Collin Berman is a pentester at Capital One Financial, focusing on web, cloud, and cryptography. After getting his start playing CTFs in high school, Collin went on to found the University of Virginia’s Computer and Network Security Club. When not on the Internet, Collin enjoys hiking, camping, climbing, and skiing.

Slippery SOP: Edge Cases in the Same Origin Policy

Why is the web full of cross-site scripting and cross-site request forgery even through browsers enforce the Same Origin Policy? Can we use the Same Origin Policy to mitigate these attacks? In this talk, we’ll answer these questions and more, including uncovering some shortcomings of the Same Origin Policy that can allow attackers to scrape sensitive information from internal websites without authorization.

Come see Collin at RVAsec! Register now!