No results.

AppSec USA 2012 - Austin

These are the videos from the OWASP AppSec USA 2012 conference in Austin, TX.

The schedule for the conference is at and the site for the conference is at

Blended Threats and JavaScript: A Plan for Permanent Network Compromise - Phil Perviance

Title: Blended Threats and JavaScript: A Plan for Permanent Network Compromise


This is a version of the talk I gave at Black Hat USA 2012, updated specifically for the AppSec USA audience. The original BlackHat slides are available at "", and the source code used in the demonstrations is available at "".

During Black Hat 2006, it was shown how common Web browser attacks could be leveraged bypass perimeter firewalls and "Hack Intranet Websites from the Outside." In the years since, the fundamental problems were never addressed and the Intranet remains wide open, probably because the attack techniques described had important limitations. These limitations prevented mass scale and persistent compromise of network connected devices, which include but are not limited to home broadband routers. Now in 2012, with the help of new research and next-generation technologies like HTML5, browser-based Intranet attacks have overcome many of the old limitations and improved to a new degree of scary.

This presentation will cover state-of-the-art browser-to-network threats launched with JavaScript, using zero to minimal user interaction and complete every step of the exploit attack cycle. Starting with enumeration and discovery, escalating the attack further upstream and into embedded network devices, and ultimately mass-scale permanent compromise.


Speaker: Phil Perviance, Application Security Consultant, AppSec Consulting, Inc.

Phil Purviance is an Application Security Consultant for AppSec Consulting where he researches application security vulnerabilities and performs penetration testing. Phil's body of work includes the discovery and proof-of-concept exploitations of critical security vulnerabilities, design flaws, and system weaknesses in hundreds of custom web sites and web application frameworks. Phil also consults with clients and recommends helpful countermeasures that are useful to mitigate serious security vulnerabilities. Phil's recent exploit talks include the security of HTML5, and the revealing of cross-site scripting vulnerabilities in Skype for iOS. When asked, "Why do you look for bugs in popular websites," he answers, "Because it's fun!"


Date: Friday October 26, 2012 11:00am - 11:45am
Location: AppSecUSA, Austin, TX. Hyatt Regency Hotel. Gemalto Room
Track: Attack