Scriptless Attacks - Stealing the Pie without touching the Sill - The document discusses scriptless attacks that can bypass traditional XSS defenses like NoScript and XSS filters by leveraging new HTML5 and CSS features. - It presents several proof-of-concept attacks including using CSS to steal passwords, using SVG fonts to brute force CSRF tokens, and using custom fonts to leak sensitive informa
![Scriptless Attacks - Stealing the Pie without touching the Sill](https://cdn-ak-scissors.b.st-hatena.com/image/square/78676769935d4927e87c92726c8f00243cd200f1/height=288;version=1;width=512/https%3A%2F%2Fcdn.slidesharecdn.com%2Fss_thumbnails%2Fstealingthepie-121220134121-phpapp02-thumbnail.jpg%3Fwidth%3D640%26height%3D640%26fit%3Dbounds)