vulnerabilities on web application assessments. Exploiting these issues potentially allow access to a user's session tokens enabling attackers to navigate a site as the victim in the context of the web application. In this episode the hosts Beau Bullock (@dafthack) & Mike Felch (@ustayready) demonstrate how to exploit a XSS vulnerability to access HTML5 local storage to steal a cookie. (Sorry the camera video feed froze at 9 minutes)

View Show Index

Full Audio

Related

Application security

Secure Ideas: A conversation with Kevin Johnson – Kevin Johnson – ISW23 #2

September 26, 2023

In this ISW interview, CRA's Bill Brenner catches up with Kevin Johnson of Secure Ideas for a chat about application security.

Cloud Threat Visibility: High-fidelity Forensics Plus Exposure Management – Ward Cobleigh – ISW23 #2

September 26, 2023

Why are we seeing a re-emergence of the demand for packet and flow-based forensic data in cloud environments? In this session, we’ll discuss three reasons why IT leaders still need the same if not even better visibility in the cloud than they have in their data centers. We’ll also discuss the growing demand for Threat Exposure Management (TEM). W...

Uber CISO Trial Learnings for CISOs: In the CISO’s Own Words – Joe Sullivan – CSP #141

September 26, 2023

In the Fall, 2016, Uber experienced a data breach, and the CISO faced the possibility of prison time for felony obstruction and misprision for failure to report the 2016 breach. He was sentenced in May, 2023 to 3 years’ probation. Join the former CISO of Uber as we discuss the events which led to the prosecution case, the results of the trial and a...