YoVDO

FIESTA - An HTTPS Side-Channel Party

Offered By: OWASP Foundation via YouTube

Tags

Conference Talks Courses Cybersecurity Courses Bug Bounty Courses Web Security Courses Side Channel Attacks Courses Vulnerability Testing Courses

Course Description

Overview

Explore FIESTA, a new tool for testing HTTPS side-channel vulnerabilities, in this 42-minute conference talk from OWASP AppSec EU 2018. Delve into the world of TLS traffic exploitation and learn about past attacks like CRIME, BREACH, and TIME. Discover a previously unused side-channel affecting major internet companies. Examine the tool's configuration, fake web setup, and image loading techniques. Investigate real-world examples involving Google and Facebook, and discuss bug bounty implications. Gain insights into JavaScript-based countermeasures and understand the broader implications for online security.

Syllabus

Intro
Pizza delivery example
Traffic
Compression
Search language
Exploit
Double narrative
FIESTA
Configuration file
Fake web
HTTP
Image loading
Image loading test
The trick
Example
Bounty hunters
Google
Facebook
Bug bounties
Hiding window
JavaScript
Conclusion


Taught by

OWASP Foundation

Related Courses

Computer Security
Stanford University via Coursera Cryptography II
Stanford University via Coursera Malicious Software and its Underground Economy: Two Sides to Every Story
University of London International Programmes via Coursera Building an Information Risk Management Toolkit
University of Washington via Coursera Introduction to Cybersecurity
National Cybersecurity Institute at Excelsior College via Canvas Network