Cracking the Lens: Targeting HTTP's Hidden Attack-Surface

[@syntasec1433]

just now stumbling onto this. I find all of James' stuff very insightful, and his critical thinking abilities in this context is really something to be admired.

[@siddharthchhetry4218]

I love how his research got better with time :)

[@PERRECTUMpl]

Great research! Wasn't aware of this at all. Thank you for sharing.

[@AntiAtheismIsUnstoppable]

Words are, he is now hired by Yahoo

[@mo938]

i've watched this like 5 times. this guy is amazing.

[@Bestself2015]

Cool. Did it actually help you find any findings in the real-world? I am still having trouble on how I can apply this in real-world is there is not enough specific information. Make no mistake, the speaker is a genius.

[@mo938]

@@Bestself2015 nice try nsa

[@yoshi5113]

and i dont really understand how to re create this attack 😂

[@mo938]

@@yoshi5113 you first need to find a target that's using a load balancer. Then you need to specially craft http requests (like modifying headers, etc..)

[@alexxnica]

Excellent presentation! Congratulations on your findings and thanks for sharing!

[@jean-claudekuo3252]

Thanks for the OAST

[@thepuzzlemaker2159]

Love how almost all the shown addresses at 27:50 from Tor have Tor in all caps at the end

[@xssfun]

In first case of yahoo - how did you find the ip of the load balancer for you to update the same in host header?

[@CheshireSwift]

I'd honestly be prepared to believe the Netflix iPhone thing is them running something on an iOS simulator.

[@brianx2405]

thanks blackhat & thank you james kettle. amazing bug hunter-ing and excellent packet analysis.

[@PacAnimal]

Why do all these damn servers have access to internal infrastructure other than maybe a single port on an isolated sql server? Have any of these companies heard of the consept of a DMZ? Of multiple isolated DMZ's for different purposes? They're kind of ancient concepts...

[@pjsmith4471]

dmz DONT protect them... it is easily to go more in depth in the network even the org have a web server in their DMZ

[@PacAnimal]

Don't try to be clever. If the DMZ is properly isolated, as it damn well should be, it's the same as hacking a completely different company. Leaves you no better off than you were. It's not as if a DMZ requires any access to an internal network unless you're horrible at designing networks. If the DMZ has any better access to the rest of your network than the outside does, you're doing it wrong.

[@qtpie2630]

oh you need to keep watching blackhat

[@autohmae]

What I'm also surprised about: Why do these proxies not have whitelists of what they should be connecting to. Or better use something like haproxy connect to configured backends and nothing else.

[@qtpie2630]

If there's a cable, there's probably a way.

[@avatarstudios7041]

haa late comment james kattle is something else guys :) what a serious research

[@Stopinvadingmyhardware]

These days they don’t even need that. Little hypnosis on a video and they can walk right up to you and plug in devices right into your USB ports.

[@tobysonline4356]

Took me three days to find this video again

[@CU.SpaceCowboy]

i saw this guy break that code sandbox website by breaking up like 2 php commands. OG

[@flawlesscode6471]

@Houston Nash nope just a scam

[@glowingone1774]

@@flawlesscode6471 I like how they think people like us fall for this 😆

[@flawlesscode6471]

@@glowingone1774 yea. they pull it under every hacking video

[@0xgodson119]

neega vera maari dholarae

[@xdman2956]

17:18 how does setting the url help?

[@yoloswaggins2161]

New videos have their comments disable, why is this?

[@user-iu3ii8sq6t]

there were too many grammar mistakes in the comments, so they just disabled them

[@green_quirk]

Awesome.

[@RaceForMoney]

Awesome!

[@fedemtz6]

What app is he using to send the http packets?

[@vaniahaddad3239]

0:53 What's wrong with it?

[@adeadcrab]

shout outs

[@RAGHAVENDRASINGH17]

Nice

[@Z111211211]

What is a ping back ?

[@supercombinecp860]

4:55

[@maverickstclare3756]

putting your hostname in the request and specifying your DNS server as authoritative so anyone that wants to know the IP of that hostname has to ask your DNS server for the IP. If the DNS lookup doesn't come from the expected destination then you can begin to explore.

[@FennecTECH]

only reason i could see doing that (thats not nasty) is silently redirecting users to the HTTPS version of the site

[@LiEnby]

sucks if your trying to use the non-http version of the site for whatever reason... (maybe trying to see if theres some weird vulnerability w using HTTP but not HTTPS? or maybe an old device that doesnt support SSL?)

[@thewhitefalcon8539]

This is internet phreaking.

[@LiEnby]

lmfao yahoo hacked 300 times

[@cipheroth]

bad