Ashwin Pathak & Ajay Prashar

Workshop title:

Out-of-Band Exploitation for Asynchronous Vulnerabilities

Abstract:

Out-Of-Band (OOB) technique provides an attacker with an alternative way to confirm and exploit a vulnerability that is otherwise “blind”. In a blind vulnerability, as an attacker, you do not get the output of the vulnerability in the direct response to the vulnerable request. The OOB techniques often require a vulnerable entity to generate an outbound TCP/UDP/ICMP request and that will then allow an attacker to detect or exfiltrate data. The success of an OOB attack is based on the egress firewall rules i.e. which outbound request is permitted from the vulnerable system and the perimeter firewall. In such cases, DNS can bypass firewall restrictions as it is out of the purview of most firewall configurations.

In this workshop, we have kept a rule of thumb to use DNS as our best bet for OOB to succeed. Thus, we have tried to focus heavily on DNS.

Pre-requisite:

For better experience and taking the best of the workshop it is suggested to install Windows Subsystem Linux on the Windows machine along with Burp community edition. Install WSL Linux with the help of the link : https://docs.microsoft.com/en-us/windows/wsl/install-win10

Bio:

Ashwin Pathak (@AshwinPathak26)

Ashwin is a senior security consultant with 6 years of experience with expertise in application security, network security. He is responsible for performing security assessments and Penetration Testing across multiple domains, including web applications, mobile applications, network infrastructure and cloud infrastructure for NotSoSecure. He is a part of the team that created vulnerable labs of the Advanced Web Hacking course of NotSoSecure. He is the co-author of the Out Of Band cheat-sheet published on NotSoSecure blog. He is listed in a few Hall of Fame for bug bounties.

Ajay Prashar (@9r4shar4j4y)

Ajay has been with NotSoSecure since early 2018 and his role involves mostly carrying out web application and infrastructure Penetration Testing. He is a part of the team that created vulnerable labs of the Advanced Web Hacking course of NotSoSecure. In February 2019, one piece of his work published on the NotSoSecure blog entitled 'Data Exfiltration via Formula Injection' was voted as one of the top 10 web hacking techniques of 2018 by the web security firm Portswigger Ltd.