|
|
Unlimited WiFi: Bypassing Captive Portals and Proxies with a Twist! |
Abstract
Have you ever been stuck in the airport and ran out of the one hour free WiFi? Have you ever been in a hotel that makes you pay for WiFi? Our talk, Unlimited WiFi, helps understand the common flaws within captive portals and proxies. On restricted networks, these methods can be used to exfiltrate information and download necessary exploits (please stop blocking exploit db and github… makes pen testing a pain!). The talk progressively assumes that each vulnerability being exploited is patched after it is presented, requiring creative ways to bypass the protections laid out. This talk brings in the concepts of misusing whitelisted software, writing scripts to bypass restrictions, writing your own authentication, and general software vulnerabilities. With each vulnerability we discuss, our talk attempts to identify possible solutions to mitigate the vulnerabilities. Our audience should gain a good understanding of the most common weaknesses within our target software and interesting ways to use the flaws they expose to our advantage! Speaker Bio: Maeesha Lohani is a security consultant working at CyberRisk. When not performing penetration tests and GRC tasks, Maeesha contributes to the Australian Women in Security (AWSN) Cadets initiative, as a member of the committee. Fulfilling her duties in this committee, Maeesha was awarded the runner-up for "Best Student Security Leader" award by CSO (2019). While being proficient in Python, JavaScript, C, and C++, Maeesha enjoys reading and learning about different algorithms and software architecture. Maeesha finds bending software to perform unintended functionality, an intellectually stimulating past-time and endeavours to hone her skills in this sector in the coming future. Sajeeb Lohani is the Head of (Director) Cybersecurity at Bugcrowd and a Sessional lecturer at the University of Melbourne. Sajeeb holds OSCP and OSWE. Constantly passionate about contributing to and improving open source security software, Sajeeb is a core contributor and co-developer of Interlace, a popular open-source project used for organising and automating penetration testing workflows. Sajeeb is also ranked within the top 40 of Bugcrowd and #2 in DVuln. Sajeeb gives back regularly to the Melbourne cyber security community and is the founder of the Monash Cyber Security Club. Additionally, Sajeeb regularly presents at local meetups, and conferences. In addition to this he mentors at the Australian Women in Security Network (AWSN) workshops. Sajeeb also runs initiatives which attempt to responsibly disclose security issues within open source software projects, with the vision of making the world of software ‘more secure’. Sajeeb is also an active Bug Bounty participant and is proud to be listed in the hall of fame for Amazon, Yahoo, Github, Atlassian, Netgear, Okta, Spotify, AT&T, US Defense, and many more. Recently Sajeeb was invited to an exclusive Bug Bash event for Okta, where he notably placed second among a field that included some of the most talented hackers in the world. Sajeeb has also presented in many renowned conferences including DevSecCon Seattle, Bsides Perth, RuxCon, OWASP NewZealand, and many more. |
