Headless Browser Hide and Seek

on YouTube ↗44m

" summary

Covers how headless browsers (notably PhantomJS) are used offensively to interact with dynamic sites for fuzzing, finding vulnerabilities, performance bottlenecks, and automating attacks, and shows demonstrations of attacking with PhantomJS, exploiting vulnerabilities in PhantomJS itself, and abusing remote PhantomJS instances. Describes attacker evasion techniques to impersonate real browsers and concrete countermeasures to detect and expose malicious headless clients, collect forensic/attribution data, and safely use headless-browser tools.

AI-written summary · about

" chapters (15)

1. 0:00Start
2. 0:32What is a Headless Browser and How it Works CA
3. 2:37PhantomJS World
4. 4:49Legitimate uses and how you can benefit
5. 5:58Malicious Use of Headless Browser
6. 6:56Impersonating a legitimate browser
7. 8:05How It Is Different from a Real Browser
8. 29:15Headless Browser Hide
9. 30:58Score board
10. 31:47Attack on PhantomJs
11. 32:25How to turn a headless browser against the attacker
12. 37:10Tips for Using Headless Browsers Safely
13. 38:40Tips For Web Admins
14. 39:40Start Detecting Already
15. 42:49References

" related talks

• 35mServer-Side Browsers: Exploring the Web’s Hidden Attack SurfaceMarius Musch · RuhrSec 2023
• 31mFinding Stealthy Bots in Javascript Hide and SeekAdam Abramov · OpenJS World 2022
• 39mExploiting Unknown Browsers and ObjectsGareth Heyes · OWASP AppSec Europe 2018
• 40mHostile JavaScript: Attacking and Defending the BrowserTodd H. Gardner · NDC London 2023
• 28mRethinking Browser Automation: Unleashing the Power of Puppeteer and PlaywrightÖnder Ceylan · JSWorld Conference 2024
• 43mAttacking Modern Web TechnologiesFrans Rosén · OWASP AppSec Europe 2018
• 33mOffensive Javascript Techniques for Red TeamersDylan Ayrey, Christian Frichot · BSidesSF 2019
• 30mThe Most Annoying Website (aka "The Power of the Web Platform")Feross Aboukhadijeh · dotJS 2017