"The Defender's New Clothes"
summary
Argues defenders overtrust appliances that run with high privilege and rely on brittle string matching, demonstrates concrete bypasses: Cloudflare and WAFs fail when URLs get extra slashes — dubbed power of slash — and base64/mutation or multipart fragmentation lets payload pieces slip past filters, then reassemble in writable logs to create a PHP webshell. Uses LFI→RCE pivoting and an htaccess SSI webshell, provides tools on GitHub and shows common Sigma/YARA rules are trivial to evade.
AI-written summary · about
chapters (40)
- 0:00Introduction
- 0:30Magic Clothes
- 1:41Defenders New Clothes
- 2:18Privileged Access
- 3:09How do we know
- 4:56The story
- 5:50Access control
- 7:29Power of slash
- 9:43New techniques
- 11:06Unicode friendly
- 12:05Directory traversal
- 12:22Relative traversal
- 13:24Cloudflare
- 14:39Push
- 15:02Upload
- 15:18File Rotation
- 16:09Multiline Comments
- 17:07Multiline Comments Code
- 18:27System hardening
- 18:41System hardening list
- 19:28Running commands
- 19:49Sidestep hardening
- 21:05php script
- 21:35Is this effective
- 23:12The Infinite Pool of Wisdom
- 23:39Instant Response
- 24:33Detection Rules
- 24:59GitHub Issues
- 25:22Denial of Service
- 25:48Invalid Syntax
- 26:26YARA Rules
- 26:47Sigma Rules
- 27:27Vsphere Rules
- 28:45NSA Cyber Detection
- 30:42Backdoor and Catalina
- 32:23Traffic Management Interface
- 32:42UK Variant
- 33:08Conclusion
- 33:39Overlapping defenses
- 34:47Conclusions
related talks
42mModern web application bugs
01h 01mSomething Something Cyber
57mSomething Something Security
52mFlying Under the Radar - New Security Evasion Techniques
28mBlue Team Fundamentals
47mLive Hacking: Breaking into Your Web App
19mLive Hacking Session Part 1
14mWeb Application Firewalls: A False Sense of Security?