SlideShare a Scribd company logo
JAVASCRIPT goneWILD Akash Mahajan | jsFoo 2011
WARNING NSFW Don’t say I didn’t warn you. This presentation is Not Safe For Work.
Don’t worry No Dirty Pictures I swear this presentation doesn’t have dirty pictures in it.
DISCLAIMER This presentation is low on technical content.  Tech Lite
Why bother? INCEPTION Planting the seed of an idea.
What is the idea? JavaScript code showing up in  unexpected  places can have  unintended  consequences. Can you have fun and profit from this somehow?
Wild Idea #1 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Firesheep also does session hijacking by stealing cookies in transit.
Wild Idea #1.5 One can steal username and password with JS in a login form.
Wilder Idea #2 ,[object Object],[object Object],[object Object],[object Object],[object Object],Do you regularly check the link you get from google to your site?
Wilder Idea #2.5 What if the JavaScript redirects users to a malicious download page?
Wildest Idea #3 ,[object Object],[object Object],[object Object],Obviously you all have changed the default password long back, right
Wildest Idea #3.5 Allowing untrusted code in the browser is not the smartest thing to do.
His WILDNESS!!! Samy Kamkar wrote JS code to get more friends in MySpace.  At one point he had over a million friends in less than 24 hours
Jumping to conclusions JavaScript can be pretty wild if it shows up in  unexpected  places. The very idea that  outside code  is allowed  execution  in the browser is radical and dangerous.
PIMPING MYSELF/ QnA ,[object Object],[object Object],[object Object],[object Object]
References, Attribution ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

More Related Content

What's hot

WordPress Security Essentials WordCamp Denver 2012
WordPress Security Essentials WordCamp Denver 2012WordPress Security Essentials WordCamp Denver 2012
WordPress Security Essentials WordCamp Denver 2012
Angela Bowman
 
How To Lock Down And Secure Your Wordpress
How To Lock Down And Secure Your WordpressHow To Lock Down And Secure Your Wordpress
How To Lock Down And Secure Your WordpressChelsea O'Brien
 
Secure wordpress site
Secure wordpress siteSecure wordpress site
Secure wordpress site
firojkhansahu
 
Security Isn't Scary and It's Not Rocket Science either.
Security Isn't Scary and It's Not Rocket Science either.Security Isn't Scary and It's Not Rocket Science either.
Security Isn't Scary and It's Not Rocket Science either.Michele Butcher-Jones
 
Web and mobile security workshop workbook v1 - by santhosh tuppad
Web and mobile security workshop   workbook v1 - by santhosh tuppadWeb and mobile security workshop   workbook v1 - by santhosh tuppad
Web and mobile security workshop workbook v1 - by santhosh tuppad
Santhosh Tuppad
 
Matematicas ii
Matematicas iiMatematicas ii
Matematicas ii
Natalia Parra
 
Passwords, Attacks, and Security oh my!
Passwords, Attacks, and Security oh my!Passwords, Attacks, and Security oh my!
Passwords, Attacks, and Security oh my!
Michele Butcher-Jones
 
WordPress Security
WordPress SecurityWordPress Security
WordPress Security
Marilyn N
 
Security-Web Vulnerabilities-Browser Attacks
Security-Web Vulnerabilities-Browser AttacksSecurity-Web Vulnerabilities-Browser Attacks
Security-Web Vulnerabilities-Browser Attacks
Raghu Addanki
 
RUNNING A SECURITY CHECK FOR YOUR WORDPRESS SITE
RUNNING A SECURITY CHECK FOR YOUR WORDPRESS SITERUNNING A SECURITY CHECK FOR YOUR WORDPRESS SITE
RUNNING A SECURITY CHECK FOR YOUR WORDPRESS SITE
Acodez IT Solutions
 
