RootedCON Madrid 2022
Join us in Madrid! 🇪🇸
For its 2022 edition, RootedCON will be held on March 10-12 at the Kinepolis in Madrid. The computer security conference was born with the purpose of promoting the exchange of knowledge between members of the security community.
YesWeHack is thrilled to be sponsoring the event a second time! Swing by the exhibition area to meet with our team: Bitk, our Tech Ambassador, Faustine Michaux, our Bug Bounty Advisor and Alice Lecoq, CSM.
And attend the technical talk of BitK on March 11, 3:30pm, in Room 25, on the following topic:
Advanced template injection exploitation, beyond RCE
During his Black Hat 2015 presentation, James Kettle explained how template injections could lead to code execution. At the end of the talk, he recommended running application in containers with limited privileges and read-only file system. Six years later, containers are now the standard of web-app deployment and getting code execution inside a well isolated container can be seen as low impact.
This talk will explore new exploitation techniques specially crafted for hardened environment.
One overlooked aspect of SSTI is that the injected code is running in the webserver process, this allows an attacker to do in-memory attack and inject persistent malicious code without the need to touch the file system. We will dive into the internals of Flask, Django and Express to understand how a request is handled and how we can hook internal functions to steal secrets or deliver malicious code to the users.
This talk will be completed by the presentation of “parasite”, a new tool made to facilitate such attacks by providing a simple GUI to explore a website internals and hook any routes.
Date(s): 10/03/2022 - 12/03/2022 | All Day