Web Cache Entanglement: Novel Pathways to Poisoning - James Kettle (albinowax)

Caches are woven into websites throughout the net, discreetly juggling data between users, and yet they are rarely scrutinized in any depth. In this session, James will show you how to remotely probe through the inner workings of caches to find subtle inconsistencies, and combine these with gadgets to build majestic exploit chains.

[tanveeraalam]

@albinowax you're the most awesome hacker. And your talks are always top notch.

[Mersal-tqlm]

26:14 the callback parameter was cache key and both ROR & CDN caches are splitting the parameters with & and ; . So why didn't the CDN notice that the callback parameter is different from the UTM_content parameter. So the CDN cache key for callback didn't even notice that the same cache key parameter is repeating second time?
Why it wasn't, like
callback(keyed).

[potatoonastick]

What the hell? Cloudflare of all services doesn't think the unkeyed port param cache poisoning is an issue? What drugs are they taking, leaving in a vulnerability like that? I'm honestly baffled. Anyway thanks for the research man, this is some truly top quality stuff

[andreys]

Very helpful, like always) thank you so much

[shamimi]

Awesome! thanks James!

A gif is needed to be made from 42:40 :D

[SuperTechrobin]

thanks you so much to share your great knowledge with us thanks you sir

[ahmedrazaidrisi]

To let's go kick the cache with method of albinowax