When TLS Hacks You
Joshua Maddux weaponizes TLS protocol features—including session resumption and SNI parsing—to execute advanced Server-Side Request Forgery (SSRF) attacks.
Summary
Repurposing TLS Features as Attack Vectors
While TLS is designed to secure network communications, complex performance optimization features within the protocol can be weaponized by adversaries.
Weaponizing TLS for Server-Side Request Forgery (SSRF)
Joshua Maddux demonstrates how manipulating TLS session tickets, SNI extensions, and client certificates enables bypassing SSRF URL filters and firewall protections.
Cross-Protocol Exploitation and Protocol Smuggling
By encapsulating plaintext protocol payloads inside encrypted TLS session resumptions, an attacker can coerce internal servers to interact with internal Redis or Memcached instances.
Securing Application TLS Implementations
The author provides guidance for application security engineers to enforce strict TLS client configurations and validate outgoing connection destinations.
Related talks
Main Stage·28 min
Joshua Maddux
Joshua Maddux answers questions on weaponizing TLS protocol features for SSRF, session resumption exploitation, and mitigation.
Main Stage·40 min
Julian Horoszkiewicz
Demonstrates rapid vulnerability discovery methodologies that uncovered seven zero-day local privilege escalation flaws in pre-installed OEM bloatware.
Main Stage·37 min
James 'albinowax' Kettle
James Kettle unleashes novel HTTP request smuggling and desync attack classes against modern web infrastructure, arguing for the retirement of HTTP/1.1.