Breaking XSS Mitigations Via Script Gadgets

Explore a groundbreaking Web hacking technique that enables attackers to bypass most XSS mitigations by exploiting script gadgets. Delve into the concept of script gadgets, which are legitimate JavaScript pieces that process DOM elements, potentially leading to script execution. Learn about HTML sanitizers, Content Security Policies, and the expression process. Watch demonstrations and gain insights from security experts Sebastian Lekies, Krzysztof Kotowicz, and Eduardo Vela as they present their findings at Black Hat. Understand the implications of this novel approach for web security and discover potential countermeasures to protect against such attacks.

Introduction
What is XSS
What are Script Gadgets
The Problem
HTML Sanitizers
Script Gadgets
Summary
Unsafeeval
Content Security Policies
Expression Process
Demo
Sebastian
Summary Conclusion
Recap
Main Conclusion
Questions