Logo
    Home > Topics > 11

    11

    Explore " 11" with insightful episodes like "HHC Episode 44: The Massacre at Hawkins Lab Pt. 1", "HHC Episode 43: The Dive Pt. 2", "HHC Episode 42: The Dive Pt. 1", "HHC Episode 41: The N.I.N.A. Project Pt. 2" and "HHC Episode 40: The N.I.N.A. Project Pt. 1" from podcasts like ""The Hawkins Hellfire Collective", "The Hawkins Hellfire Collective", "The Hawkins Hellfire Collective", "The Hawkins Hellfire Collective" and "The Hawkins Hellfire Collective"" and more!

    Episodes (100)

    OWASP Raider: a novel framework for manipulating HTTP processes of persistent sessions (eh20)

    OWASP Raider: a novel framework for manipulating HTTP processes of persistent sessions (eh20)
    Raider was created to fill a gap in current tooling for pentesting the authentication process. It abstracts the client-server information exchange as a finite state machine. Each step comprises one request with inputs, one response with outputs, arbitrary actions to do on the response, and conditional links to other stages. Thus, a graph-like structure is created. This architecture works not only for authentication purposes but can be used for any HTTP process that needs to keep track of states. A few years ago, the author had the task of helping developers to build OAuth directly from RFCs, supporting them with security topics and questions. In the beginning, the project ran into some challenges. Early on, we faced the fact that authentication is a stateful process, while HTTP is a stateless protocol. BurpSuite and ZAProxy were incepted when the web did not have states, so they inherited a stateless architecture. REST APIs became popular some years after those tools were created. They have workarounds like Burpsuite macros and ZAP Zest scripts to pass information between requests, but we found that functionality lacking and too complex to implement. So the author wrote custom python scripts to pentest this. It worked fine, but doing this makes the scripts usable only on this system. Therefore, the author decided to create a tool that fills that gap. Raider's configuration is inspired by Emacs. Hylang is used, which is LISP on top of Python. LISP is used because of its "Code is Data, Data is Code" property. It would also allow generating configuration automatically easily in the future. Flexibility is in its DNA, meaning it can be infinitely extended with actual code. Since all configuration is stored in cleartext, reproducing, sharing or modifying attacks becomes easy. Links to the project: - Website: https://raiderauth.com/ - Source: https://github.com/OWASP/raider - Documentation: https://docs.raiderauth.com/en/latest/ - Twitter: @raiderauth - Mastodon: @raiderauth@infosec.exchange about this event: https://cfp.eh20.easterhegg.eu/eh20/talk/R38RUP/
    Chaos Computer Club - recent events feed
    April 10, 2023
    2023
    11
    eh20

    OWASP Raider: a novel framework for manipulating HTTP processes of persistent sessions (eh20)

    OWASP Raider: a novel framework for manipulating HTTP processes of persistent sessions (eh20)
    Raider was created to fill a gap in current tooling for pentesting the authentication process. It abstracts the client-server information exchange as a finite state machine. Each step comprises one request with inputs, one response with outputs, arbitrary actions to do on the response, and conditional links to other stages. Thus, a graph-like structure is created. This architecture works not only for authentication purposes but can be used for any HTTP process that needs to keep track of states. A few years ago, the author had the task of helping developers to build OAuth directly from RFCs, supporting them with security topics and questions. In the beginning, the project ran into some challenges. Early on, we faced the fact that authentication is a stateful process, while HTTP is a stateless protocol. BurpSuite and ZAProxy were incepted when the web did not have states, so they inherited a stateless architecture. REST APIs became popular some years after those tools were created. They have workarounds like Burpsuite macros and ZAP Zest scripts to pass information between requests, but we found that functionality lacking and too complex to implement. So the author wrote custom python scripts to pentest this. It worked fine, but doing this makes the scripts usable only on this system. Therefore, the author decided to create a tool that fills that gap. Raider's configuration is inspired by Emacs. Hylang is used, which is LISP on top of Python. LISP is used because of its "Code is Data, Data is Code" property. It would also allow generating configuration automatically easily in the future. Flexibility is in its DNA, meaning it can be infinitely extended with actual code. Since all configuration is stored in cleartext, reproducing, sharing or modifying attacks becomes easy. Links to the project: - Website: https://raiderauth.com/ - Source: https://github.com/OWASP/raider - Documentation: https://docs.raiderauth.com/en/latest/ - Twitter: @raiderauth - Mastodon: @raiderauth@infosec.exchange about this event: https://cfp.eh20.easterhegg.eu/eh20/talk/R38RUP/
    Chaos Computer Club - recent events feed (low quality)
    April 10, 2023
    2023
    11
    eh20
    Logo

    © 2024 Podcastworld. All rights reserved

    TwitterYouTubeInstagramPinterestFacebookLinkedIn

    Pages

    PodcastsEpisodesTopics

    Support

    Refund PolicyTerms of ServiceContact usPrivacy Policy

    Stay up to date

    For any inquiries, please email us at hello@podcastworld.io