Can Request Encryption Fix Your Web Apps?

Title: Can Request Encryption Fix Your Web Apps?
Presenter: Farhan Thakur
Event: BreachForce CyberSecurity Cohort
Talk Date: 11-August-2024

Key Takeaways: An exploration of request encryption techniques and their potential to enhance the security of web applications.

Transcript

1. Can Request Encryption fix your Web Apps? By Farhan Thakur
2. About Me • ~ 3.5 years of cyber security experience and 1.5 years of non cyber security experience • Expertise in Offensive Web Application security. • Socials - ◦ Linkedin - https://www.linkedin.com/in/farhanthakur/ ◦ Github - https://github.com/kaminari14
3. Understanding the Demographic
4. Pre Requisites Burpsuite/Reverse Web Proxy Javascript Encryption Concepts
5. Symmetric Encryption
6. Asymmetric Encryption
7. Question? What severity is usually given for SSL pinning bypass?
8. Motivation for using Encryption in Web Applications
9. How many Vulnerabilities can you find?
10. How many Vulnerabilities can you find?
11. Developers Hackers/ Cyber Security VS
12. Does encryption actually fix web app vulnerabilities? • Client side protection • Extra Layer of security
14. Demonstration • Bypassing symmetric encryption with Key and IV in Requests • Bypassing symmetric encryption with key and IV in JS • Bypassing asymmetric encryption • Using Burpcrypto • Bypassing Hybrid encryption
15. Importance of testing Unencrypted Requests in a greybox/whitebox activity
16. Implementation Challenges for a developer
17. Thank You