Download as PDF, PPTX
Uploaded bySimon Willison
PDF, PPTX13,171 views
Web App Security Horror Stories
This document summarizes Simon Willison's talk on web app security vulnerabilities and lessons learned from past mistakes. It discusses cross-site scripting (XSS) vulnerabilities that allow attackers to steal users' cookies or show fake login pages. It also covers SQL injection attacks, cross-site request forgery (CSRF), and how even features like CSS can be exploited. Past incidents like Samy's MySpace worm and the Google UTF-7 hole are examined to illustrate the dangers if vulnerabilities are left unaddressed. The talk emphasizes following best practices like parameterization and CSRF tokens to prevent common exploits.
