11/9/2022 0 Comments Current defconEven high-security devices like hardware cryptocurrency wallets use such an architecture. #CURRENT DEFCON CODE#Today's systems sandbox code through traditional techniques: memory protection and user-kernel mode. He has spoken at numerous prestigious venues including both BlackHat USA and EU, and OWASP AppSec USA and EU.īack to top Want Strong Isolation? Just Reset Your ProcessorĤ5 minutes | Demo, Tool Anish Athalye PhD student at MIT James has extensive experience cultivating novel attack techniques, including server-side RCE via Template Injection, client-side RCE via malicious formulas in CSV exports, and abusing the HTTP Host header to poison password reset emails and server-side caches. Recent work has focused on using web cache poisoning to turn caches into exploit delivery systems. James Kettle is Head of Research at PortSwigger Web Security, where he designs and refines vulnerability detection techniques for Burp Suite's scanner. By applying fresh ideas and new techniques, I’ll unveil a vast expanse of vulnerable systems ranging from huge content delivery networks to bespoke backends, and ensure you leave equipped to devise your own desync techniques and tailor attacks to your target of choice. I’ll also demonstrate using backend reassembly on your own requests to exploit every modicum of trust placed on the frontend, gain maximum privilege access to internal APIs, poison web caches, and compromise my favourite login page.Īlthough documented over a decade ago, a fearsome reputation for difficulty and collateral damage has left this attack optimistically ignored for years while the web's susceptibility grew. #CURRENT DEFCON HOW TO#Using these targets as case studies, I’ll show you how to delicately amend victim's requests to route them into malicious territory, invoke harmful responses, and lure credentials into your open arms. In this session, I'll introduce techniques for remote, unauthenticated attackers to smash through this isolation and splice their requests into others, through which I was able to play puppeteer with the web infrastructure of numerous commercial and military systems, rain exploits on their visitors, and harvest over $50k in bug bounties. HTTP requests are traditionally viewed as isolated, standalone entities. HTTP Desync Attacks: Smashing into the Cell Next DoorĤ5 minutes | Demo, Tool albinowax Head of Research, PortSwigger
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |