I am an experienced security researcher, with years of experience in web application attacks, penetration testing various kind of systems and vulnerability research. I currently serve as a Senior Security Researcher working in the Akamai Threat Research Group supporting Akamai's cloud security solutions.
The Service Workers API is a modern web API that grants web developers advanced capabilities, such as acting as a proxy server, intercepting network requests and improving offline experience as a background service. In Akamai, we have unique visibility into the world wide web traffic. We have witnessed a dramatic increase in usage of legitimate service workers in our customers web applications in the past year. We believe this trend also applies to malicious service workers as well. In this talk we will cover new and emerging web based attacks that (ab)use the Service Worker web API. We will cover and demonstrate the attack flow where a potential attacker can amplify and persist his foothold on the client and exfiltrate sensitive information by abusing the service worker API. Along showcasing those kind of attacks, we will also discuss and explain how to find those attacks and methods to mitigate and prevent them.
JSShell is an interactive multi-user web based javascript shell that enables the user to debug esoteric browsers and manage XSS (cross site scripting) campaigns. It was originally created during research to have the ability to debug remote esoteric browsers that did not have a simple debugging console. This tool can be also used to easily attach to a XSS (Cross Site Scripting) payload to achieve browser remote code execution (similar to the BeeF framework) and manage the vulnerability.
MQTT is a machine-to-machine connectivity protocol designed as an extremely lightweight publish/subscribe messaging transport and widely used by millions of IoT devices worldwide. MQTT-PWN intends to be a one-stop-shop for IoT Broker penetration-testing and security assessment operations, as it combines enumeration, supportive functions and exploitation modules while packing it all within command-line-interface with an easy-to-use and extensible shell-like environment.