BlackHatEU : Universal XSS via IE8s XSS Filters
April 15th, 2010
No comments
By David Lindsay & Eduardo Vela Nava
The talk is about abusing the anti-XSS filters built into IE8 to always be able to perform XSS.
Microsoft decided to implement anti-XSS measures in IE because XSS is so common. On the other hand the wanted to be careful not to break the web and to keep things performant and the solution itself had to be secure.
So how do these filters work?
• Examine all outbound requests for XSS patterns using heuristics filters.
• If something matches the filter a dynamic signature is generated
• If the signature matches then the response is neutered.
Read more…
Categories: BlackHatEU, Conferences, Security Barcelona, Blackhat, BlackHatEU, Conference, Cross Site Scripting, IE8, Internet Explorer, Microsoft, Security, XSS