Organizer
Partner Company
A Whole New Perspective In SSRF: MAKE IT GREAT AGAIN AND Ignore Most Of SSRF DEFENSE SOLUTIONS THAT WE KNOWND
Yongtao Wang, Yang Zhang, Kunzhe Chai
BCM Social Corp
Abstract
In this presentation, we will start with some traditional SSRF attack chains before introducing our research. After that, we will exhibit a new attack surface and demonstrate it how to ignore SSRF protections, even results in RCE(Remote Command Execution). In the end, we will also disclose a number of vulnerabilities that existed in prevalent programming languages and fundamental libraries, and describe them in real-world attack scenarios which have never been noticed.
Speaker Info
Yongtao Wang(@by_Sanr) is Leader of Red Team at BCM Social Corp.He has profound experience in wireless security and penetration testing, and His research interests include Active Directory、Threat hunting.He shares research achievements at China Internet Security Conference (ISC), Blackhat, Codeblue, POC, CanSecWest, HackInTheBox etc.
Yang Zhang(izy) is a security researcher in BCM Social Corp, with rich experience in application security and penetration testing, leader of Back2Zero Team and core member of XDSEC Team. Currently focusing on the security research of application security, cloud security, blockchain security. International renowned security conference speaker.
Kunzhe Chai (Anthony) is a Chief Information Security Officer at BCM Social Corp, Founder of PegasusTeam and author of the well-known security tool MDK4. He is the maker of China's first Wireless Security Defense Product Standard and he also is the world's first inventor of Fake Base Stations defense technology, He leads his team to share the research results at HackInTheBox(HITB), BlackHat, DEFCON, Cansecwest, CodeBlue, POC, etc. Follow him on Twitter at @swe3per