Главная
Study mode:
on
1
Intro
2
Unanswered questions in cache poisoning
3
Outline
4
Recap: cache poisoning concept
5
Recap: Practical Web Cache Poisoning (2018) Keyed GET /research?x=1 HTTP/1.1
6
Methodology
7
Unkeyed port
8
Unkeyed query detection
9
Unkeyed query effect Hides obvious XSS from pentesters & bug bounty hunters
10
Redirect Dos gadget
11
Cache parameter cloaking: Akamai?
12
Parameter cloaking: Rack::Cache?
13
Parameter cloaking: Ruby on Rails
14
Dynamic resource gadget
15
Unkeyed method
16
Local redirect gadget
17
Cache key normalisation
18
Normalisation gadgets - XSS
19
Cache key injection - Akamai
20
Cache key injection - Cloudflare? Select Prote Cloudflare documentation
21
Application Cache Poisoning - Adobe
22
Blind Internal Cache Poisoning - DoD
23
Recognising internal cache poisoning
24
Param Miner
25
Further Reading
Description:
Explore the intricacies of web cache vulnerabilities and exploitation techniques in this Black Hat conference talk. Delve into the often-overlooked world of caches and their critical role in web infrastructure. Learn how to remotely probe cache systems, identify subtle inconsistencies, and leverage these findings to construct sophisticated exploit chains. Gain insights into novel pathways for cache poisoning, including techniques like cache parameter cloaking, dynamic resource gadgets, and cache key injection. Discover methodologies for detecting unkeyed queries and their potential effects on security. Examine real-world examples involving major platforms like Akamai, Cloudflare, and Ruby on Rails. Understand the concepts of application cache poisoning and blind internal cache poisoning, with case studies from Adobe and the Department of Defense. Acquire practical knowledge on recognizing internal cache poisoning and using tools like Param Miner for further exploration.

Web Cache Entanglement - Novel Pathways to Poisoning

Black Hat
Add to list
0:00 / 0:00