Sucuri Webinar: How to Clean a Hacked Magento Website
Sucuri Webinar: How to Clean a Hacked Magento WebsiteSucuri Webinar: How to Clean a Hacked Magento Website
Sucuri Webinar: How to Clean a Hacked Magento Website
Sucuri
 
Locking Down Your WordPress Site
Locking Down Your WordPress SiteLocking Down Your WordPress Site
Locking Down Your WordPress Site
Frank Corso
 
Awesome Tips for Data Security
Awesome Tips for Data SecurityAwesome Tips for Data Security
Awesome Tips for Data Security
Millennium Systems International
 
Sucuri Webinar: How to Optimize Your Website for Best Performance
Sucuri Webinar: How to Optimize Your Website for Best PerformanceSucuri Webinar: How to Optimize Your Website for Best Performance
Sucuri Webinar: How to Optimize Your Website for Best Performance
Sucuri
 
Checkear si esta_inslatado_un_modulo_en_apache
Checkear si esta_inslatado_un_modulo_en_apacheCheckear si esta_inslatado_un_modulo_en_apache
Checkear si esta_inslatado_un_modulo_en_apacheJames Jara
 
Bug Bounty for - Beginners
Bug Bounty for - BeginnersBug Bounty for - Beginners
Bug Bounty for - Beginners
Himanshu Kumar Das
 
Basic Scary DNS
Basic Scary DNSBasic Scary DNS
Basic Scary DNS
evilsquelch
 
Website Security AMA: Best Practices
Website Security AMA: Best Practices Website Security AMA: Best Practices
Website Security AMA: Best Practices
Adam W. Warner
 
Oh no, was that CSRF #Ouch
Oh no, was that CSRF #Ouch Oh no, was that CSRF #Ouch
Oh no, was that CSRF #Ouch
Abhinav Sejpal
 
Week5 BA
Week5 BAWeek5 BA
Week5 BACMoz
 

What's hot (20)

WordPress Security Essentials WordCamp Denver 2012
WordPress Security Essentials WordCamp Denver 2012WordPress Security Essentials WordCamp Denver 2012
WordPress Security Essentials WordCamp Denver 2012
 
How To Lock Down And Secure Your Wordpress
How To Lock Down And Secure Your WordpressHow To Lock Down And Secure Your Wordpress
How To Lock Down And Secure Your Wordpress
 
Secure wordpress site
Secure wordpress siteSecure wordpress site
Secure wordpress site
 
Security Isn't Scary and It's Not Rocket Science either.
Security Isn't Scary and It's Not Rocket Science either.Security Isn't Scary and It's Not Rocket Science either.
Security Isn't Scary and It's Not Rocket Science either.
 
Web and mobile security workshop workbook v1 - by santhosh tuppad
Web and mobile security workshop   workbook v1 - by santhosh tuppadWeb and mobile security workshop   workbook v1 - by santhosh tuppad
Web and mobile security workshop workbook v1 - by santhosh tuppad
 
Matematicas ii
Matematicas iiMatematicas ii
Matematicas ii
 
Passwords, Attacks, and Security oh my!
Passwords, Attacks, and Security oh my!Passwords, Attacks, and Security oh my!
Passwords, Attacks, and Security oh my!
 
WordPress Security
WordPress SecurityWordPress Security
WordPress Security
 
Security-Web Vulnerabilities-Browser Attacks
Security-Web Vulnerabilities-Browser AttacksSecurity-Web Vulnerabilities-Browser Attacks
Security-Web Vulnerabilities-Browser Attacks
 
RUNNING A SECURITY CHECK FOR YOUR WORDPRESS SITE
RUNNING A SECURITY CHECK FOR YOUR WORDPRESS SITERUNNING A SECURITY CHECK FOR YOUR WORDPRESS SITE
RUNNING A SECURITY CHECK FOR YOUR WORDPRESS SITE
 
Sucuri Webinar: How to Clean a Hacked Magento Website
Sucuri Webinar: How to Clean a Hacked Magento WebsiteSucuri Webinar: How to Clean a Hacked Magento Website
Sucuri Webinar: How to Clean a Hacked Magento Website
 
