Главная
Study mode:
on
1
Intro
2
Topics
3
Holy hole in the router, Batman!
4
Subject Background
5
Players in the SOHO Market
6
Evaluated SOHO Products
7
Why did we choose these routers?
8
Security Risks
9
Testing Methodology
10
Information Gathering
11
Scanning and Enumeration Cont.
12
Analyzing Web Applications Cont.
13
Analyzing Servers
14
Static Code Analysis
15
Fuzzing (Dynamic Analysis)
16
Analyze Fuzzing Results
17
Gaining Access Cont.
18
Reverse Engineering Toolz and Techniques
19
Exploit Development
20
Testing for Cross-Site Request Forgery
21
Testing for Command Injection
22
Command Injection - Vulnerable Code ?php
23
Command Injection Countermeasures
24
CSRF and Command Injection Demo
25
Directory Traversal #define: Directory Traversal is a form of attack where an attacker can access files and directories outside of the intended directory
26
Testing for Directory Traversal
27
Directory Traversal - Vulnerable Code ?php
28
Directory Traversal Countermeasures
29
Directory Traversal Demo
30
Testing for Buffer Overflows
31
Buffer Overflow - Vulnerable Code
32
Buffer Overflow Countermeasures
33
MIPS Architecture
34
ASUS RT-AC66U ROP Chain
35
MIPS Shellcode (RT-AC66U Exploit)
36
LIVE DEMO
Description:
Explore the critical security vulnerabilities in SOHO routers in this comprehensive DerbyCon 3.0 conference talk. Delve into the implications of pervasive vulnerabilities, examining various SOHO router products and the associated security risks. Learn about testing methodologies, including information gathering, scanning, and enumeration techniques. Analyze web applications, servers, and conduct static code analysis and fuzzing. Gain insights into reverse engineering tools and techniques, exploit development, and testing for cross-site request forgery and command injection. Discover directory traversal attacks, buffer overflows, and MIPS architecture specifics. Witness live demonstrations of vulnerabilities and exploits, including an ASUS RT-AC66U ROP chain and MIPS shellcode exploit.

So Hopelessly Broken - The Implications of Pervasive Vulnerabilities in SOHO Routers

Add to list
#Conference Talks #DerbyCon #Information Security (InfoSec) #Cybersecurity #Network Security #Ethical Hacking #Reverse Engineering #Buffer Overflow #Programming #Software Development #Software Testing #Static Code Analysis #Vulnerability Assessment #Exploit Development #Fuzzing
1 of 36

Intro