I was watching a DefCon talk and the speaker was saying he was able to infect JavaScript cache files, once the user visited his website/server. From there he was able to load scripts from other sites and infect them for when the user visits later on. Does anyone know how this works?

Talk PDF: http://www.slideshare.net/chemai64/owning-bad-guys-and-mafia-with-javascript-botnets (See page 7)

Talk Video: https://www.youtube.com/watch?v=0QT4YJn7oVI (See 32:45)

  • Sounds like it may possibly be persistent cross site scripting. A quick google search should help. – wireghoul May 20 '15 at 2:45
  • It might be helpful if you provided a reference to the talk. – schroeder May 20 '15 at 3:11
  • @wireghoul He literally just downloaded the file with document.write('SomeUrl.js') and it was infected – Jake Cross May 20 '15 at 3:11
  • I'm not sure what we can add. The pdf you linked explains it. – schroeder May 20 '15 at 3:17
  • It doesn't work though. I've tried it. – Jake Cross May 20 '15 at 3:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.