Locking Down Your WordPress Site
Locking Down Your WordPress SiteLocking Down Your WordPress Site
Locking Down Your WordPress Site
 
Awesome Tips for Data Security
Awesome Tips for Data SecurityAwesome Tips for Data Security
Awesome Tips for Data Security
 
Sucuri Webinar: How to Optimize Your Website for Best Performance
Sucuri Webinar: How to Optimize Your Website for Best PerformanceSucuri Webinar: How to Optimize Your Website for Best Performance
Sucuri Webinar: How to Optimize Your Website for Best Performance
 
Checkear si esta_inslatado_un_modulo_en_apache
Checkear si esta_inslatado_un_modulo_en_apacheCheckear si esta_inslatado_un_modulo_en_apache
Checkear si esta_inslatado_un_modulo_en_apache
 
Bug Bounty for - Beginners
Bug Bounty for - BeginnersBug Bounty for - Beginners
Bug Bounty for - Beginners
 
Basic Scary DNS
Basic Scary DNSBasic Scary DNS
Basic Scary DNS
 
Website Security AMA: Best Practices
Website Security AMA: Best Practices Website Security AMA: Best Practices
Website Security AMA: Best Practices
 
Oh no, was that CSRF #Ouch
Oh no, was that CSRF #Ouch Oh no, was that CSRF #Ouch
Oh no, was that CSRF #Ouch
 
Week5 BA
Week5 BAWeek5 BA
Week5 BA
 

Similar to javascript-gone-wild-withreferences-attributions-111003035611-php

How to secure web applications
How to secure web applicationsHow to secure web applications
How to secure web applications
Mohammed A. Imran
 
Javascript Security - Three main methods of defending your MEAN stack
Javascript Security - Three main methods of defending your MEAN stackJavascript Security - Three main methods of defending your MEAN stack
Javascript Security - Three main methods of defending your MEAN stack
Ran Bar-Zik
 
Clickjacking DevCon2011
Clickjacking DevCon2011Clickjacking DevCon2011
Clickjacking DevCon2011Krishna T
 
Immersive realities to the web
Immersive realities to the webImmersive realities to the web
Immersive realities to the web
yamama shakaa
 
8 Most Common Joomla! Hacks and How to Avoid Them
8 Most Common Joomla! Hacks and How to Avoid Them8 Most Common Joomla! Hacks and How to Avoid Them
8 Most Common Joomla! Hacks and How to Avoid Them
Daniel Kanchev
 
Security Theatre - AmsterdamPHP
Security Theatre - AmsterdamPHPSecurity Theatre - AmsterdamPHP
Security Theatre - AmsterdamPHP
xsist10
 
Bug Bounty #Defconlucknow2016
Bug Bounty #Defconlucknow2016Bug Bounty #Defconlucknow2016
Bug Bounty #Defconlucknow2016
Shubham Gupta
 
Javascript Security
Javascript SecurityJavascript Security
Javascript Security
jgrahamc
 
Cyber Security Workshop @SPIT- 3rd October 2015
Cyber Security Workshop @SPIT- 3rd October 2015Cyber Security Workshop @SPIT- 3rd October 2015
Cyber Security Workshop @SPIT- 3rd October 2015
Nilesh Sapariya
 
Rv defcon25 keeping an eye on mobile applications - mikhail sosonkin
Rv defcon25   keeping an eye on mobile applications - mikhail sosonkinRv defcon25   keeping an eye on mobile applications - mikhail sosonkin
Rv defcon25 keeping an eye on mobile applications - mikhail sosonkin
reconvillage
 
PHPUG Presentation
PHPUG PresentationPHPUG Presentation
PHPUG Presentation
Damon Cortesi
 
Don't let your WordPress site get hacked
Don't let your WordPress site get hackedDon't let your WordPress site get hacked
Don't let your WordPress site get hacked
Victoria Darling
 
