Exploiting Dependency Confusion By Tuhin Bose

root@kali:~#whoami Bug Bounty Hunter CISO at DSPH Crowdsource Security Researcher at Detectify B. Tech in Cyber Security and Digital Forensics

Conclusion & QNA Packages & Dependencies Public registry vs private registry Attacking Live Targets AGENDA Dependency Confusion Attack

Packages and Dependencies

The term "package" is used to describe code that's been made publicly available. A package can contain a single file or many files of code. Generally, a package helps you to add some functionality to your application. A dependency in programming is an essential functionality, library or piece of code that's essential for a different part of the code to work.

No content

No content

Public registry vs private registry

pypi.org npmjs.com requirements.txt package.json

No content

Dependency Confusion

What happens if malicious code is uploaded to npm under these names?

Attacking Live Targets

Step1: List all packages package.json js files For JS files, always look for the keyword require and import

No content

Step2: Filter all private packages

Step3: Publishing Your Package

@tuhin1729 [email protected]