How I got XSS’d by my ad network
troyhunt.com
How I got XSS’d by my ad network
1–10 of 62 posts
Re: How I got XSS’d by my ad network
#2What a shame he didn't actually pull the plug on the ad network :(
Re: How I got XSS’d by my ad network
#3as far as i can tell, adsafeprotected isn't actually for your or your visitors' protection, but for the advertisers (it seems to run a huge gob of incredibly slow scripts to "ensure" visibility, that there is actually an eyeball on the ad and that it's not hidden or collapsed or something)
Re: How I got XSS’d by my ad network
#4"When you allow third parties to run script on your site, you’re entirely beholden to them; they can run anything they like in the context of your site"
I've seen a fair few Internet banking web sites pulling scripts from over a dozen third parties, mostly for tracking and advertising, but even for trivial things like social media. On their customer login pages. It's beyond me how they can consider this to be an acceptable risk.
Re: How I got XSS’d by my ad network
#5This is why browsers should have an option "Block third party javascript" similar to "Block third party cookies".
With http2, relevant javascript files will be increasingly hosted on the same domain anyway and that option would become increasingly relevant.
Re: How I got XSS’d by my ad network
#6This is why browsers should have an option "Block third party javascript" similar to "Block third party cookies". With http2, relevant javascript files will be increasingly hosted on the same domain anyway and that option would become increasingly relevant.
With http2, relevant javascript files will be
increasingly hosted on the same domain
Re: How I got XSS’d by my ad network
#7"When you allow third parties to run script on your site, you’re entirely beholden to them; they can run anything they like in the context of your site" I've seen a fair few Internet banking web sites pulling scripts from over a dozen third parties, mostly for tracking and advertising, but even for trivial things like social media. On their customer login pages. It's beyond me how they can consider this to be an acce…
I wonder how many websites' users would be compromised if code.jquery.com got hacked.
Re: How I got XSS’d by my ad network
#8This is why browsers should have an option "Block third party javascript" similar to "Block third party cookies". With http2, relevant javascript files will be increasingly hosted on the same domain anyway and that option would become increasingly relevant.
With http2, relevant javascript files will be increasingly hosted on the same domain Why is that?
There's a limit on the number of simultaneous requests per domain with http1, which will not be present in http2 [0]. This limit meant that for best performance, static files should be served from multiple (sub)domains.
[0] https://mattwilcox.net/web-development/http2-for-front-end-w...
Re: How I got XSS’d by my ad network
#9If you're going to put adverts on your site, always put them within an iframe, pointed at a separate "adverts" only domain. This will ensure they can't execute javascript within your own website context.
Re: How I got XSS’d by my ad network
#10This is why browsers should have an option "Block third party javascript" similar to "Block third party cookies". With http2, relevant javascript files will be increasingly hosted on the same domain anyway and that option would become increasingly relevant.
NoScript can do that. Just enable the "Temporarily allow top-level sites by default" setting.