Explore a comprehensive conference talk from NahamCon2020 that delves into breaking web security through a virtual appliance. Learn about hacking methodologies, case studies, and practical techniques for enumerating services and defining attack vectors. Discover how to target admin UIs, understand proxy services, and exploit vulnerabilities like CVE-2017-3163. Gain insights into leaking active session IDs and creating exploitation chains. Perfect for cybersecurity enthusiasts and ethical hackers looking to enhance their web security testing skills.
A Heaven for Hackers - Breaking Web Security Virtual Appliance
Overview
Syllabus
Intro
Case Study
Methodology
Free Trial
Access to the Terminal
3 - Breaking Hardenings
Product Features
Enumerate Services
Define Attack Vectors
Targeting Admin UI
7- Find a Vulnerability
7.1 - Understanding Proxy
7.1 Reversing Proxy Service
7.1 - Reversing Proxy Service
7.1 - Accessing to the SOLR Admin
CVE-2017-3163 - Arbitrary file read via path traversal attack in ReplicationHandler
Leaking Active Session ID
Exploitation Chain
Taught by
NahamSec
