Host of Troubles - Multiple Host Ambiguities in HTTP Implementations
Offered By: Association for Computing Machinery (ACM) via YouTube
Course Description
Overview
Syllabus
Intro
Multiparty interactions in current Internet
Previous works about ambiguity
How HTTP requests are processed
Host - A critical HTTP field
Technique 1: Multiple Host header
How do implementations handle requests with multiple Host header?
How implementations handle requests with space-surrounded Host Header?
Absolute-URI as request-target
How do different implementations handle absolute-URI?
Attacks exploiting host ambiguity
Cache poisoning Co- hosting website
Cache poisoning Co-CDN website
Cache poisoning any HTTP website CVE-2016-4553
Firewall bypass
WAF bypass
How Prevalent are Upstream/Downstream vulnerabilities?
Outline
Measurement set up
Execution of test cases
Measurement results
Mitigation
A test in my phone's network
Discussion
Taught by
ACM CCS
Related Courses
Peeling the Onion's User Experience Layer - Examining Naturalistic Use of the Tor BrowserAssociation for Computing Machinery (ACM) via YouTube DeepCorr - Strong Flow Correlation Attacks on Tor Using Deep Learning
Association for Computing Machinery (ACM) via YouTube SandScout - Automatic Detection of Flaws in iOS Sandbox Profiles
Association for Computing Machinery (ACM) via YouTube Game of Decoys - Optimal Decoy Routing Through Game Theory
Association for Computing Machinery (ACM) via YouTube PREDATOR - Proactive Recognition and Elimination of Domain Abuse at Time-Of-Registration
Association for Computing Machinery (ACM) via YouTube