Главная
Study mode:
on
1
Intro
2
Param Miner
3
Outline
4
Caching Threat Landscape
5
Cache poisoning objective
6
Cache keys
7
Cache key collisions
8
Cache Poisoning Methodology
9
Trusting headers
10
Unkeyed input detection
11
Explore and Inject
12
Seizing the Cache
13
Selective poisoning
14
DOM Poisoning
15
Mystery Interaction
16
Mozilla SHIELD
17
Chaining Unkeyed Inputs
18
Hidden Route Poisoning
19
Resource Hijacking
20
Open Graph hijacking
21
Cross-Cloud Poisoning: Cloudflare
22
Beyond fake hosts
23
External cache poison (1/3)
24
Internal cache poison (2/3)
25
Drupal Open redirect (3/3)
26
Combining ingredients
27
Defense
28
Takeaways
Description:
Explore practical web cache poisoning techniques in this 44-minute Black Hat conference talk by James Kettle. Delve into the vulnerabilities of modern web applications' caching systems and content delivery networks. Learn how to exploit esoteric web features to transform caches into exploit delivery systems, potentially affecting all visitors to a website's homepage. Discover the caching threat landscape, cache poisoning objectives, and methodologies. Examine topics such as cache keys, unkeyed input detection, DOM poisoning, and cross-cloud poisoning. Gain insights into defensive strategies and key takeaways for securing web applications against these sophisticated attacks.

Practical Web Cache Poisoning - Redefining 'Unexploitable'

Black Hat
Add to list
0:00 / 0:00