Disclaimer - Please be aware that variations in audio quality may occur.
In this clip of Exfiltrated, we discussed manipulating file metadata and content types to bypass security restrictions in web applications.
🟪 We used Burp Suite to change the content field and demonstrated how backend systems might fail to manually check and accept manipulated content types, thus bypassing restrictions.
🟪 We introduced ExifTool which is used for reading metadata and headers to determine a file's type and extension, highlighting the backend's reliance on such tools for security checks.
🟪 A technique called "magic byte" was explained, which involved adding specific characters and headers to a file to alter its MIME type and file type as perceived by security tools, effectively bypassing detection mechanisms.
🟪 The example provided illustrated how adding a specific string ("magic numbers") to the beginning of a file could fool detection tools into misidentifying the file type, using the scenario of a PHP file being treated as an image file to demonstrate the concept.
Exfiltrated is a Proving Grounds Practice machine: portal.offsec.com/labs/practice
Join OffSec Live on Fridays: / offsecofficial
We do demonstrations and walkthroughs of course topics and Proving Grounds machines. Additionally, sessions offer career guidance, including how to build a resume, how to break into #cybersecurity, and interview tips.