hoodoer
Drew Kirkpatrick has 25 years of experience building complex systems across application security, ML, and aerospace. He is now a red teamer at Blackthorne Consulting, Previously: security researcher and principal consultant at TrustedSec, NopSec and SecDec, and senior computer scientist for the U.S. Navy. He holds an MS in Computer Science and an MS in Computer Information Systems from Florida Tech, plus OSCP, CRTO, GWAPT, and GMOB certs. Author of JS-Tap and OWASP Attack Surface Detector.
@hoodoer, https://www.linkedin.com/in/drew-kirkpatrick-1009a0/, https://github.com/hoodoer
Session
JS-Tap v3 moves beyond exploiting web applications to targeting the user’s endpoint itself. JavaScript is used heavily on desktops and in this hands-on workshop you'll deploy three new JS-Tap implant types against a Windows workstation on a simulated corporate network.
Start by installing a malicious browser extension that harvests sessions from every site the victim visits and injects payloads into specific application domains on command. We'll then add optional features that escape the browser sandbox for filesystem and shell access.
Next we'll patch a local Electron app for screenshots, keylogging, network interception, and message spoofing in a corporate chat platform. Then we'll instrument a Node.js CLI tool with a single environment variable to intercept its traffic and keystrokes.
Your operator system can't reach the internal corporate web applications directly. You'll use JS-Tap Conductor to pivot through an implant, demonstrating the full attack chain from session theft to authenticated access on an internal network.
All infrastructure is provided. Each participant gets a dedicated Windows victim machine and Linux operator box accessible via noVNC. Just bring a laptop with a browser and an ethernet adapter.
You'll leave with firsthand experience operating all three beacon types.