Главная
Study mode:
on
1
Intro
2
WHO ARE WE
3
SSRF According to OWASP
4
What is Cloud Metadata?
5
Basic Example
6
CVE Examples
7
SSRF Hurdles
8
Headless Browsers
9
HTML Renderers
10
Simple XSS- SSRF via wkhtmltopdf
11
When Simple Fails
12
XSS via escaping tag
13
WeasyPrint Makes Hacking (W)easy
14
Use The Source
15
Attachments
16
DNS Rebinding for Fun and Profit
17
HTTPRebind
18
Recap
19
Keep in Touch
Description:
Explore the intricacies of Server-Side Request Forgery (SSRF) attacks and their implications in cloud environments in this 31-minute conference talk from 44CON Information Security Conference. Delve into the OWASP definition of SSRF, understand cloud metadata, and examine basic examples and CVE cases. Navigate through SSRF hurdles, including headless browsers and HTML renderers. Discover techniques like simple XSS via wkhtmltopdf and advanced methods for bypassing security measures. Learn about WeasyPrint vulnerabilities and the power of source code analysis. Investigate DNS rebinding and HTTPRebind for enhanced attack vectors. Gain valuable insights into cloud security and SSRF mitigation strategies from security expert Cody Brocious.

Owning the Cloud Through SSRF

44CON Information Security Conference
Add to list