Hacking Articles Tips Tricks Videos Tutorials

erhub 118. BugBounty 119. Huntr 120. Universocraft 121. Wireclub 122. AminoApps 123. Trakt 124. Giphy 125. Minecraft List 126. SEOClerks 127. Mix 128. Codecademy 129. Bandcamp 130. Poshmark 131. hackster 132. BodyBuilding 133. Mastodon 134. IFTTT 135. Anime…

l: Blackbird first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

8 viewsedited 02:10

Hacking Articles Tips Tricks Videos Tutorials

Photo

Black Hat Ethical Hacking
Browser-powered desync: New class of HTTP request smuggling attacks showcased at Black Hat USA

Browser-powered desync: New class of HTTP request smuggling attacks showcased at Black Hat USAPost Views: 252 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon-1.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes A new class of HTTP request smuggling attack allowed a security researcher to compromise multiple popular websites including Amazon and Akamai, break TLS, and exploit Apache servers.Speaking at Black Hat USA yesterday (August 10), James Kettle unveiled research that opens the new frontier in HTTP request smuggling – browser-powered desync attacks.

The briefing and it’s whitepaper, titled ‘Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling’, builds on Kettle’s previous research into desync attacks.

Traditional desync attacks poison the connection between a front-end and back-end server and are therefore impossible on websites that don’t use a front-end/back-end architecture.

However this new technique causes a desync between the front-end and the browser, allowing an attacker to “craft high-severity exploits without relying on malformed requests that browsers will never send”, Kettle noted.

This can expose a whole new range of websites to server-side request smuggling and enables an attacker to perform client-side variations of these attacks by inducing a victim’s browser to poison its own connection to a vulnerable web server.

Kettle demonstrated how he was able to turn a victim’s web browser into a desync delivery platform, shifting the request smuggling frontier by exposing single-server websites and internal networks.

He was able to combine cross-domain requests with server flaws to poison browser connection pools, install backdoors, and release desync worms – in turn compromising targets including Amazon, Apache, Akamai, Varnish, and multiple web VPNs.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course DiscoveryKettle told attendees at the 25th anniversary of the annual hacking conference that four separate vulnerabilities led to the discovery of browser-powered desync attacks.

The first, involving request validation, leverages a technique in which an attacker can use two requests down the same connection with a valid host header in order to gain access to the host in the second request, because the reverse proxy only validates the first host.

The second, first-request routing, is a closely related flaw which occurs when the front-end uses the first request’s Host header to decide which back-end to route the request to, and then routes all subsequent requests from the same client connection down the same back-end connection.

Kettle also discovered a technique to detect connection-locked request smuggling by using a delay and reading the data early to decide if the front-end is using the Content-Length header.

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/819f-article-220810-james-k-1024x576.jpg
James Kettle presents at the annual hacking conference held in Las Vegas
If it is using the Content-Length it will time out, which will signify the difference between connection-locked HTTP/1 request smuggling and harmless HTTP pipelining.

A fourth vulnerability caused a desync known as CL.0/H2.0. Kettle was able to use this to compromise Amazon users’ accounts, enabling him to steal users’ requests and add them to his shopping list. He could capture all their requests, including tokens which could have enabled him to impersonate those users.

Speakin[...]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking

Browser-powered desync: New class of HTTP request smuggling attacks showcased at Black Hat USA | Black Hat Ethical Hacking

A new class of HTTP request smuggling attack allowed a security researcher to compromise multiple popular websites including Amazon and Akamai, break TLS, and exploit Apache servers.

9 viewsedited 02:10

Hacking Articles Tips Tricks Videos Tutorials

Black Hat Ethical Hacking
Browser-powered desync: New class of HTTP request smuggling attacks showcased at Black Hat USA

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking

Browser-powered desync: New class of HTTP request smuggling attacks showcased at Black Hat USA | Black Hat Ethical Hacking

A new class of HTTP request smuggling attack allowed a security researcher to compromise multiple popular websites including Amazon and Akamai, break TLS, and exploit Apache servers.

9 viewsedited 02:10

Hacking Articles Tips Tricks Videos Tutorials

prevent xss
https://www.reddit.com/r/Pentesting/comments/wn0pak/prevent_xss/

hello Is setting the cookie to http only is enough to protect against xss attacks? submitted by /u/Objective_Fruit_5995 (https://www.reddit.com/user/Objective_Fruit_5995)
[link] (https://www.reddit.com/r/Pentesting/comments/wn0pak/prevent_xss/) [comments] (https://www.reddit.com/r/Pentesting/comments/wn0pak/prevent_xss/)

___________________________
@hacking_Attack
@Hacking_Video

prevent xss

hello Is setting the cookie to http only is enough to protect against xss attacks?

9 viewsedited 02:18

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
How to Clear Security Obstacles and Achieve Cloud Nirvana

Back-end complexity of cloud computing means there's plenty of potential for security problems. Here's how to get a better handle on SaaS application security.

9 views03:06

Source

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
Novel Ransomware Comes to the Sophisticated SOVA Android Banking Trojan

Unusually, SOVA, which targets US users, now allows lateral movement for deeper data access. Version 5 adds an encryption capability.

9 views03:06

Source

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
Software Supply Chain Chalks Up a Security Win With New Crypto Effort

GitHub, the owner of the Node Package Manager (npm), proposes cryptographically linking source code and JavaScript packages in an effort to shore up supply chain security.

8 views03:06

Source

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
Patch Madness: Vendor Bug Advisories Are Broken, So Broken

Duston Childs and Brian Gorenc of ZDI take the opportunity at Black Hat USA to break down the many vulnerability disclosure issues making patch prioritization a nightmare scenario for many orgs.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

Patch Madness: Vendor Bug Advisories Are Broken, So Broken

Dustin Childs and Brian Gorenc of ZDI take the opportunity at Black Hat USA to break down the many vulnerability disclosure issues making patch prioritization a nightmare scenario for many orgs.

8 viewsedited 03:09

Hacking Articles Tips Tricks Videos Tutorials

Directory Traversal — Explicação [PT/BR]
https://medium.com/@anonymindsec/directory-traversal-explica%C3%A7%C3%A3o-pt-br-a644c94380ce?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Medium

Directory Traversal — Explicação [PT/BR]

Hoje eu resolvi fazer um pouco diferente, normalmente eu tenho mais o hábito de escrever sobre write-ups do que sobre as vulnerabilidades…

7 viewsedited 04:03

Hacking Articles Tips Tricks Videos Tutorials

6 views04:03