generated from lachlan-waugh/tut-template
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
9b1c035
commit 4cbc83b
Showing
15 changed files
with
623 additions
and
47 deletions.
There are no files selected for viewing
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
Large diffs are not rendered by default.
Oops, something went wrong.
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Large diffs are not rendered by default.
Oops, something went wrong.
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,9 +1,79 @@ | ||
| <?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Lectures on COMP6[84]45 Slides</title><link>/lectures/</link><description>Recent content in Lectures on COMP6[84]45 Slides</description><generator>Hugo</generator><language>en-au</language><atom:link href="/lectures/index.xml" rel="self" type="application/rss+xml"/><item><title>9: protections</title><link>/lectures/week9/</link><pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate><guid>/lectures/week9/</guid><description>client-side mitigations 6443 week9 pre-amble: reports slides are up on webcms demos are at github.com/lachlan-waugh/6443 go into demos/lectures and theres setup instructiong Origin https://www.example.com:80 | ||
| origin = scheme + host + port | ||
| Site http://www.example.com:80 | ||
| https://api.example.com:443 | ||
| site = private_domain + public_suffix | ||
| scheme, subdomain and port SOP (Same Origin Policy) blocks resource requests to/from an external site | ||
| &ldquo;external&rdquo; is based on sop: only requests from the same origin are allowed to use the resources</description></item><item><title>x8: cs</title><link>/lectures/ext8/</link><pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate><guid>/lectures/ext8/</guid><description>We&rsquo;ll get started at 18:05 client side attacks 6843 week8 overview how do browsers work? how can we exploit this mutation xss dom clobbering client-side js exploitation how do browsers work they render html, css, and js into the DOM | ||
| you can think of them kinda like an interpreters or a couple of interpreters (js + html parser) read more here | ||
| syntax errors what happens when a brower receives invalidly formatted content (js, html, css)?</description></item></channel></rss> | ||
| <?xml version="1.0" encoding="utf-8" standalone="yes"?><rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Lectures on COMP6[84]45 Slides</title><link>/lectures/</link><description>Recent content in Lectures on COMP6[84]45 Slides</description><generator>Hugo</generator><language>en-au</language><atom:link href="/lectures/index.xml" rel="self" type="application/rss+xml"/><item><title>9: protections</title><link>/lectures/9/</link><pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate><guid>/lectures/9/</guid><description><section data-noprocess data-shortcode-slide | ||
| class="center"> | ||
|
|
||
| <h2 id="client-side-mitigations">client-side mitigations</h2> | ||
| <h3 id="6443-week9">6443 week9</h3> | ||
| <hr> | ||
| <h3 id="pre-amble-reports">pre-amble: reports</h3> | ||
| <ul> | ||
| <li>slides are up on webcms</li> | ||
| <li>demos are at <a href="https://github.com/lachlan-waugh/6443">github.com/lachlan-waugh/6443</a> | ||
| <ul> | ||
| <li>go into demos/lectures and theres setup instructiong</li> | ||
| </ul> | ||
| </li> | ||
| </ul> | ||
| <hr> | ||
|
|
||
|
|
||
| <section data-shortcode-section> | ||
| <h3 id="origin">Origin</h3> | ||
| <blockquote> | ||
| <p><span style="color: #021691">https://</span><span style="color: #fffacd">www.example.com</span><span style="color: #7FFFD4">:80</span></p> | ||
| </blockquote> | ||
| <p>origin = <span style="color: #021691">scheme</span> + <span style="color: #fffacd">host</span> + <span style="color: #7FFFD4">port</span></p> | ||
| <hr> | ||
