Cybersecurity skills shortage soars nearing 3 million. Keep your skills current. Train with SANS.

Pen Test Berlin 2015

Berlin, Germany | Mon, Jun 22 - Sat, Jun 27, 2015
This event is over,
but there are more training opportunities.

Bypassing HTTP Strict Transport Security

  • Jose Selvi
  • Tuesday, June 23rd, 6:00pm - 7:00pm

For the last few years, some different attacks against SSL/TLS have been released. Some of them based on cryptography or protocol weaknesses such as BEAST, CRIME, etc, and some others, such as SSLStrip, based on rewriting https links into http ones and keep user communications always in HTTP. In order to protect users against SSLStrip attacks, a new protection called HTTP Strict Transport Security (HSTS) has been developed and it's currently supported by most widely used browsers. However, under certain circumstances, an attacker could exploit an inter-operation vulnerability in order to bypass HTTP Strict Transport Security protection and use other well-known attack techniques such as SSLStrip. In this presentation, we review the HSTS strengths and weaknesses, and we go in-depth on this inter-operation vulnerability and how it could be exploited.

Bonus Sessions

The following bonus sessions are open to all paid attendees at no additional cost. There are many different types of events that fall into these categories:

  • SANS@Night: Evening presentations given after day courses have ended. This category includes Keynotes.
Monday, June 22
Session Speaker Time Type
PowerShell for Pentesters James Shewmaker Monday, June 22nd, 7:30pm - 8:30pm SANS@Night
Tuesday, June 23
Session Speaker Time Type
Bypassing HTTP Strict Transport Security Jose Selvi Tuesday, June 23rd, 6:00pm - 7:00pm SANS@Night
Developer's disappointed expectations manifested in poor code Ralf Reinhardt Tuesday, June 23rd, 7:00pm - 8:00pm SANS@Night
Thursday, June 25
Session Speaker Time Type
Playing with SCADA's Modbus Protocol Justin Searle Thursday, June 25th, 6:00pm - 7:00pm SANS@Night
Hacking Survival: So, you want to compute post-apocalypse? Larry @haxorthematrix Pesce Thursday, June 25th, 7:00pm - 8:00pm SANS@Night
Friday, June 26
Session Speaker Time Type
A History of ATM Violence - From blowing up safes over jackpotting to all-round malware Erik Van Buggenhout Friday, June 26th, 6:00pm - 7:00pm SANS@Night