OWASP AppSec DC 2012/DOMJacking Attack Exploit and Defense

Registration Now OPEN! | Hotel | Schedule | Convention Center | AppSecDC.org

The Presentation

Browsers architecture and usage are ever changing in todays world. Browser cannot be considered a thin client in this new era, it is very much a thick client and capable of loading very interesting applications. Ajax, RIA (Adobe), Silverlight and HTML5 are key ingredients of next generation applications. Document Object Model (DOM) is the most critical component of the browser; it allows various different technologies to glue at a single point. DOM is emerging as a potential battlefield for future application and can be considered as an interesting entry point. DOM can be attacked and exploited if it is implemented poorly across client side application. DOMJacking is an interesting vector and allows exploitation of various different interesting tags like object. Object tag holds application components like flash, Silverlight, applet etc. It is possible to hijack DOM and create various abuse cases and scenario. In this talk we are going to cover attack vectors encompassing DOM which can lead to exploitation of Browser components like HTML5, RIA and Silverlight. We will be covering various interesting concepts, threat vectors and innovative defense mechanism along with real life cases and demos.

The Speakers

Shreeraj Shah Bio TBA

---

Gold Sponsors
Silver Sponsors
Small Business
Exhibitors