Offensive Javascript Techniques for Red Teamers
summary
Walks through concrete offensive JavaScript workflows: using BeEF, fetch/WebRTC and prebuilt recon (Certificate Transparency, VirusTotal, PassiveTotal) to enumerate thousands of subdomains, queue an exploit for a known internal app (example Jenkins/ReviewBoard/GeoCD), then spray a /24 in ~30 seconds and trigger remote code execution or install a web shell. Demonstrates DNS rebinding to bypass SOP in ~60s, and using service workers to run JavaScript after tab close (minutes), yielding internal shells and successful responsible disclosures.
AI-written summary · about
chapters (12)
- 0:00Introduction to talk
- 1:23Modern browser attack surface
- 5:58Browser exploitation with BeEF
- 9:51Same-origin policy explained
- 13:39Reflected XSS vs stored XSS
- 16:06Recon for internal networks
- 19:41Subdomain enumeration techniques
- 22:27DNS rebinding attacks
- 25:53Real-world bug bounty examples
- 30:06Service workers persistence
- 31:31Red teaming with browser features
- 32:13Conclusion and Q&A
