Presentation Material
Abstract
Web 2.0 applications are using dynamic DOM manipulations extensively for presenting JSON or XML streams in the browser. These DOM calls mixed with XMLHttpRequest (XHR) object are part of client side logic written in JavaScript or part of any other client side technology be it Flash or Silverlight. DOM driven XSS is a sleeping giant in the application code and it can be exploited by an attacker to gain access to the end user’s browser/desktop. This can become a root cause of following set of interesting vulnerabilities – Cross Widget Sniffing, RSS feed reader exploitation, XHR response stealing, Mashup hacking, Malicious code injection, Spreading Worm etc. This set of vulnerability needs innovative way of scanning the application and corresponding methodology needs to be tweaked. We have seen DOM driven XSS exploited in various different popular portals to spread worm or virus. This is a significant threat on the rise and should be mitigated by validating un-trusted content poisoning Ajax or Flash routines. DOM driven XSS, Cross Domain Bypass and CSRF can cause a deadly cocktail to exploit Web 2.0 applications across Internet. This presentation will be covering following important issues and concepts.
- Web 2.0 Architecture and DOM manipulation points
- JavaScript exploits by leveraging DOM
- Cross Domain Bypass and Hacks
- DOM hacking for controlling Widgets and Mashups
- Exploiting Ajax routines to gain feed readers
- Scanning and detecting DOM driven XSS in Web 2.0
- Tools for scanning the DOM calls
- Mitigation strategies for better security posture
AI Generated Summarymay contain errors
Here is a summarized version of the content:
The speaker is explaining how Web 2.0 applications work, specifically focusing on the interaction between the client-side rich interface and the backend resources.
Client-Side:
- Rich clients (e.g., JavaScript) manipulate the Document Object Model (DOM)
- Typical web clients (browsers) access the application through HTML
- No full page reloads; only DOM updates
Backend:
- Web server runs in a DMZ (demilitarized zone)
- Backend application servers access databases
- Web 2.0 resources include web services, JSON RPCs, XML RPCs, etc.
Interaction:
- Rich clients make direct calls to backend resources using technologies like Ajax, XHR, and JSON RPCs
- No full page reloads; only DOM updates
The speaker demonstrates this concept using examples from PageFlex.com and Firebug. They show how a single-page application can make multiple Ajax calls to fetch different information from the backend, resulting in a dynamic user interface.
Additionally, the speaker explains that dissecting the application reveals the backend JavaScript files, ASMX files (Microsoft’s web services technology), and other resources that enable the Web 2.0 functionality.