Modern websites are growing more complex with different reverse proxies and balancers covering them. They are used for various purposes: request routing, caching, putting additional headers, restricting access. In other words, reverse proxies must both parse incoming requests and modify them in a particular way. However, path parsing may turn out to be quite a challenge due to mismatches in the parsing of different web servers. Moreover, request converting may imply a wide range of different consequences from a cybersecurity point of view. I have analyzed different reverse proxies with different configurations, the ways they parse requests, apply rules, and perform caching. In this talk, I will both speak about general processes and the intricacies of proxy operation and demonstrate the examples of bypassing restrictions, expanding access to a web application, and new attacks through the web cache deception and cache poisoning.
Reverse proxies & Inconsistency
November 21, 17:40|30min|hall Mir
Alexey (GreenDog) Tiurin. Senior Security Researcher, pentester with 8 years of experience. Hacked many things, specifically ERP and banking systems, Windows-networks. For last 4 years, he has been into Web hacking. He loves sharing knowledge: he wrote EasyHack column for Xakep magazine for 5 years, he is co-organizer of Defcon Russia (DCG #7812). He received a bite from the Deserialization Demon, so be careful and do not talk about deserialization near him.