Attacking Modern Web Technologies

on YouTube ↗55m

" summary

Describes concrete exploits: postMessage + WebSocket-reconnect lets an attacker harvest Slack xoxs by forcing a reconnect and racing with goodbye messages, fixed in about 5 hours and rewarded ~$3,000; Werkzeug debugger exposes a slash/console RCE that likely caused the Patreon breach; an appcache fallback attack on Dropbox leaks one‑time download URLs (reported reward $12,000); misconfigured AWS/Google upload policies and signed‑URL logic let attackers list, overwrite or take full control of buckets (examples include a 2 GB file listing and $25,000 payouts).

AI-written summary · about

" chapters (21)

1. 0:00Intro
2. 1:01Frans Rosén
3. 3:23How did I get here?
4. 7:27Rundown
5. 9:23Werkzeug Debugger
6. 11:33Patreon
7. 19:46Cookie Stuffing
8. 20:55Bug in EVERY BROWSER
9. 22:04Surprise - Specification was vague
10. 23:01AppCache DEMO
11. 28:52Service Workers - AppCache's bigger brother
12. 32:29Upload Policies AWS S3
13. 33:31Pitfalls AWS S3
14. 35:54AWS STS • Generates temporary credentials client side
15. 39:28Your own policy-logic - The worst
16. 42:18Full read access to every object
17. 44:45Slack's postMessage
18. 46:07Slack's call function
19. 46:53Rabbit hole
20. 47:57reconnect!
21. 54:02Walkthrough

" related talks

• 43mAttacking Modern Web TechnologiesFrans Rosén · OWASP AppSec Europe 2018
• 29mThe Smörgåsbord of web app hackingFrans Rosén · Nordic.js 2016
• 56mModern Web Vulnerabilities 2020Erlend Oftedal · NDC Security Oslo 2020
• 50mModern WebApp VulnerabilitiesErlend Oftedal · Øredev 2019
• 41mLive Hacking: Breaking into Your Web AppBrian Vermeer · GOTO Amsterdam 2022
• 58mExploiting web messaging implementationsBarak Tawily · Global AppSec US 2021 Virtual
• 30mHow to hack a web app?Asim Hussain · Render Conference 2018
• 50mHTTP Desync Attacks: Smashing into the Cell Next DoorJames Kettle · Black Hat USA 2019