Leveraging Web Application Vulnerabilities for Resourceful Intelligence Gathering
Submitted by Karan Saini (@karansaini) on Saturday, 4 May 2019
Section: Full talk (40 mins) Technical level: Beginner Session type: Demo Session type: Lecture Technical level: Intermediate Status: Confirmed & Scheduled
This talk aims to introduce the audience how web application vulnerabilities can be leveraged for self-sufficient information and intelligence gathering.
The talk seeks to provide the audience with a starting point for where and how resourceful information and intelligence can be found and collected, particularly, through discovery and exploitation of security flaws in web applications. The talk will provide real life examples of security flaws through which sensitive information could have been disclosed, and how at times - owing largely to the interconnected nature of such information - it could be pieced together with other data to glean useful intelligence about a particular individual or group. Lastly, the talk will touch upon how developers can avoid baking these issues into their services and applications, while also discussing protective operational security measures that end-users can adopt as a best practice.
- Intelligence and Investigations
- Case Studies
- Web Application Vulnerabilities and Intelligence Gathering
Scoping and Execution:
- Targeting Techniques
- Types of Prevalent Flaws
- Attacking Techniques
- Slides with Examples
- Best Practices for Developers
- Operational Security for Users
A basic understanding of open source intelligence, web application vulnerabilities, and the use of digital information in aiding investgative processes.
Karan Saini is a security researcher and program officer at the Centre for Internet and Society. Karan has been a practitioner of responsible vulnerability disclosure for four years, and has an avid interest in uncovering different ways through which new technologies and protocols can impact user privacy.