Fernando Arnaboldi - Abusing XSLT for Practical Attacks - 101 Track

Materials Available here:https://media.defcon.org/DEF%20CON%2023/DEF%20CON%2023%20presentations/DEFCON-23-Fernando-Arnaboldi-Abusing-XSLT-for-Practical-Attacks-UPDATED.pdf Whitepaper Here: https://media.defcon.org/DEF%20CON%2023/DEF%20CON%2023%20presentations/DEFCON-23-Fernando-Arnaboldi-Abusing-XSLT-for-Practical-Attacks-WP-UPDATED.pdf Abusing XSLT for Practical Attacks Fernando Arnaboldi Senior Security Consultant at IOActive White paper available here: https://media.defcon.org/DEF CON 23/DEF CON 23 presentations/Fernando Arnaboldi - UPDATED/DEFCON-23-Fernando-Arnaboldi-Abusing-XSLT-for-Practical-Attacks-WP-UPDATED.pdf Over the years, XML has been a rich target for attackers due to flaws in its design as well as implementations. It is a tempting target because it is used by other programming languages to interconnect applications and is supported by web browsers. In this talk, I will demonstrate how to use XSLT to produce documents that are vulnerable to new exploits. XSLT can be leveraged to affect the integrity of arithmetic operations, lead to code logic failure, or cause random values to use the same initialization vector. Error disclosure has always provided valuable information, but thanks to XSLT, it is possible to partially read system files that could disclose service or system's passwords. Finally, XSLT can be used to compromise end-user confidentiality by abusing the same-origin policy concept present in web browsers. This presentation includes proof-of-concept attacks demonstrating XSLT’s potential to affect production systems, along with recommendations for safe development. Fernando Arnaboldi is a senior security researcher and consultant at IOActive, Inc. He has over 10 years of experience in the security research space (Deloitte, Core Security Technologies and IOActive) and holds a Bachelor's degree in Computer Science.

There are no comments yet.

Please log in to write the first comment.