Shifting Gears
Shifting GearsShifting Gears
Shifting Gears
Christian Heilmann
 
Cloud adoption fails - 5 ways deployments go wrong and 5 solutions
Cloud adoption fails - 5 ways deployments go wrong and 5 solutionsCloud adoption fails - 5 ways deployments go wrong and 5 solutions
Cloud adoption fails - 5 ways deployments go wrong and 5 solutions
Yevgeniy Brikman
 
A Practical Guide to Securing Modern Web Applications
A Practical Guide to Securing Modern Web ApplicationsA Practical Guide to Securing Modern Web Applications
A Practical Guide to Securing Modern Web Applications
Manish Shekhawat
 
Security Theatre - Benelux
Security Theatre - BeneluxSecurity Theatre - Benelux
Security Theatre - Benelux
xsist10
 
Deadly pixels - NSC 2013
Deadly pixels - NSC 2013Deadly pixels - NSC 2013
Deadly pixels - NSC 2013
Saumil Shah
 
Owasp top 10 web application security hazards part 2
Owasp top 10 web application security hazards part 2Owasp top 10 web application security hazards part 2
Owasp top 10 web application security hazards part 2
Abhinav Sejpal
 
So you wanna be a pentester - free webinar to show you how
So you wanna be a pentester - free webinar to show you howSo you wanna be a pentester - free webinar to show you how
So you wanna be a pentester - free webinar to show you how
Joe McCray
 
Android mobile app security offensive security workshop
Android mobile app security   offensive security workshopAndroid mobile app security   offensive security workshop
Android mobile app security offensive security workshopAbhinav Sejpal
 

Similar to javascript-gone-wild-withreferences-attributions-111003035611-php (20)

How to secure web applications
How to secure web applicationsHow to secure web applications
How to secure web applications
 
Javascript Security - Three main methods of defending your MEAN stack
Javascript Security - Three main methods of defending your MEAN stackJavascript Security - Three main methods of defending your MEAN stack
Javascript Security - Three main methods of defending your MEAN stack
 
Clickjacking DevCon2011
Clickjacking DevCon2011Clickjacking DevCon2011
Clickjacking DevCon2011
 
Immersive realities to the web
Immersive realities to the webImmersive realities to the web
Immersive realities to the web
 
8 Most Common Joomla! Hacks and How to Avoid Them
8 Most Common Joomla! Hacks and How to Avoid Them8 Most Common Joomla! Hacks and How to Avoid Them
8 Most Common Joomla! Hacks and How to Avoid Them
 
Security Theatre - AmsterdamPHP
Security Theatre - AmsterdamPHPSecurity Theatre - AmsterdamPHP
Security Theatre - AmsterdamPHP
 
Bug Bounty #Defconlucknow2016
Bug Bounty #Defconlucknow2016Bug Bounty #Defconlucknow2016
Bug Bounty #Defconlucknow2016
 
Javascript Security
Javascript SecurityJavascript Security
Javascript Security
 
Cyber Security Workshop @SPIT- 3rd October 2015
Cyber Security Workshop @SPIT- 3rd October 2015Cyber Security Workshop @SPIT- 3rd October 2015
Cyber Security Workshop @SPIT- 3rd October 2015
 
Rv defcon25 keeping an eye on mobile applications - mikhail sosonkin
Rv defcon25   keeping an eye on mobile applications - mikhail sosonkinRv defcon25   keeping an eye on mobile applications - mikhail sosonkin
Rv defcon25 keeping an eye on mobile applications - mikhail sosonkin
 
PHPUG Presentation
PHPUG PresentationPHPUG Presentation
PHPUG Presentation
 
Don't let your WordPress site get hacked
Don't let your WordPress site get hackedDon't let your WordPress site get hacked
Don't let your WordPress site get hacked
 
