JavaScript Security

  1. Advanced Topics
    1. Web Workers and Service Workers
      1. Security Models and Risks
        1. Isolation from Main Thread
          1. Data Leakage Risks
            1. Cross-Origin Restrictions
            2. importScripts Vulnerabilities
              1. Loading Untrusted Scripts
                1. Mitigation Strategies
                  1. CSP in Workers
                  2. Service Worker Security
                    1. Cache Poisoning
                      1. Network Interception
                        1. Update Mechanisms
                        2. Shared Workers
                          1. Cross-Origin Communication
                            1. Data Sharing Risks
                          2. JSON and JSONP Security
                            1. JSON Hijacking
                              1. Exploitation Techniques
                                1. Prevention Methods
                                  1. Array Constructor Attacks
                                  2. The Demise of JSONP
                                    1. Security Risks
                                      1. Modern Alternatives
                                        1. Callback Injection
                                        2. JSON Parsing Security
                                          1. Prototype Pollution via JSON
                                            1. Large Payload DoS
                                          2. Post-Exploitation with JavaScript
                                            1. Browser Exploitation Framework (BeEF)
                                              1. Capabilities and Use Cases
                                                1. Hook Deployment
                                                2. Data Exfiltration Techniques
                                                  1. Covert Channels
                                                    1. Network Request Abuse
                                                      1. DNS Exfiltration
                                                        1. Image-Based Exfiltration
                                                        2. Persistence Mechanisms
                                                          1. Service Worker Persistence
                                                            1. Local Storage Abuse
                                                              1. Browser Extension Hijacking
                                                            2. WebAssembly (Wasm) Security
                                                              1. Sandboxing and Memory Isolation
                                                                1. Wasm Runtime Protections
                                                                  1. Linear Memory Model
                                                                  2. Interaction with JavaScript
                                                                    1. Security Boundaries
                                                                      1. Risks of Unsafe Imports/Exports
                                                                        1. Type Confusion Attacks
                                                                        2. Wasm-Specific Vulnerabilities
                                                                          1. Buffer Overflows
                                                                            1. Integer Overflows
                                                                              1. Side-Channel Attacks
                                                                            2. Browser Extension Security
                                                                              1. Extension Permissions Model
                                                                                1. Content Script Isolation
                                                                                  1. Cross-Extension Communication
                                                                                    1. Malicious Extension Detection
                                                                                    2. Progressive Web App (PWA) Security
                                                                                      1. Service Worker Security
                                                                                        1. App Manifest Security
                                                                                          1. Push Notification Security
                                                                                            1. Background Sync Security

                                                                                          Previous

                                                                                          7. Security in Modern JavaScript Frameworks

                                                                                          Go to top

                                                                                          Next

                                                                                          9. Security Testing and Analysis