The Age of Universal XSS

In August 1996, Internet Explorer joined the JavaScript security scene after they added JScript. During this era from around 1996-2000, tons of bugs were found what we would call today "Universal Cross-site Scripting". I find this word confusing, but looking back at the history, we can try to make sense of it.

Episode 03:
00:00 - Intro to the "Age of Universal XSS"
01:16 - JavaScript Security in Netscape 1996
01:52 - JScript Vulnerability in Internet Explorer
03:38 - Georgi Guninski: IE can read local files (1998)
05:12 - Who is Georgi Guninski?
06:36 - Georgi Guninski: IE 5 circumventing cross-frame security policy
09:41 - David Ross from Microsoft about Georgi
10:16 - "Cross-Frame" Browser Bugs
11:17 - Universal Cross-Site Scripting
12:15 - Outro

-=[ ❤️ Support ]=-

-=[ 🐕 Social ]=-

[lucho]

This series of historic web vulnerabilities is amazing

[Techsplosion]

I understand nothing about coding or anything but this guy still entertains me.

[JoeyRH]

this is a great series! I love the historical look at vulnerabilities

[rainerzufall]

Ich habe heute deinen Stream mit John gesehen und bin sehr beeindruckt. Ich danke dir, dass du deine Zeit spendest um Youtube Videos zu erstellen und dein Wissen zu teilen.

[motbus]

Thanks for sharing these videos. It gives a super importa view ln modern technologies and all the craziness involved

[krusic]

Didn't know they still had Windows 95 in the year "19997".

[damejelyas]

God damn, these are legends, the last hack was insane .

[Wyvernnnn]

The early age of browser security or lackthereof :)

[wildcodedeveloper]

I may be more interested in how they discovered these vulnerabilities at the time. Presumably they have a good understanding of the operating principle of the browser framework or the operating method of JavaScript.

[chrizzzly_hh]

Wieder ein grandioses video. Ich bin gespannt wenn wir die spannende zeit mit csrf und xss auf myspace ankommen (durch samys grandiosen wurm). Und firsheep, womit man im wep lan per firefox plugin automatisch in anderen social networks eingeloggt war. Herrliche zeit. 😅

[Haxelrd]

I miss these good old times very much..

[zanarxhy]

i really apreciate your help with dowloanding this software

[Techsplosion]

‘Most of you know what reflected or stored XSS is’ I’m sorry but I have no idea what on earth that is

[xAnomaly]

Nice series. Takes you back in time. Kinda reminds you why we are still the white hats. Even tho there are millions to be made on dark side, but we still choose the light, bad salary and imposter syndrome.

[rogirwin]

Microsoft didn't have any brower security at this time. There was ActiveX after all. That's remote code execution by design!

[BlackHermit]

This is the kind of history they should be teaching in

[niki]

What do you think about making a video that debates the use of modern anti cheat software (such as Riot Vanguard) with regards to security? When it got introduced I read a lot of cricism online about how it could be used to hack your computer, and I wonder how realistic or how practical this really is.

[TilmanBaumann]

I rememeber the times. Took two bloody decades to more or less clean up that mess.
Seemed hopeless. And I'm still not convinced it was all worth it.

[capability-snob]

The opener cap is a security grant, and if the designers of the DOM API had thought in these terms, we would have avoided these vulnerabilities. It's painful to think that we went down the wrong path (in SOP), and there's no sign of turning back.

[MADhatter_AIM]

Where did you find such an old image of windows, to install in a vm ? ps : very interesting information, currently doing my own research.