Главная
Study mode:
on
1
Intro
2
Multiparty interactions in current Internet
3
Previous works about ambiguity
4
How HTTP requests are processed
5
Host - A critical HTTP field
6
Technique 1: Multiple Host header
7
How do implementations handle requests with multiple Host header?
8
How implementations handle requests with space-surrounded Host Header?
9
Absolute-URI as request-target
10
How do different implementations handle absolute-URI?
11
Attacks exploiting host ambiguity
12
Cache poisoning Co- hosting website
13
Cache poisoning Co-CDN website
14
Cache poisoning any HTTP website CVE-2016-4553
15
Firewall bypass
16
WAF bypass
17
How Prevalent are Upstream/Downstream vulnerabilities?
18
Outline
19
Measurement set up
20
Execution of test cases
21
Measurement results
22
Mitigation
23
A test in my phone's network
24
Discussion
Description:
Explore a conference talk from CCS 2016 examining multiple host ambiguities in HTTP implementations. Delve into the intricacies of multiparty interactions in the current Internet, focusing on the critical HTTP Host field. Learn about techniques like multiple Host headers and absolute-URI as request-target, and how different implementations handle these scenarios. Discover potential attacks exploiting host ambiguity, including cache poisoning and firewall bypass. Examine the prevalence of upstream/downstream vulnerabilities through measurement results and discuss mitigation strategies. Gain insights from authors representing Tsinghua University, University of California, Berkeley, International Computer Science Institute, and Huawei Canada as they present their findings on this crucial aspect of web security.

Host of Troubles - Multiple Host Ambiguities in HTTP Implementations

Association for Computing Machinery (ACM)
Add to list
0:00 / 0:00