Shifting Gears
Shifting GearsShifting Gears
Shifting Gears
 
Cloud adoption fails - 5 ways deployments go wrong and 5 solutions
Cloud adoption fails - 5 ways deployments go wrong and 5 solutionsCloud adoption fails - 5 ways deployments go wrong and 5 solutions
Cloud adoption fails - 5 ways deployments go wrong and 5 solutions
 
A Practical Guide to Securing Modern Web Applications
A Practical Guide to Securing Modern Web ApplicationsA Practical Guide to Securing Modern Web Applications
A Practical Guide to Securing Modern Web Applications
 
Security Theatre - Benelux
Security Theatre - BeneluxSecurity Theatre - Benelux
Security Theatre - Benelux
 
Deadly pixels - NSC 2013
Deadly pixels - NSC 2013Deadly pixels - NSC 2013
Deadly pixels - NSC 2013
 
Owasp top 10 web application security hazards part 2
Owasp top 10 web application security hazards part 2Owasp top 10 web application security hazards part 2
Owasp top 10 web application security hazards part 2
 
So you wanna be a pentester - free webinar to show you how
So you wanna be a pentester - free webinar to show you howSo you wanna be a pentester - free webinar to show you how
So you wanna be a pentester - free webinar to show you how
 
Android mobile app security offensive security workshop
Android mobile app security   offensive security workshopAndroid mobile app security   offensive security workshop
Android mobile app security offensive security workshop
 

More from Apoorvi Kapoor (20)

2slidedeck-150318164339-conversion-gate01
2slidedeck-150318164339-conversion-gate012slidedeck-150318164339-conversion-gate01
2slidedeck-150318164339-conversion-gate01
 
Hiking guide2014
Hiking guide2014Hiking guide2014
Hiking guide2014
 
Readme
ReadmeReadme
Readme
 
Empty
EmptyEmpty
Empty
 
111111
111111111111
111111
 
03 03 what_aboutbigdata
03 03 what_aboutbigdata03 03 what_aboutbigdata
03 03 what_aboutbigdata
 
Hiking guide2014
Hiking guide2014Hiking guide2014
Hiking guide2014
 
111111
111111111111
111111
 
Abcd feihfiewfn
Abcd feihfiewfnAbcd feihfiewfn
Abcd feihfiewfn
 
Slide share culture_code_template
Slide share culture_code_templateSlide share culture_code_template
Slide share culture_code_template
 
Webtech1b
Webtech1bWebtech1b
Webtech1b
 
Webtech1b
Webtech1bWebtech1b
Webtech1b
 
Webtech1b
Webtech1bWebtech1b
Webtech1b
 
Test
TestTest
Test
 
5x5
5x55x5
5x5
 
Lorem
LoremLorem
Lorem
 
SlideShare Hack Day 2013
SlideShare Hack Day 2013SlideShare Hack Day 2013
SlideShare Hack Day 2013
 
Profile Pictures
Profile PicturesProfile Pictures
Profile Pictures
 
SlideShare HACK Day 2013
SlideShare HACK Day 2013SlideShare HACK Day 2013
SlideShare HACK Day 2013
 
SlideShare HACK Day 2013
SlideShare HACK Day 2013SlideShare HACK Day 2013
SlideShare HACK Day 2013
 

Recently uploaded

Advantages and Disadvantages of CMS from an SEO Perspective
Advantages and Disadvantages of CMS from an SEO PerspectiveAdvantages and Disadvantages of CMS from an SEO Perspective
Advantages and Disadvantages of CMS from an SEO Perspective
Krisztián Száraz
 
How to Make a Field invisible in Odoo 17
How to Make a Field invisible in Odoo 17How to Make a Field invisible in Odoo 17
How to Make a Field invisible in Odoo 17
Celine George
 
Francesca Gottschalk - How can education support child empowerment.pptx
Francesca Gottschalk - How can education support child empowerment.pptxFrancesca Gottschalk - How can education support child empowerment.pptx
Francesca Gottschalk - How can education support child empowerment.pptx
EduSkills OECD
 
