Top 10 winner

Abusing CDNs with SSRF Flash and DNS

Mike Brooks and Matthew Bryant · Bishop Fox · 14 September 2015

Combines DNS reconnaissance, Akamai EdgeSuite’s legacy ARLv1 fetching, and vulnerable FlowPlayer plugin loading. ARLv1 can place a whitelisted FlowPlayer SWF under a trusted CDN subdomain; attacker-loaded plugins then use Flash crossdomain.xml trust to make authenticated requests. Also demonstrates three FlowPlayer URL-check bypasses, including protocol-relative URLs, triple-slash parsing and an open redirect.

Record

Researcher

Mike Brooks and Matthew Bryant

Published by

Bishop Fox

Date

14 September 2015

Format

Recording

In the archive

• Ranked #5 in the 2015 Top 10 Web Hacking Techniques

Related sources

• Slides

Tags

• ssrf
• cdn
• flash
• dns
• sop-bypass
• filter-bypass
• attack-chain
• owasp-a01-2021
• owasp-a05-2021
• owasp-a10-2021

This page is the archive's own catalogue record. The research is the work of Mike Brooks and Matthew Bryant, first published at the original source. Preserved copies are kept so the citation survives its host.