🔴 Ya están en el LADO B @stokfredrik y @joohoi 😎 Cerrarán hoy el maintrack con su charla: "Flipping Bits: Your Credentials Are Certainly Mine". Sumate al stream junto a @fede_k y @Gala_chip >> twitch.tv/ekoparty

Charlas MainTrack #EKO2024 🔥 📌 @stokfredrik, Hacker - Creative 📌 @joohoi, Head of Security Testing 💡 “Flipping Bits: Your Credentials Are Certainly Mine”: Did you know that if you change a single bit from 1 to 0 (or vice versa) in the first 'g' of the domain name google.com (which is 01100111 in binary) you will end up with variety of valid "bitflip" domains like coogle.com, oogle.com, & woogle.com? So what happens if you generate and register a bunch of cheap bitflipped versions of popular cloud / Saas provider domains, point them to your VPS, log all incoming requests & then forget about the whole thing for two years? Well you will in fact receive a stiff bill, generate huge log files and eventually run out of disk space. But on the upside, you will also have collected a treasure trove of legit credentials & interesting stuff like valid OAuth refresh tokens, JWT tokens, bearers, cookies, emails, meeting invites with passwords & truckloads of internet scanner noise. In this session we will revisit bit-flip research from the last decade and weaponize it. Showcase 'Certainly' a pioneering offensive / defensive tool that employs Wildcard DNS matching & on-the-fly generated SSL certificates and injects custom payloads for incoming requests across various protocols. All with the intention to downgrade security, harvest credentials, capture emails and replacing dependencies. 📍 13, 14 y 15 de noviembre en el CEC - Buenos Aires 🎟️ ¡Registrate gratis hasta el 31/10! >> entradas.ekoparty.org 🚀 Podés ver la agenda completa en ekoparty.org/agenda

Ahora si, ¡conocé las charlas del MainTrack #EKO2024! 🥳🔥 🎟️ ¿Todavía no tenés tu entrada? ¡Reservá tu lugar! >> entradas.ekoparty.org/