Everybody Wants SOME - Advance Same Origin Method Execution

Explore the advanced aspects of Same Origin Method Execution (SOME), a powerful web attack technique, in this 55-minute conference talk from the Hack In The Box Security Conference. Delve into how SOME exploits callback endpoints to perform unintended actions on websites, bypassing common security measures. Examine real-world case studies of SOME attacks against major platforms like WordPress, Google, PayPal, and Microsoft. Learn how SOME can enable XSS attacks in previously secure environments. Understand the differences between SOME and JSONP, and discover a new approach to user interaction in SOME attacks. Gain insights from Ben Hayak, an experienced Information Security Engineer and researcher, on how seemingly innocuous callback endpoints can become backdoors in even the most protected domains, potentially causing severe damage to web applications.

#HITB2017AMS D2T1 - Everybody Wants SOME: Advance Same Origin Method Execution - Ben Hayak