Cross-Site Request Forgery
“The Sleeping Giant of Website Vulnerabilities”
Jeremiah Grossman | WhiteHat Security | 04/09/08 | Session Code: HT1-20304

Jeremiah Grossman
– WhiteHat Security Founder & CTO
– Technology R&D and industry evangelist
(Named to InfoWorld's CTO Top 25 for 2007)
– Frequent international conference speaker
– Co-founder of the Web Application
Security Consortium
– Co-author: Cross-Site Scripting Attacks
– Former Yahoo! information security officer

Focus on “custom web applications”
Vulnerability Stack
WhiteHat
Security
“well-known”
vulnerabilities
Symantec
Qualys
Nessus
nCircle

Target #1
– 162 million websites
– 809,000+ websites with SSL-certificates
– Many are mission-critical and gateways to highly sensitive customer
and corporate information
– These websites