Offensive Javascript Techniques for Red Teamers

Explore offensive JavaScript techniques for red teamers in this 33-minute conference talk from BSidesSF 2019. Delve into advanced methods for crafting JavaScript payloads that target internal network vulnerabilities with unprecedented speed. Learn about new reconnaissance techniques traditionally used post-malware implant that can now be applied pre-implant to gain network footholds from a browser. Examine real-world examples of external payloads targeting internal assets at major companies, and understand the process of responsible disclosure for intranet-facing bugs. Topics covered include the Lobster Security Fallacy, browser exploitation limitations, Netflix Singularity, Service Workers, and building an attack portfolio. Gain insights into cutting-edge AppSec strategies that go beyond pre-exploitation, challenging conventional norms in cybersecurity.

Intro
Lobster Security Fallacy
Browser Exploitation
Limitations
Netflix
Singularity
RealWorld Examples
GeoCD Example
Bug Bounty Example
Service Workers
Attack Portfolio
Outro