BEGIN:VCALENDAR
VERSION:2.0
PRODID:Data::ICal 0.24
BEGIN:VEVENT
DESCRIPTION:   'Title: ROP for the Web: Smuggling XSS\, SQLi\, and Web Shel
 ls Past\n   Every WAF Using Compression Dictionaries\n   Tags: Advanced | 
 AppSec Village | Creator Event/Activity\n   When: Sunday\, Aug 9\, 10:15 -
  11:15 PDT\n   Where: LVCCW Level 1 Hall 2 604 (Appsec Village) Arsenal - 
 [1]Map\n\n   Description:\n\n   Compression Dictionary Transport (RFC 9842
 ) shipped in Chrome 130+ in\n   2025. Any JavaScript asset designated as a
  dictionary becomes a set of\n   gadgets an attacker can chain into respon
 ses that bypass\n   signature-based WAFs and IDSes. gadget-scanner is the 
 a tool to\n   evaluate that surface: drop in a candidate dictionary and a 
 payload\,\n   and it reports how much of the payload hides inside backrefe
 rences and\n   how much leaks as literal bytes on the wire. At the table y
 ou will\n   score real-world JS libraries as attack primitives\, generate 
 the DCB\n   blob with brotli -D\, and watch the side-by-side: the raw byte
 s a WAF\n   would see vs. the payload a browser would execute\n\n   Speake
 rBio:  alevsk\n\n   Lenin Alevski is a Full Stack Engineer and generalist 
 with a lot of\n   passion for Information Security. Currently working as a
  Security\n   Engineer at Google. Lenin specializes in building and mainta
 ining\n   Distributed Systems\, Application Security and Cloud Security in
 \n   general. Lenin loves to play CTFs\, contributing to open-source and\n
    writing about security and privacy on his personal blog\n   https://www
 .alevsk.com.\n\n   '\n\n   1. #LVCCW_Level1_Hall2\n\n\n
DTEND:20260809T181500Z
DTSTART:20260809T171500Z
LOCATION:AppSec Village - LVCCW Level 1 Hall 2 604 (Appsec Village) Arsenal
SUMMARY:ROP for the Web: Smuggling XSS\, SQLi\, and Web Shells Past Every W
 AF Using Compression Dictionaries
END:VEVENT
END:VCALENDAR