Главная
Study mode:
on
1
Intro
2
Matthew Bryant (mandatory)
3
Content Delivery Networks
4
What happened?
5
A Divided Penetration Testing Scope
6
SRV Record Enumeration
7
subbrute - Internal Network Assessment
8
NOERROR?
9
Server Trust
10
Search for Cross Domain Proxy
11
SSRF tools
12
Access to the Web Server's localhost
13
Access to Internal Network Hardware
14
SSRF Questions
15
What's an origin?
16
Differences between JavaScript and Flash
17
Example Crossdomain.xml File
18
The Check
19
FlowPlayer Bypass #1 - The Bypass
20
Full Exploit Flow
21
Bypassing HTTP Content Security Policy
22
Remediation
23
Future Security Research
Description:
Explore the vulnerabilities and attack patterns affecting Content Delivery Networks (CDNs) in this Black Hat conference talk. Delve into the potential consequences of exploiting CDN weaknesses, including unauthorized access to sensitive information and financial accounts. Learn about the research uncovering general attack patterns against high-availability website infrastructure. Discover techniques such as SRV record enumeration, internal network assessment, and SSRF tools. Examine the differences between JavaScript and Flash in terms of security, and understand the implications of crossdomain.xml files. Investigate methods for bypassing HTTP Content Security Policy and potential remediation strategies. Gain insights into future security research directions in this critical area of web infrastructure.

Bypass Surgery - Abusing Content Delivery Networks

Black Hat
Add to list