Abusing XSLT For Practical Attacks
Analysts investigate attack surfaces and defenses concerning Abusing XSLT For Practical Attacks.
Summary
Overview: XSLT can be leveraged to affect the integrity of arithmetic operations, lead to code logic failure, or cause random values to use the same initialization vector. Error disclosure has always provided valuable information, but thanks to XSLT, it is possible to partially read system files that could disclose service or system's passwords. Finally, XSLT can be used to compromise end-user confidentiality by abusing the same-origin policy concept present in web browsers.
Related talks
Black Hat·38 min
Christopher Wade
Industry experts analyze emerging threats surrounding Practical Attacks Against Smartphone Boot ROMs.
Black Hat·38 min
Presenters detail vulnerability discovery and exploitation in Practical Attacks Against Attribute-based Encryption.
Black Hat·49 min
Presenters detail vulnerability discovery and exploitation in Nonce-Disrespecting Adversaries: Practical Forgery Attacks on GCM in TLS.