Guidance_and_Counselling.pdf B.Ed. 4th Semester
Guidance_and_Counselling.pdf B.Ed. 4th SemesterGuidance_and_Counselling.pdf B.Ed. 4th Semester
Guidance_and_Counselling.pdf B.Ed. 4th Semester
Atul Kumar Singh
 
The Accursed House by Émile Gaboriau.pptx
The Accursed House by Émile Gaboriau.pptxThe Accursed House by Émile Gaboriau.pptx
The Accursed House by Émile Gaboriau.pptx
DhatriParmar
 
Unit 2- Research Aptitude (UGC NET Paper I).pdf
Unit 2- Research Aptitude (UGC NET Paper I).pdfUnit 2- Research Aptitude (UGC NET Paper I).pdf
Unit 2- Research Aptitude (UGC NET Paper I).pdf
Thiyagu K
 
Digital Tools and AI for Teaching Learning and Research
Digital Tools and AI for Teaching Learning and ResearchDigital Tools and AI for Teaching Learning and Research
Digital Tools and AI for Teaching Learning and Research
Vikramjit Singh
 
STRAND 3 HYGIENIC PRACTICES.pptx GRADE 7 CBC
STRAND 3 HYGIENIC PRACTICES.pptx GRADE 7 CBCSTRAND 3 HYGIENIC PRACTICES.pptx GRADE 7 CBC
STRAND 3 HYGIENIC PRACTICES.pptx GRADE 7 CBC
kimdan468
 
Best Digital Marketing Institute In NOIDA
Best Digital Marketing Institute In NOIDABest Digital Marketing Institute In NOIDA
Best Digital Marketing Institute In NOIDA
deeptiverma2406
 
A Survey of Techniques for Maximizing LLM Performance.pptx
A Survey of Techniques for Maximizing LLM Performance.pptxA Survey of Techniques for Maximizing LLM Performance.pptx
A Survey of Techniques for Maximizing LLM Performance.pptx
thanhdowork
 
Mule 4.6 & Java 17 Upgrade | MuleSoft Mysore Meetup #46
Mule 4.6 & Java 17 Upgrade | MuleSoft Mysore Meetup #46Mule 4.6 & Java 17 Upgrade | MuleSoft Mysore Meetup #46
Mule 4.6 & Java 17 Upgrade | MuleSoft Mysore Meetup #46
MysoreMuleSoftMeetup
 
June 3, 2024 Anti-Semitism Letter Sent to MIT President Kornbluth and MIT Cor...
June 3, 2024 Anti-Semitism Letter Sent to MIT President Kornbluth and MIT Cor...June 3, 2024 Anti-Semitism Letter Sent to MIT President Kornbluth and MIT Cor...
June 3, 2024 Anti-Semitism Letter Sent to MIT President Kornbluth and MIT Cor...
Levi Shapiro
 
Model Attribute Check Company Auto Property
Model Attribute  Check Company Auto PropertyModel Attribute  Check Company Auto Property
Model Attribute Check Company Auto Property
Celine George
 
Overview on Edible Vaccine: Pros & Cons with Mechanism
Overview on Edible Vaccine: Pros & Cons with MechanismOverview on Edible Vaccine: Pros & Cons with Mechanism
Overview on Edible Vaccine: Pros & Cons with Mechanism
DeeptiGupta154
 
The basics of sentences session 5pptx.pptx
The basics of sentences session 5pptx.pptxThe basics of sentences session 5pptx.pptx
The basics of sentences session 5pptx.pptx
heathfieldcps1
 
Chapter 3 - Islamic Banking Products and Services.pptx
Chapter 3 - Islamic Banking Products and Services.pptxChapter 3 - Islamic Banking Products and Services.pptx
Chapter 3 - Islamic Banking Products and Services.pptx
Mohd Adib Abd Muin, Senior Lecturer at Universiti Utara Malaysia
 
