OWASP Top 10: #7 XSS and #8 Insecure Deserialization

Introduction

• Common software vulnerabilities

1. Cross-Site Scripting: How Does It Work?

• General concept

2. Impact of Cross-Site Scripting

• Example scenario 1
• Example scenario 2

3. Preventing Cross-Site Scripting

• Enable a content security policy
• Apply context sensitive encoding
• Escape untrusted HTTP data

4. Insecure Deserialization: How Does It Work?

• General concept

5. Impact of Insecure Deserialization

• Example scenario 1
• Example scenario 2

6. Preventing Insecure Deserialization

• Use integrity checks and encrypt
• Log to detect insecure deserialization
• Isolate code that deserializes

Conclusion

• Next steps