Explore command injection vulnerabilities in F5 iRules through this 49-minute Black Hat conference talk. Dive into the world of BigIP F5 products, widely used by large corporations and governments for reverse proxy and web traffic routing. Learn about iRules, a subset of rules written in TCL-based language, and understand its syntax, structure, and potential security risks. Examine script examples, server headers, and HTTP server configurations. Discover exploitation techniques, including table syntax manipulation and TMSH attack chains. Gain insights into unit testing for iRules and understand the importance of secure coding practices in high-performance network environments. Conclude with a summary of key takeaways and participate in a Q&A session to deepen your understanding of iRules security.
Overview
Syllabus
Introduction
Christopher
What is iRules
iRules the language
Script example
Server header
HTTP server
Syntax
Decalogue
Quotes
Code Example
Exploit
Demo
Table and Table
Table Syntax
Example
Request
TMSH
Attack Chain
Unit Testing
Summary
Questions
Taught by
Black Hat