| <h3 id="site">Site</h3> | ||
| <blockquote> | ||
| <p><span style="color: #021691">http://</span><span style="color: #A52A2A">www.</span><u><span style="color: #fffacd">example</span><span style="color: #D2691E">.com</span></u><span style="color: #7FFFD4">:80</span><br> | ||
| <span style="color: #021691">https://</span><span style="color: #A52A2A">api.</span><u><span style="color: #fffacd">example</span><span style="color: #D2691E">.com</span></u><span style="color: #7FFFD4">:443</span></p> | ||
| </blockquote> | ||
| <p>site = <span style="color: #fffacd">private_domain</span> + <span style="color: #D2691E">public_suffix</span></p> | ||
| <ul> | ||
| <li><s><span style="color: #021691">scheme</span>, <span style="color: #A52A2A">subdomain</span> and <span style="color: #7FFFD4">port</span></s></li> | ||
| </ul> | ||
|
|
||
| </section> | ||
| <hr> | ||
|
|
||
|
|
||
| <section data-shortcode-section> | ||
| <h2 id="sop-same-origin-policy">SOP (Same Origin Policy)</h2> | ||
| <ul> | ||
| <li> | ||
| <p>blocks resource requests to/from an <em>external</em> site</p></description></item><item><title>x8: cs</title><link>/lectures/e8/</link><pubDate>Mon, 01 Jan 0001 00:00:00 +0000</pubDate><guid>/lectures/e8/</guid><description><h2 id="well-get-started-at-1805">We&rsquo;ll get started at 18:05</h2> | ||
| <hr> | ||
|
|
||
| <section data-noprocess data-shortcode-slide | ||
| class="center"> | ||
|
|
||
| <h2 id="client-side-attacks">client side attacks</h2> | ||
| <h3 id="6843-week8">6843 week8</h3> | ||
| <hr> | ||
| <h3 id="overview">overview</h3> | ||
| <ul> | ||
| <li>how do browsers work?</li> | ||
| <li>how can we exploit this | ||
| <ul> | ||
| <li>mutation xss</li> | ||
| <li>dom clobbering</li> | ||
| </ul> | ||
| </li> | ||
| <li>client-side js exploitation</li> | ||
| </ul> | ||
| <hr> | ||
|
|
||
|
|
||
| <section data-shortcode-section> | ||
| <h3 id="how-do-browsers-work">how do browsers work</h3> | ||
| <p>they render html, css, and js into the DOM</p> | ||
| <ul> | ||
| <li>you can think of them kinda like an interpreters</li> | ||
| <li>or a couple of interpreters (js + html parser)</li> | ||
| </ul> | ||
| <blockquote> | ||
| <p>read more <a href="https://developer.mozilla.org/en-US/docs/Web/API/Document_Object_Model/Introduction">here</a></p> | ||
| </blockquote> | ||
| <hr> | ||
| <h3 id="syntax-errors">syntax errors</h3> | ||
| <p>what happens when a brower receives invalidly formatted content (js, html, css)?</p></description></item></channel></rss> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| <?xml version="1.0" encoding="utf-8" standalone="yes"?><urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:xhtml="http://www.w3.org/1999/xhtml"><url><loc>/week1/</loc></url><url><loc>/week10/</loc></url><url><loc>/week2/</loc></url><url><loc>/week3/</loc></url><url><loc>/week4/</loc></url><url><loc>/week5/</loc></url><url><loc>/week7/</loc></url><url><loc>/week8/</loc></url><url><loc>/week9/</loc></url><url><loc>/lectures/week9/</loc></url><url><loc>/categories/</loc></url><url><loc>/</loc></url><url><loc>/help/</loc></url><url><loc>/lectures/</loc></url><url><loc>/tags/</loc></url><url><loc>/lectures/ext8/</loc></url></urlset> | ||
| <?xml version="1.0" encoding="utf-8" standalone="yes"?><urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:xhtml="http://www.w3.org/1999/xhtml"><url><loc>/1/</loc></url><url><loc>/10/</loc></url><url><loc>/2/</loc></url><url><loc>/3/</loc></url><url><loc>/4/</loc></url><url><loc>/5/</loc></url><url><loc>/7/</loc></url><url><loc>/8/</loc></url><url><loc>/9/</loc></url><url><loc>/lectures/9/</loc></url><url><loc>/categories/</loc></url><url><loc>/</loc></url><url><loc>/help/</loc></url><url><loc>/lectures/</loc></url><url><loc>/tags/</loc></url><url><loc>/lectures/e8/</loc></url></urlset> |