filmov
tv
DEF CON 29 - James Kettle - HTTP2: The Sequel is Always Worse
Показать описание
HTTP/2 is easily mistaken for a transport-layer protocol that can be swapped in with zero security implications for the website behind it. Two years ago, I presented HTTP Desync Attacks and kicked off a wave of request smuggling, but HTTP/2 escaped serious analysis. In this presentation, I'll take you beyond the frontiers of existing HTTP/2 research, to unearth horrifying implementation flaws and subtle RFC oversights.
I'll show you how these flaws enable HTTP/2-exclusive desync attacks, with case studies targeting high-profile websites powered by servers ranging from Amazon's Application Load Balancer to WAFs, CDNs, and bespoke stacks by big tech. I'll demonstrate critical impact by hijacking thick clients, poisoning caches, and stealing plaintext passwords to net multiple max-bounties.
After that, I'll unveil novel techniques and tooling to crack open a widespread but overlooked request smuggling variant affecting both HTTP/1 and HTTP/2 that is typically mistaken for a false positive.
Finally, I'll drop multiple exploit-primitives that resurrect a largely-forgotten class of vulnerability, and use HTTP/2 to expose fresh application-layer attack surface.
I'll leave you with an open-source scanner, a custom, open-source HTTP/2 stack, and free interactive labs so you can hone your new skills on live systems.
REFERENCES:
This research is built on my previous work on this topic:
This presentation by defparam has good explanations of response queue poisoning and self-desync attacks:
I had a partial research collision with Emil Lerner. His work provides an alternative perspective on certain techniques:
I'll show you how these flaws enable HTTP/2-exclusive desync attacks, with case studies targeting high-profile websites powered by servers ranging from Amazon's Application Load Balancer to WAFs, CDNs, and bespoke stacks by big tech. I'll demonstrate critical impact by hijacking thick clients, poisoning caches, and stealing plaintext passwords to net multiple max-bounties.
After that, I'll unveil novel techniques and tooling to crack open a widespread but overlooked request smuggling variant affecting both HTTP/1 and HTTP/2 that is typically mistaken for a false positive.
Finally, I'll drop multiple exploit-primitives that resurrect a largely-forgotten class of vulnerability, and use HTTP/2 to expose fresh application-layer attack surface.
I'll leave you with an open-source scanner, a custom, open-source HTTP/2 stack, and free interactive labs so you can hone your new skills on live systems.
REFERENCES:
This research is built on my previous work on this topic:
This presentation by defparam has good explanations of response queue poisoning and self-desync attacks:
I had a partial research collision with Emil Lerner. His work provides an alternative perspective on certain techniques:
0:40:04
DEF CON 29 - James Kettle - HTTP2: The Sequel is Always Worse
0:25:28
DEF CON 29 Aerospace Village - James Pavur - Threat Modeling for Space Hitchhikers
0:49:28
DEF CON 29 - Agent X - A look inside security at the New York Times
0:38:32
James McKee (punkcoder) - Encryption for Developers - DEF CON 29 AppSec Village
0:47:21
DEF CON 29 - Jesse 'Agent X' Krembs - A Look Inside Security at the New York Times - LI...
0:44:30
DEF CON Safe Mode - James Pavur - Whispers Among the Stars
0:42:19
DEF CON 31 - Smashing the State Machine the True Potential of Web Race Conditions - James Kettle
0:42:50
DEFCON 29 IoT Village - Jay Balan - 5 Years of IoT Vulnerability Research and Countless 0days
0:43:51
DEF CON 29 - Matthew Bryant - Hacking G Suite: The Power of Dark Apps Script Magic
0:29:50
DEF CON China Party 2021 - Whispers Among the Stars - James Pavur
0:30:38
DEF CON 29 Adversary Village - Phillip Wylie - The Way of The Adversary
0:00:06
Hack-A-Sat rolling in at DEFCON29
0:42:16
DEF CON 29 - Tomer Bar, Eran Segal - 2021 Our Journey Back To The Future Of Windows Vulnerabilities
0:40:13
DEF CON 29 Blockchain Village - Josh McIntyre - Subtle Ways to Lose Your Cryptocurrency
0:47:30
DEF CON 29 - Seth Kintigh - OTA remote code execution on the DEF CON 27 badge via NFMI
0:24:06
DEF CON 29 Ham Radio Village - Eric Escobar - Getting started with low power/long distance Comms
1:05:07
DEF CON 29 Ham Radio Village - Bryan Fields - Spectrum Coordination for Amateur Radio
4:01:51
DEFCON 29: Network Analysis with Wireshark
0:39:47
DEF CON 29 - Hao Xing, Zekai Wu - How I use a JSON 0day to Steal Your Money on the Blockchain
0:42:14
DEF CON 29 - Ian Coldwater, Chad Rikansrud - Real Life Story of the 1st Mainframe Container Breakout
0:45:02
DEF CON 29 - Chad Seaman - UPnProxyPot: Fake the Funk, Become a Blackhat Proxy, MITM their TLS...
0:22:23
DEF CON 29 -Joseph Gabay - DoS Denial of Shopping: Analyzing and Exploiting Shopping Cart Systems
0:28:05
DEF CON 29 Blue Team Village - Gert-Jan Bruggink - This is what we thought would happen in 2021
0:01:36
Propagate the Signal [with JRWR] | DEF CON 29 #badgelife
Комментарии