Filter Evasion (Workshop)
Demonstrates filter Evasion (Workshop) and evaluates key implications for security practitioners.
Summary
Workshop overview
Optiv consultant Tanner Scott leads a cross-site scripting filter-evasion workshop covering XSS basics, proof-of-concept payloads, real-world breaches, bypass techniques, ModSecurity examples, cheat sheets, and hands-on Discord labs.
XSS impact
Stored, reflected, and DOM-based XSS let attackers impersonate users, perform privileged actions, steal cookies or local storage, bypass CSRF protections, deface sites, and inject trojan functionality. Examples include British Airways Magecart via Feedify in 2018, Fortnite's 2019 retired-page XSS affecting millions, and eBay redirect parameter abuse through 2017.
Bypass techniques
Filters fail against case/null-byte/tab mutations, event handlers on tags like svg/audio/video, malformed attributes, alternate quote/backtick delimiters, doubled brackets after stripping, javascript: pseudo-protocols, and HTML/URL/Unicode encodings—including layered encodings ModSecurity may miss.
ModSecurity demo
The workshop walks through ModSecurity's two-phase word stripping and regex blocks, showing payloads using eval, svg, and encodings that evade detection. PortSwigger, OWASP, PayloadsAllTheThings, and HackTricks cheat sheets support live experimentation.
Related talks
Source Zero Con·56 min
Investigates (Security) Culture Eats Strategy For Breakfast and evaluates key implications for security practitioners.
Source Zero Con·28 min
Demonstrates business Email Compromise (BEC) & Phishing Investigations in Office365 and evaluates key implications for security practitioners.
Source Zero Con·31 min
Outlines current State of Linux Rootkits and evaluates key implications for security practitioners.