OWASP AppSec DC 2009
Title: User Input Piercing for Cross-Site Scripting Attacks
Presenter: Matias Blanco, exploit writer
Date and Time: November 12, 2009 at 5:30pm
Location: Walter E. Washington Convention Center, Washington, DC
Link to event: http://www.owasp.org/index.php/OWASP_AppSec_DC_200
Overview:
This paper presents algorithms and techniques for performing user input piercing on a web application. We also introduce a heuristic to determine if a given cross-site scripting attack will effectively execute scripting code on the compromised browser. In addition, an algorithm to detect the need of encoding techniques will be presented.
