Daniel Abeles

I am an experienced security researcher, with years of experience in web application attacks, penetration testing various kind of systems and vulnerability research. I currently serve as a Senior Security Researcher working in the Akamai Threat Research Group supporting Akamai's cloud security solutions.


Experience

Senior Security Researcher

Akamai Technologies
July 2016 - Present

Security Researcher and Penetration Tester

Avnet Cyber & Information Security
Aug 2011 - Jul 2016

Forensics & Malware Analyst

IAF
Aug 2011 - Aug 2014

Education

Holon Institute of Technology

Bachelor of Science (B.Sc.)
Oct 2015 - Oct 2018

The Hebrew Reali School

Computer Software Engineering & Physics Major
Sep 2005 - Jun 2011

Publications, Conferences & Projects

Bsides Las Vegas 2019

The Service Workers API is a modern web API that grants web developers advanced capabilities, such as acting as a proxy server, intercepting network requests and improving offline experience as a background service. In Akamai, we have unique visibility into the world wide web traffic. We have witnessed a dramatic increase in usage of legitimate service workers in our customers web applications in the past year. We believe this trend also applies to malicious service workers as well. In this talk we will cover new and emerging web based attacks that (ab)use the Service Worker web API. We will cover and demonstrate the attack flow where a potential attacker can amplify and persist his foothold on the client and exfiltrate sensitive information by abusing the service worker API. Along showcasing those kind of attacks, we will also discuss and explain how to find those attacks and methods to mitigate and prevent them.

USA

Blackhat Arsenal 2019

JSShell is an interactive multi-user web based javascript shell that enables the user to debug esoteric browsers and manage XSS (cross site scripting) campaigns. It was originally created during research to have the ability to debug remote esoteric browsers that did not have a simple debugging console. This tool can be also used to easily attach to a XSS (Cross Site Scripting) payload to achieve browser remote code execution (similar to the BeeF framework) and manage the vulnerability.

Daily Swig Interview

USA

Blackhat Arsenal 2018

MQTT is a machine-to-machine connectivity protocol designed as an extremely lightweight publish/subscribe messaging transport and widely used by millions of IoT devices worldwide. MQTT-PWN intends to be a one-stop-shop for IoT Broker penetration-testing and security assessment operations, as it combines enumeration, supportive functions and exploitation modules while packing it all within command-line-interface with an easy-to-use and extensible shell-like environment.

USA, Europe & Asia

Awards

CTF's & Bug Bounty
  • Paypal Hall of Fame - Honorable Mention
  • Solved the Microsoft's BlueHatIL Camera Challenge (Rub33)
  • Solved HackerOne MemeCTF


Blog Posts


Courses & Certifications
  • Cellebrite Mobile Forensics Examiner (Jan 2014)
  • Learning Python for Data Analysis and Visualization
  • Go: The Complete Developer's Guide
  • Learn and Understand NodeJS