C3Subtitles: 35c3-chaoswest: Nothing new about XSS in impress.js
back

Nothing new about XSS in impress.js

If you suspend your transcription on amara.org, please add a timestamp below to indicate how far you progressed! This will help others to resume your work!

Please do not press “publish” on amara.org to save your progress, use “save draft” instead. Only press “publish” when you're done with quality control.

Video duration
00:19:36
Language
English
Abstract
I built a small demonstrator for Cross-Site-Scripting (XSS) attacks in impress.js. It would be a waste to let it stay on my computer, because I think it could help you giving a brief lecture on XSS. Much more interesting, probably, is my implementation of the whole thing: the cockpit (a header and footer that provide a visual frame, while the viewpoint navigates the 3-dimensional space of your presentation) and the handling of input to modify contents of successive slides.

While I don't think to tell you anything new about cross-site scripting, I hope you are interested in the two features I add to the impress.js examples. Well the XSS-part also is interesting in itself, but I am astonished every time I find this weakness in the wild, because it is not difficult to prevent. Thus, if you also learn about XSS in the progress, I am happy.

Mostly the presentation will show you two new example techniques for presentations with impress.js

The cockpit: just some fixed headers and footer in the layout. But better graphical artists might actually turn this into a real cockpit view. In the end it is only a wee bitty of css, but it is something that turns a 3-d animation into a flight through the slide-space.

Use my [demo sources](https://gitlab.com/larsipulami/xss-demo) and make me famous!
Value-transfer: Why using JavaScript to present static slides, it makes no sense to not utilise a fully-fledged, yet tedious, interpreter environment — your web-browser — if you don't make something more dynamic with your slides. For example transferring inputs between slides and execute contents to demonstrate the effects of XSS.

Talk ID
35c3CW-17
Event:
35c3-chaoswest
Day
3
Room
Chaos West Bühne
Start
5:30 p.m.
Duration
00:20:00
Track
None
Type of
Einfacher Slot mit optionalen Q+A
Speaker
inj4n
0.0% Checking done0.0%
0.0% Syncing done0.0%
0.0% Transcribing done0.0%
100.0% Nothing done yet100.0%

English: Transcribed until

Last revision: unknown