Practical Attacks Using HTTP Request Smuggling by @defparam

Рет қаралды 41,263

Күн бұрын

Live Every Tuesday, Saturday and Sunday on Twitch:
/ nahamsec
Slides:
drive.google.com/file/d/1iC09...
Follow me on social media:
/ nahamsec
/ nahamsec
twitch.com/nahamsec
hackerone.com/nahamsec
/ nahamsec1
Free $100 DigitalOcean Credit:
m.do.co/c/3236319b9d0b
Signup for HackerOne:
nahamsec.stream/HackerOne
Signup for Hacker101:
nahamsec.stream/H101
Github:
github.com/nahamsec
Nahamsec's Discord:
discordapp.com/invite/ucCz7uh

Пікірлер: 37

@pentestical 4 жыл бұрын

Exactly what I need. Impressive stuff!

@m.waheedanwar7105 3 жыл бұрын

Thank you for sharing.One of great teaching class i ever had.

@1772prem 4 жыл бұрын

Cool PoC, Great session on HTTP smuggling attack.

@ShailuSharma-y3k 9 күн бұрын

The stuff is really great. Thanks a lot !!

@hdphoenix29 4 жыл бұрын

Amazing stuff ! thanks a lot

@dwilliams877 4 жыл бұрын

This was fascinating!

@nowonder9466 3 жыл бұрын

I needed this.

@yashjain1449 4 жыл бұрын

Amazing stuff

@tommysuriel 4 жыл бұрын

This is GOLD!

@tanercoder1915 4 жыл бұрын

mind blown! felt sorry for sysadmins for the consequences of his very last attack in this presentation. highly impactful attack indeed.

@chasejensen88 2 жыл бұрын

Wem

@tanercoder1915 2 жыл бұрын

@@chasejensen88 one year later )

@lancemarchetti8673 Жыл бұрын

This was trooly amayzing

@Imhamzaazam 4 жыл бұрын

Thankyou!

@Andrei-ds8qv Жыл бұрын

Thank you

@m0niruzzaman 3 жыл бұрын

Thanks

@testing7468 2 жыл бұрын

The last one was mind blowing

@iamkid4357 4 жыл бұрын

wow amazing

@domaincontroller 3 жыл бұрын

01:10 interest low stack system/integration/protocol bugs 01:27 agenda 02:04 quick introduction, CL.TE /TE.CL "HTTP Desync Attacks: Smashing into the Cell Next Door " James Kettle, kzfaq.info/get/bejne/rZOVfbBjtcmUe30.html watchfire paper, 2005 shorturl.at/cfstN ====================================== CL.TE Desync Attack ====================================== 03:21 CL.TE which is the front-end.back-end 03:35 the front-end will interpret a web request using its content-type header and the back-end will interpret the same request using the transfer-encoded header 03:51 here we have an attacker, post request, T.E header is malformed 04:18 Back-end ignores the content-length ============================= TE.CL Desync Attack ============================= 05:58 [...] 08:14 testing for request smuggling 08:37 github.com/defparam/smuggler 09:58 Impact radius of request smuggling 10:14 Open Desync, the3 most dangerous of the three 10:28 IP Desync 10:51 Self Desync, VPN, VPS ============================= Practical Attack ============================= 11:20 Recon stories

@rahulmyakala9816 4 жыл бұрын

Hello sir. I have a question I couldn't find how to do that. There are 15 numbers from 1-15. It can generate any number randomly. How can we identify which number is being generated?

@ibrahime316 3 жыл бұрын

Is their github page for the test server , I wanna test my self

@jondo-vh8tx 3 ай бұрын

14:40 the takeway i love it. i was in talk with a pretty big sec tech company . one of their guys tried to act like a wise guy: there is no risk with a robots.txt. ok sure kiddo.

@thebest152 3 жыл бұрын

Hi Nahamsec, Can you share the lab so I can practice?

@hydroloco5132 3 жыл бұрын

seeing the view count gives me the warm n fuzzies cus i know im super early to the party you ladies and gents are super rad and i couldnt be more excited to start hunting

@thedarkarmy8713 6 ай бұрын

Does HTTP Request smuggling, just works on POST method, or also on GET ? I have heard it just works on POST method..

@goodboy8833 4 жыл бұрын

Why don't you ppl invite ippsec

@khammama2974 4 жыл бұрын

18:48 recon story#2 is about api.zomato.com🕵️ got a bounty of. 15k USD

@hamrodesh4362 4 жыл бұрын

Tcm hair 😂

@hidayatbachtar 3 жыл бұрын

how attacker poisoing the HTTP, but Victim access on HTTPS ? can it's still work ? or not? if work, how?

@omarataallah9451 Жыл бұрын

in this vulnerability, there is no key different between http and https, but the thing you must looking for is the http version, if it's http/2.0 then you have to try another ways to exploit it by downgrading the http version to 1

@hidayatbachtar Жыл бұрын

@@omarataallah9451 ouh thats about http version not http / https ? am i right?

@omarataallah9451 Жыл бұрын

@@hidayatbachtar true