Explore practical web cache poisoning techniques in this 44-minute Black Hat conference talk by James Kettle. Delve into the vulnerabilities of modern web applications' caching systems and content delivery networks. Learn how to exploit esoteric web features to transform caches into exploit delivery systems, potentially affecting all visitors to a website's homepage. Discover the caching threat landscape, cache poisoning objectives, and methodologies. Examine topics such as cache keys, unkeyed input detection, DOM poisoning, and cross-cloud poisoning. Gain insights into defensive strategies and key takeaways for securing web applications against these sophisticated attacks.
Practical Web Cache Poisoning - Redefining 'Unexploitable'