Same-Origin Policy Courses and Certifications

Black Hat

Same Origin Method Execution - Exploiting a Callback for Same Origin Policy Bypass

Explore a powerful web attack technique that exploits JSONP to bypass Same Origin Policy, potentially compromising entire domains without user interaction or typical browser protections.

• YouTube
• 45 minutes
• On-Demand
• Conference Talk

Packt

AJAX Authentication and Cross-Origin Requests

Enhance web security with HTTP Basic Authentication for AJAX. Learn server setup, form security, and modern Fetch API. Master CORS and SOP for robust cross-origin communication.

• Coursera
• 6 hours 22 minutes
• On-Demand
• Paid Course

Black Hat

Bypassing Browser Security Policies for Fun and Profit

Explore mobile browser vulnerabilities and security policy bypasses, including Same Origin Policy and Content Security Policy. Learn testing methodologies and see real-world examples of Android browser exploits.

• YouTube
• 27 minutes
• On-Demand
• Conference Talk

Black Hat

Browsers Gone Wild

Unveiling creative browser vulnerabilities and attacks, including confidentiality breaches, login detection, and exploiting HTML5 features, with live demonstrations challenging Same Origin Policy understanding.

• YouTube
• 59 minutes
• On-Demand
• Conference Talk

Black Hat

Your Scripts In My Page - What Could Possibly Go Wrong?

Explore the security risks of cross-domain script inclusion, including potential data leaks and account compromises. Learn detection methods and defensive measures to protect against these vulnerabilities.

• YouTube
• 29 minutes
• On-Demand
• Conference Talk

Black Hat

Session Identifier are for Now, Passwords are Forever - XSS-Based Abuse of Browser Password Managers

Explore XSS-based attacks on browser password managers, their vulnerabilities, and potential solutions. Learn about password field usage on popular websites and get recommendations for protection.

• YouTube
• 55 minutes
• On-Demand
• Conference Talk

Surfing the Sea and Drowning in Tabs - An Introduction to Cross Site Request Forgery

Explore Cross Site Request Forgery: its mechanisms, prevention strategies, and real-world implications. Learn about same-origin policy, viewstate, headers, and encrypted token patterns.

• YouTube
• 50 minutes
• On-Demand
• Conference Talk

Association for Computing Machinery (ACM)

The "Web/Local" Boundary Is Fuzzy - A Security Study of Chrome's Process-based Sandboxing

Explore Chrome's process-based sandboxing, its security implications, and potential vulnerabilities in web browser architecture. Learn about attacks exploiting the fuzzy web/local boundary.

• YouTube
• 25 minutes
• On-Demand
• Conference Talk

Black Hat

The Deputies Are Still Confused

Exploring misunderstandings and vulnerabilities in same-origin policy, with practical examples of attacks bypassing common content-isolation mechanisms for CSRF, clickjacking, and NTLM protection.

• YouTube
• 54 minutes
• On-Demand
• Conference Talk

OWASP Foundation

Client-Side Protection Against DOM-Based XSS Done Right

Comprehensive overview of client-side protection against DOM-based XSS attacks, covering vulnerabilities, prevention techniques, and practical solutions for web security professionals.

• YouTube
• 40 minutes
• On-Demand
• Conference Talk

OWASP Foundation

CSP Pitfalls and Gotchas

Explore common pitfalls and gotchas in Content Security Policy implementation, focusing on whitelist issues, SameOrigin policy, and unsafe inline practices. Learn strategies for building a robust security framework.

• YouTube
• 15 minutes
• On-Demand
• Conference Talk

OWASP Foundation

OWASP CSRFGuard: Understanding and Preventing Cross-Site Request Forgery

Learn to prevent Cross-Site Request Forgery attacks with OWASP CSRFGuard. Explore real-world examples, detection techniques, and implementation strategies for robust web application security.

• YouTube
• 35 minutes
• On-Demand
• Free Video

OWASP Foundation

The Timing Attacks They Are A-Changin' - Web-based and Browser-based Timing Attack Techniques

Explore evolving timing attacks in web security, from classic cross-site techniques to browser-based methods, and learn effective mitigation strategies.

• YouTube
• 42 minutes
• On-Demand
• Free Video

OWASP Foundation

Security Implications of Cross-Origin Resource Sharing - HTML5 and CORS Analysis

Explore security implications of Cross-Origin Resource Sharing in HTML5, including its impact on same-origin policy, potential vulnerabilities, and mitigation strategies for web application developers.

• YouTube
• 45 minutes
• On-Demand
• Free Video

OWASP Foundation

Warning Ahead: Security Storms Brewing in JavaScript

Explore JavaScript vulnerabilities, including unique issues, third-party platform exploits, and HTML5 risks. Learn about emerging security threats and their impact on enterprise data and user safety.

• YouTube
• 36 minutes
• On-Demand
• Free Video