M33tfinder
summary
Shows a practical exploit against Cisco Meeting Server WebRTC web-bridge: server responses leak valid numeric conference ID ranges and whether a meeting exists, enabling enumeration and then brute‑forcing 4–6 digit passcodes. Implements two Python tools, midfinder (async POST range + active-conference enumeration) and midbreak (dictionary/brute-force of numeric PINs), finds 12 conferences (10 PIN‑protected) on a test server, recovers codes (example 0881) and joins as a guest to record audio. Vulnerability is reported and fixed in 2.5.0.
AI-written summary · about
chapters (10)
- 0:00Start
- 4:59LOOKING FOR ACME
- 9:25WEBRTC
- 11:40PASSCODE AND CONFIGURATION
- 17:17POST REQUEST
- 19:37PYTHON CODE M33TFINDER
- 20:03PYTHON CODE M33TBREAK
- 25:05DETECTING MEETINGS
- 26:11OBTAINING PASSCODE
- 26:58JOINING THE MEETING
related talks
46mWeb Security Experts: Are you overlooking WebRTC vulnerabilities?
53mVoIP Wars: the Phreakers Awaken
56mClosing Ceremony
39mEavesdropping on WebRTC Communication with Funny Cat Pictures
34mTowards Discovering Remote Code Execution Vulnerabilities in Apple FaceTime
10mTechnical Tracks
58mHacking in 2016 - How is our systems broken?
54mWhere did you find that?