Top 10 winner

Attacking "Modern" Web Technologies

Frans Rosén · OWASP AppSec Europe

Three attack families against widely deployed web features: AppCache manifests abused by cookie bombing so a forced 500 makes the FALLBACK page serve a whole directory or origin, weak cloud upload policies that let business logic be bypassed, and postMessage handlers that leak data, can be raced, or execute attacker script through sandboxed domains.

Record

Researcher

Frans Rosén

Published by

OWASP AppSec Europe

Format

Slides

In the archive

• Ranked #5 in the 2018 Top 10 Web Hacking Techniques

Related sources

• Talk recording
• Talk recording

Tags

• postmessage
• cache-poisoning
• xss
• file-upload
• cookie
• sop-bypass
• race-condition
• browser-extension
• bug-bounty
• owasp-a01-2021
• owasp-a03-2021
• owasp-a04-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Frans Rosén, first published at the original source. Preserved copies are kept so the citation survives its host.