Introduction

The talk opens with an overview of the speaker’s cybersecurity background and experience, setting the stage for the discussion. It explains the motivation behind addressing the gap in achieving true persistent XSS and hints at the release of a new tool.

XSS Recap

This section briefly covers XSS types, including stored, reflected, and DOM-based, and discusses the impact of traditional XSS payloads, such as credential theft and session hijacking. Real-world case studies illustrate XSS’s destructive potential, but makes sure to highlight the difficulties that exist when attempting to practically exploit the vulnerability, while common remediation techniques and their limitations are reviewed.

Modern Persistence: Snake Oil?

Here, persistence is defined in a web application context as survival, not just storage. The talk explores why navigation poses the final barrier to true persistence and addresses misconceptions about persistent XSS, highlighting challenges in modern browser environments, like the modern adoption of single page applications and how that poses a challenge for persistence.

The Logic Behind Persistent XSS

This section delves into the core truths of XSS, emphasizing the level of control over a user’s browser and the implications of DOM manipulation for advanced attacks. It posits that XSS provides a foundation for persistence if navigation challenges are overcome. It will also lead into how we could potentially utilise the core truths discussed to achieve true persistence.

Have We Been Gaslit?

The discussion focuses on existing persistence methods, including stored XSS, iFrame traps, and BeEF’s browser-in-the-middle attack. It highlights their limitations in modern browsers, such as X-Frame-Options, CSP, and EDR detection, and notes specific drawbacks of BeEF’s approach in today’s web environment and its practicality when used during red/purple team engagements.

Modernization (Without the AI Slob)

This part outlines goals for modernizing tools like BeEF to ensure practical use. It addresses challenges posed by EDR and AV detection and discusses design principles for red/purple team engagements, focusing on stealth, stability, and impact.

BRAT (Browser Remote Access Tool)

The talk introduces BRAT’s architecture, explaining how it differs from BeEF through modern APIs and advanced DOM manipulation for persistence. It covers features like live remote view, permissions abuse, reconnaissance, and a novel technique that would allow an XSS payload to persist even AFTER re-opening your browser, along with practical use cases for red/purple team scenarios. The section emphasizes BRAT’s role in re-igniting the pursuit of true persistence and preventing such attacks.

BRAT Demo

The talk concludes with a live demonstration using a simulated banking application, showcasing BRAT’s inner workings, including real-time monitoring, JavaScript injection, and HTML retrieval, to highlight its practical impact and functionality in a controlled environment. The demo also serves to showcase a new novel technique that can be used to poison a browsers local cache to embed persistence even after a victim re-opens their browser.

Conclusion

The talk will wrap up by talking a bit about the key take aways listed below:
- Grasp XSS’s potential on modern web applications for high-impact attacks like data theft and lateral attacks.
- True persistence requires you to defeat a boss - The audience will gain insight into what it really means to achieve true persistence in modern web environments.
- Learn how BRAT uses modern APIs and DOM manipulation, advancing beyond BeEF’s legacy methods.
- Explore BRAT’s live remote view for real-time monitoring of infected web apps.
- Gain a mental model for obscured persistence challenges and BRAT deployment insights.

And then end of by relaying how the community can get involved in the development of the tool.