CACJapan - GROUP Presentation 1- Wk 4.pdf
CACJapan - GROUP Presentation 1- Wk 4.pdfCACJapan - GROUP Presentation 1- Wk 4.pdf
CACJapan - GROUP Presentation 1- Wk 4.pdf
camakaiclarkmusic
 
How libraries can support authors with open access requirements for UKRI fund...
How libraries can support authors with open access requirements for UKRI fund...How libraries can support authors with open access requirements for UKRI fund...
How libraries can support authors with open access requirements for UKRI fund...
Jisc
 
Azure Interview Questions and Answers PDF By ScholarHat
Azure Interview Questions and Answers PDF By ScholarHatAzure Interview Questions and Answers PDF By ScholarHat
Azure Interview Questions and Answers PDF By ScholarHat
Scholarhat
 
Normal Labour/ Stages of Labour/ Mechanism of Labour
Normal Labour/ Stages of Labour/ Mechanism of LabourNormal Labour/ Stages of Labour/ Mechanism of Labour
Normal Labour/ Stages of Labour/ Mechanism of Labour
Wasim Ak
 

Recently uploaded (20)

Advantages and Disadvantages of CMS from an SEO Perspective
Advantages and Disadvantages of CMS from an SEO PerspectiveAdvantages and Disadvantages of CMS from an SEO Perspective
Advantages and Disadvantages of CMS from an SEO Perspective
 
How to Make a Field invisible in Odoo 17
How to Make a Field invisible in Odoo 17How to Make a Field invisible in Odoo 17
How to Make a Field invisible in Odoo 17
 
Francesca Gottschalk - How can education support child empowerment.pptx
Francesca Gottschalk - How can education support child empowerment.pptxFrancesca Gottschalk - How can education support child empowerment.pptx
Francesca Gottschalk - How can education support child empowerment.pptx
 
Guidance_and_Counselling.pdf B.Ed. 4th Semester
Guidance_and_Counselling.pdf B.Ed. 4th SemesterGuidance_and_Counselling.pdf B.Ed. 4th Semester
Guidance_and_Counselling.pdf B.Ed. 4th Semester
 
The Accursed House by Émile Gaboriau.pptx
The Accursed House by Émile Gaboriau.pptxThe Accursed House by Émile Gaboriau.pptx
The Accursed House by Émile Gaboriau.pptx
 
Unit 2- Research Aptitude (UGC NET Paper I).pdf
Unit 2- Research Aptitude (UGC NET Paper I).pdfUnit 2- Research Aptitude (UGC NET Paper I).pdf
Unit 2- Research Aptitude (UGC NET Paper I).pdf
 
Digital Tools and AI for Teaching Learning and Research
Digital Tools and AI for Teaching Learning and ResearchDigital Tools and AI for Teaching Learning and Research
Digital Tools and AI for Teaching Learning and Research
 
STRAND 3 HYGIENIC PRACTICES.pptx GRADE 7 CBC
STRAND 3 HYGIENIC PRACTICES.pptx GRADE 7 CBCSTRAND 3 HYGIENIC PRACTICES.pptx GRADE 7 CBC
STRAND 3 HYGIENIC PRACTICES.pptx GRADE 7 CBC
 
Best Digital Marketing Institute In NOIDA
Best Digital Marketing Institute In NOIDABest Digital Marketing Institute In NOIDA
Best Digital Marketing Institute In NOIDA
 
A Survey of Techniques for Maximizing LLM Performance.pptx
A Survey of Techniques for Maximizing LLM Performance.pptxA Survey of Techniques for Maximizing LLM Performance.pptx
A Survey of Techniques for Maximizing LLM Performance.pptx
 
