19
Fast Track Уязвимости в логике работы веб-приложений панелей управления хостинг-провайдеров

Dmitry Boomov - Hosting dashboard web application logic vulnerabilities

Embed Size (px)

DESCRIPTION

 

Citation preview

Page 1: Dmitry Boomov - Hosting dashboard web application logic vulnerabilities

Fast Track

Уязвимости в логике работы веб-приложений панелей управления

хостинг-провайдеров

Page 2: Dmitry Boomov - Hosting dashboard web application logic vulnerabilities

-18

Page 3: Dmitry Boomov - Hosting dashboard web application logic vulnerabilities
Page 4: Dmitry Boomov - Hosting dashboard web application logic vulnerabilities
Page 5: Dmitry Boomov - Hosting dashboard web application logic vulnerabilities
Page 6: Dmitry Boomov - Hosting dashboard web application logic vulnerabilities
Page 7: Dmitry Boomov - Hosting dashboard web application logic vulnerabilities

DNS-сервер

Page 8: Dmitry Boomov - Hosting dashboard web application logic vulnerabilities

Баг или фича?

Page 9: Dmitry Boomov - Hosting dashboard web application logic vulnerabilities

ТОП-15 хостинг-провайдеров российского рынка

Page 10: Dmitry Boomov - Hosting dashboard web application logic vulnerabilities

Здесь были красивые таблички

Но теперь их нет

Page 11: Dmitry Boomov - Hosting dashboard web application logic vulnerabilities

Никому ненужная статистика

Page 12: Dmitry Boomov - Hosting dashboard web application logic vulnerabilities

Вектор #1

Page 13: Dmitry Boomov - Hosting dashboard web application logic vulnerabilities

Вектор #2ТиЦ + PR

Содержимое .htaccess:

Page 14: Dmitry Boomov - Hosting dashboard web application logic vulnerabilities

Вектор #2ТиЦ + PR

Page 15: Dmitry Boomov - Hosting dashboard web application logic vulnerabilities

Вектор #3MITM

Page 16: Dmitry Boomov - Hosting dashboard web application logic vulnerabilities

Сервис 1stat.ru

Page 17: Dmitry Boomov - Hosting dashboard web application logic vulnerabilities

Обратный резолвинг

• Yougetsignal.com (Domain List или API)• Bing.com (ip: 127.0.0.1)• Прочие сервисы и утилиты

Page 18: Dmitry Boomov - Hosting dashboard web application logic vulnerabilities

Способ защиты

Page 19: Dmitry Boomov - Hosting dashboard web application logic vulnerabilities

Спасибо за внимание

@i_bo0om

Дмитрий Bo0oM Бумов