Modern web application bugs
summary
Shows reproducible demos of XML external entity attacks that read /etc/password and AWS metadata (including a $10,000 Twitter XXE report), XSLT and blind XXE exfiltration, unsafe deserialization chains that spawn bash netshells for full RCE, and server and client template injection (Twig and Angular sandbox bypasses). Covers SSRF tricks (169.254.169.254, numeric/hex/octal IP encodings), subdomain takeover cases (Heroku, Shopify, Microsoft), web cache poisoning via headers like X-Host, and GraphQL data leaks; demonstrates Burp/ParamMiner and Bugcrowd/HackerOne reports.
AI-written summary · about
chapters (29)
- 0:00about me
- 9:25Blind XXE
- 11:04Stopping XXE
- 12:48JSON serialization
- 13:09Deserialization Attack Gadgets
- 17:32Custom deserialization attacks
- 18:41Underlying cause
- 19:00Stopping insecure deserialization
- 20:02Templating frameworks
- 28:14Testing for template injection
- 29:06Stopping template injection
- 31:51Common mistakes
- 34:28Server side requests
- 35:14SSRF - Server-Side Request Forgery
- 37:32SSRF - internal services
- 38:08IP-adresses - Blacklisting is hard...
- 40:39Broken URL parsing
- 42:04Protection
- 43:13Subdomain takeover/hijacking
- 43:34Cloud services
- 44:10Example
- 45:26Subdomain takeover - Impact
- 51:24Crowd demo
- 52:35Tricky headers
- 52:56Complicating the attack
- 53:16Stopping web cache poisoning
- 54:47What is this?
- 55:18GraphQL gotchas
- 56:07Resources
