BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//cfp.hackfest.ca//hf-2021-cfp//talk//83SD9W
BEGIN:VTIMEZONE
TZID:EST
BEGIN:STANDARD
DTSTART:20001029T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10;UNTIL=20061029T070000Z
TZNAME:EST
TZOFFSETFROM:-0400
TZOFFSETTO:-0500
END:STANDARD
BEGIN:STANDARD
DTSTART:20071104T030000
RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=11
TZNAME:EST
TZOFFSETFROM:-0400
TZOFFSETTO:-0500
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000402T030000
RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=4;UNTIL=20060402T080000Z
TZNAME:EDT
TZOFFSETFROM:-0500
TZOFFSETTO:-0400
END:DAYLIGHT
BEGIN:DAYLIGHT
DTSTART:20070311T030000
RRULE:FREQ=YEARLY;BYDAY=2SU;BYMONTH=3
TZNAME:EDT
TZOFFSETFROM:-0500
TZOFFSETTO:-0400
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-hf-2021-cfp-83SD9W@cfp.hackfest.ca
DTSTART;TZID=EST:20211120T150000
DTEND;TZID=EST:20211120T170000
DESCRIPTION:Load balancers and proxies\, such as HAProxy\, Varnish\, Squid 
 and Nginx\, play a crucial role in website performance\, and they all have
  different HTTP protocol parser implementation. HTTP Request Smuggling (HR
 S) is an attack abusing inconsistencies between the interpretation of requ
 ests’ ending by HTTP request parsers. What might be considered the end o
 f one request for your load balancer might not be considered as such by yo
 ur web server. \n\nWe will see how an attacker can abuse several vulnerabl
 e configurations. HTTP Request Smuggling (HRS) enables multiple attack vec
 tors\, including cache poisoning\, credential hijacking\, URL filtering by
 pass\, open-redirect and persistent XSS. For each of these vectors\, a pay
 load will be showcased and explained in-depth. Also\, a live demonstration
  will be made to see the vulnerability in action. Aside from exploitation\
 , we will show how developers and system administrators can detect such fa
 ulty configurations using automated tools. \n\nThroughout the session\, si
 mple exercises will be given to participants to reproduce the exploitation
  of these vulnerabilities. A case of HTTP1 header confusion as well as mor
 e recent variants with the HTTP2 protocol will be exploited. To participat
 e in the workshop section\, you will need to install Burp Suite\, Docker a
 nd Python. \n\nBy the end of this workshop\, security enthusiasts from any
  level will have solid foundations to detect request smuggling\, a vulnera
 bility that has greatly evolved in the past 15 years.
DTSTAMP:20261013T101546Z
LOCATION:Sponsors - Workshops
SUMMARY:Request Smuggling Workshop - Philippe Arteau
URL:https://cfp.hackfest.ca/hf-2021-cfp/talk/83SD9W/
END:VEVENT
END:VCALENDAR