Presented at
DerbyCon 2.0 Reunion (2012),
Sept. 28, 2012, 9 p.m.
(50 minutes)
But, here’s your password. Reset it, maybe? Everyone thinks they know about the Man in the Middle. Most places think as long as they have SSL, they’re immune. Attackers know better. But, if the truth is told, even experienced pentesters can look at a MitM foothold and think “Well, now what?” We’ll demonstrate implications of Man in the Middle vulnerability that go beyond the 101. We’ll turn layer 2 weaknesses into corporate compromise by taking common network data, elevating access, gathering credentials, and compromising hosts– and we’ll do it all without raising serious alarms. We’ll show how to do this with custom scripts and filters using injection, iptables, proxying, and SSL middling using BeEF, Ettercap filters, Cain and Able, Metasploit, and more in practical exploitation. This is a demonstration in the true spirit of breaking in quietly and without gimmicks, but with little talked about tactics and more advanced techniques.
Presenters:
-
Mike Ryan
Mike Ryan (justfalter) is a Lead Security Researcher at Trustwave. He is a member of Trustwave’s SpiderLabs – the advanced security team focused on penetration testing, incident response, and application security. He has over thirteen (14) years of information technology administration and engineering experience, with the last eight (9) years specializing in Information Security research and development. At Trustwave, Mike is responsible for the design of Trustwave’s vulnerability scanning engine, implementing network-protocols, and researching new vulnerabilities.
-
Ryan Linn
Ryan Linn is a Senior Consultant with Trustwave’s SpiderLabs – the advanced security team focused on penetration testing, incident response, and application security. Ryan is a penetration tester, an author, a developer, and an educator. He comes from a systems administration and Web application development background, with many years of IT security experience. Ryan currently works as a full-time penetration tester and is a regular contributor to open source projects including Metasploit and BeEF, the Browser Exploitation Framework.
Similar Presentations: