Announcement

Collapse
No announcement yet.

Samuel Erb (erbbysam) & Justin Gardner (Rhynorater) - Crossing the KASM - a webapp pentest story

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • Samuel Erb (erbbysam) & Justin Gardner (Rhynorater) - Crossing the KASM - a webapp pentest story

    Samuel Erb (erbbysam) & Justin Gardner (Rhynorater) - Crossing the KASM - a webapp pentest story


    Samuel Erb (erbbysam), Hacker, He/Him
    Justin Gardner (Rhynorater), Full-time Bug Bounty Hunter, He/Him

    Presentation Title: Crossing the KASM -- a webapp pentest story
    Length of presentation:
    War Story, Exploit


    In this talk we will tell the story of an insane exploit we used to compromise the otherwise secure KASM Workspaces software. KASM Workspaces is enterprise software for streaming virtual workstations to end users built on top of Docker.

    This talk will span python binary RE, header smuggling, configuration injection, docker networking and questionable RFC interpretation. We hope to show you a little bit of what worked and a lot a bit of what didn't work on our quest to exploit this Heisenbug.


    SPEAKER BIOS:
    Samuel Erb is a 2x black badge winner with Co9 in the Badge Challenge and is working to make the Internet a safer place. He has also presented 3x previously at the Packet Hacking Village. Outside of hacking, you will likely find Sam in a climbing gym or on the side of a mountain.
    https://twitter.com/erbbysam

    Justin Gardner is a full-time bug bounty hunter who spent the last two years traveling around Japan with his wife Mariah, and is currently in the process of settling back down in Richmond, VA to adopt some kids and start a family. His expertise lies mostly in Web Hacking with a bug bounty focus, but he also has experience with Ethereum Smart Contract Auditing, Penetration Testing, and Mobile App Hacking. He hopes to pivot into binary exploitation over the next couple years as well.
    Outside of hacking, Justin enjoys talking about Jesus, Volleyball, Jiu Jitsu, League of Legends, and hanging out with friends.
    https://www.twitter.com/Rhynorater

    []
Working...
X