Mule 4.6 & Java 17 Upgrade | MuleSoft Mysore Meetup #46
Mule 4.6 & Java 17 Upgrade | MuleSoft Mysore Meetup #46Mule 4.6 & Java 17 Upgrade | MuleSoft Mysore Meetup #46
Mule 4.6 & Java 17 Upgrade | MuleSoft Mysore Meetup #46
 
June 3, 2024 Anti-Semitism Letter Sent to MIT President Kornbluth and MIT Cor...
June 3, 2024 Anti-Semitism Letter Sent to MIT President Kornbluth and MIT Cor...June 3, 2024 Anti-Semitism Letter Sent to MIT President Kornbluth and MIT Cor...
June 3, 2024 Anti-Semitism Letter Sent to MIT President Kornbluth and MIT Cor...
 
Model Attribute Check Company Auto Property
Model Attribute  Check Company Auto PropertyModel Attribute  Check Company Auto Property
Model Attribute Check Company Auto Property
 
Overview on Edible Vaccine: Pros & Cons with Mechanism
Overview on Edible Vaccine: Pros & Cons with MechanismOverview on Edible Vaccine: Pros & Cons with Mechanism
Overview on Edible Vaccine: Pros & Cons with Mechanism
 
The basics of sentences session 5pptx.pptx
The basics of sentences session 5pptx.pptxThe basics of sentences session 5pptx.pptx
The basics of sentences session 5pptx.pptx
 
Chapter 3 - Islamic Banking Products and Services.pptx
Chapter 3 - Islamic Banking Products and Services.pptxChapter 3 - Islamic Banking Products and Services.pptx
Chapter 3 - Islamic Banking Products and Services.pptx
 
CACJapan - GROUP Presentation 1- Wk 4.pdf
CACJapan - GROUP Presentation 1- Wk 4.pdfCACJapan - GROUP Presentation 1- Wk 4.pdf
CACJapan - GROUP Presentation 1- Wk 4.pdf
 
How libraries can support authors with open access requirements for UKRI fund...
How libraries can support authors with open access requirements for UKRI fund...How libraries can support authors with open access requirements for UKRI fund...
How libraries can support authors with open access requirements for UKRI fund...
 
Azure Interview Questions and Answers PDF By ScholarHat
Azure Interview Questions and Answers PDF By ScholarHatAzure Interview Questions and Answers PDF By ScholarHat
Azure Interview Questions and Answers PDF By ScholarHat
 
Normal Labour/ Stages of Labour/ Mechanism of Labour
Normal Labour/ Stages of Labour/ Mechanism of LabourNormal Labour/ Stages of Labour/ Mechanism of Labour
Normal Labour/ Stages of Labour/ Mechanism of Labour
 

javascript-gone-wild-withreferences-attributions-111003035611-php

  • 1. JAVASCRIPT goneWILD Akash Mahajan | jsFoo 2011
  • 2. WARNING NSFW Don’t say I didn’t warn you. This presentation is Not Safe For Work.
  • 3. Don’t worry No Dirty Pictures I swear this presentation doesn’t have dirty pictures in it.
  • 4. DISCLAIMER This presentation is low on technical content. Tech Lite
  • 5. Why bother? INCEPTION Planting the seed of an idea.
  • 6. What is the idea? JavaScript code showing up in unexpected places can have unintended consequences. Can you have fun and profit from this somehow?
  • 7.
  • 8. Wild Idea #1.5 One can steal username and password with JS in a login form.
  • 9.
  • 10. Wilder Idea #2.5 What if the JavaScript redirects users to a malicious download page?
  • 11.
  • 12. Wildest Idea #3.5 Allowing untrusted code in the browser is not the smartest thing to do.
  • 13. His WILDNESS!!! Samy Kamkar wrote JS code to get more friends in MySpace. At one point he had over a million friends in less than 24 hours
  • 14. Jumping to conclusions JavaScript can be pretty wild if it shows up in unexpected places. The very idea that outside code is allowed execution in the browser is radical and dangerous.
  • 15.
  • 16.