Defeating The Intercepting Web Proxy
-
Upload
websecurify -
Category
Software
-
view
98 -
download
2
description
Transcript of Defeating The Intercepting Web Proxy
![Page 1: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/1.jpg)
Defeating The Intercepting Web Proxy A Glimpse Into the Next Generation of Web Security Tools
Wednesday, 10 April 13
![Page 2: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/2.jpg)
Who is this talk for?
Wednesday, 10 April 13
![Page 3: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/3.jpg)
Why web proxies?
Wednesday, 10 April 13
![Page 4: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/4.jpg)
•Proxies are basic tools.
•They are general purpose.
•Provide visibility of the comms.
Wednesday, 10 April 13
![Page 5: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/5.jpg)
Written in Java!Wednesday, 10 April 13
![Page 6: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/6.jpg)
Buffering!Wednesday, 10 April 13
![Page 7: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/7.jpg)
Large files are no fun!Wednesday, 10 April 13
![Page 8: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/8.jpg)
No pipelining!Wednesday, 10 April 13
![Page 9: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/9.jpg)
WebSocket are no go!Wednesday, 10 April 13
![Page 10: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/10.jpg)
Plain auth is pain!Wednesday, 10 April 13
![Page 11: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/11.jpg)
SSL auth is pain!Wednesday, 10 April 13
![Page 12: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/12.jpg)
Custom auth is no!Wednesday, 10 April 13
![Page 13: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/13.jpg)
It takes time to setup!Wednesday, 10 April 13
![Page 14: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/14.jpg)
Everything is just a request and a response.
No understandings of the app purpose and function.
Wednesday, 10 April 13
![Page 15: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/15.jpg)
Does it pass grandma’s test for Ease of Use?
Wednesday, 10 April 13
![Page 16: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/16.jpg)
Charles Darwin
It is not the strongest of the species that survives, nor the most intelligent,
but the one most responsive to change.
Wednesday, 10 April 13
![Page 17: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/17.jpg)
Innovation ended with Achilles!
Wednesday, 10 April 13
![Page 18: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/18.jpg)
This is how web apps will look like in 2 years.
Wednesday, 10 April 13
![Page 19: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/19.jpg)
Unreal3 engine is ported to asm.js.
Wednesday, 10 April 13
![Page 20: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/20.jpg)
The most powerful client ever built.
Wednesday, 10 April 13
![Page 21: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/21.jpg)
HTML5Wednesday, 10 April 13
![Page 22: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/22.jpg)
JavaScriptWednesday, 10 April 13
![Page 23: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/23.jpg)
NECKO, XPCOMWednesday, 10 April 13
![Page 24: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/24.jpg)
Chrome APIsWednesday, 10 April 13
![Page 25: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/25.jpg)
To Da RescueWednesday, 10 April 13
![Page 26: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/26.jpg)
Web Security Testing Reinvented
Wednesday, 10 April 13
![Page 27: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/27.jpg)
•AttackAPI 2005/2006
•Technika 2006/2007
•Weaponry 2008/2009
•Websecurify Suite 2011/-
Wednesday, 10 April 13
![Page 28: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/28.jpg)
Suite
Wednesday, 10 April 13
![Page 29: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/29.jpg)
Runs In The Browser Runs In The Cloud
Instant Queued
Proactive Reactive
Online/Offline Online
SAASWEBSECURIFY
Wednesday, 10 April 13
![Page 30: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/30.jpg)
See what they do.
Wednesday, 10 April 13
![Page 31: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/31.jpg)
Compiler
Code
Code
Wednesday, 10 April 13
![Page 32: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/32.jpg)
Browser
Ext.
Code
Wednesday, 10 April 13
![Page 33: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/33.jpg)
Code TargetExt.
Wednesday, 10 April 13
![Page 34: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/34.jpg)
Code TargetExt.
Worker
Wednesday, 10 April 13
![Page 35: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/35.jpg)
•Ability to send requests.
•Ability to intercept transactions.
•Ability to access low level APIs.
Wednesday, 10 April 13
![Page 36: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/36.jpg)
DEMOSWednesday, 10 April 13
![Page 37: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/37.jpg)
Building It UpWednesday, 10 April 13
![Page 38: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/38.jpg)
BadAssProxyWednesday, 10 April 13
![Page 39: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/39.jpg)
What is next?
Wednesday, 10 April 13
![Page 40: Defeating The Intercepting Web Proxy](https://reader033.fdocuments.in/reader033/viewer/2022051211/5549a9c2b4c9050c708b5636/html5/thumbnails/40.jpg)
Q&A
Wednesday, 10 April 13