OWASP AppSec Europe 2015

In this talk, we present an analysis of Chrome's XSS Auditor, in which
we discovered 17 flaws, that enable us to bypass the Auditor's filtering
capabilities. We will demonstrate the bypasses and present a tool to
automatically generated XSS attacks utilizing the bypasses.

Furthermore, we will report on a practical, empirical study of the Auditor's
protection capabilities in which we ran our generated attacks against a set of
several thousand DOM-based, zero-day XSS vulnerabilities in the Alexa
Top 10.000. In our experiments, we were able to successfully bypass the
XSS filter on first try in over 80% of all vulnerable Web applications.

Finally, we present an alternative XSS filter design, that reliably detects successful XSS attacks via
client-side taint tracking in the JavaScript engine. Unlike the current approach,
our filter does not rely on coarse approximation but on precise data flow information,
that allows us to robustly stop DOM-XSS for good.