New Methods in Automated XSS Detection

Ken Belva at AppSec USA 2015

For the past 15+ years all major automated XSS detection methods rely on payloads. Payloads are static exploit strings with previously known variations of exploits and exploit syntaxes. This presentation shows examples dynamic methods that do not rely on payloads to figure out if an XSS vulnerability exists. Furthermore these methods can be extended to provide, for the first time, accurate Stored XSS detection and generate dynamic custom XSS exploits. This presentation will show the current well-known automated XSS detection methods and the short comings of using a static payload methodology. It will then describe a number of methods and techniques that are used to provide dynamic XSS analysis. Finally, it will demonstrate how to create dynamic custom XSS exploits based on the dynamic detection XSS method described earlier in the presentation.

Ken Belva
Owner, XSS Warrior, LLC
I'm a 15+ year cyber security veteran. Please speak with me about opportunities for my XSS tool xssWarrior and my CyberSec Analytics tool currently named Spire as well as Pen Testing.