Breaking XSS Mitigations Via Script Gadgets

Explore a groundbreaking Web hacking technique that enables attackers to bypass most XSS mitigations by exploiting script gadgets. Delve into the concept of script gadgets, which are legitimate JavaScript pieces that process DOM elements, potentially leading to script execution. Learn about HTML sanitizers, Content Security Policies, and the expression process. Watch demonstrations and gain insights from security experts Sebastian Lekies, Krzysztof Kotowicz, and Eduardo Vela as they present their findings at Black Hat. Understand the implications of this novel approach for web security and discover potential countermeasures to protect against such attacks.