Slippery SOP: Edge Cases in the Same Origin Policy

Presented at RVAsec 2022, June 16, 2022, 1 p.m. (50 minutes).

Why is the web full of cross-site scripting and cross-site request forgery even through browsers enforce the Same Origin Policy? Can we use the Same Origin Policy to mitigate these attacks? In this talk, we'll answer these questions and more, including uncovering some shortcomings of the Same Origin Policy that can allow attackers to scrape sensitive information from internal websites without authorization.

Presenters:

• Collin Berman - Capital One
  Collin Berman is a pentester at Capital One Financial, focusing on web, cloud, and cryptography. After getting his start playing CTFs in high school, Collin went on to found the University of Virginia's Computer and Network Security Club. When not on the Internet, Collin enjoys hiking, camping, climbing, and skiing.

Links:

• https://rvasec2022.sched.com/event/12PaE/slippery-sop-edge-cases-in-the-same-origin-policy

Similar Presentations:

• ToorCon San Diego 18 (2016) / The Subtleties of Bypassing the Same-Origin Policy and Exploiting Cross-Site Request Forgery
• DEF CON China Beta (2018) / Hacking Intranet from Outside: Security Problems of Cross Origin Resource Sharing (CORS)
• AppSec USA 2012 / The Same-Origin Saga