JSON Hijacking On The Modern Web - Gareth Heyes @OWASPLondon
Channel: OWASP London
Date: 2016-11-26

JSON hijacking is supposedly dead after the Array constructor and "Object.prototype" setter bugs have been patched or is it? This talk will show how it's still possible to steal JSON data cross domain using various browser bugs. Gareth will take us on an epic journey of bug discovery and if we have time he may even bypass CSP for fun. 

This talk was presented by Gareth Heyes at OWASP London Chapter Meeting on 24th November 2016. HD version of this video is available to watch here: https://youtu.be/X4jeph2KFwo

Slides: https://www.owasp.org/images/6/6a/OWASPLondon20161124_JSON_Hijacking_Gareth_Heyes.pdf
Blog Article:http://blog.portswigger.net/2016/11/json-hijacking-for-modern-web.html

Speaker: Gareth Heyes

Gareth works as a researcher at Portswigger and loves breaking sandboxes and anything to do with JavaScript. He has developed various free online tools such as Hackvertor and Shazzer. He also created MentalJS a free JavaScript sandbox that provides a safe DOM environment for sandboxed code. Gareth has been a speaker at many security conferences including the Microsoft BlueHat, Confidence Poland, and OWASP Application Security Conferences. Gareth also co-authored  the "Web Application Obfuscation" book,  which was named a 2011 Best Hacking and Pen Testing Book by InfoSec Reviews. Notes: https://github.com/corkami/pics/blob/master/JPG.png