Dependency Confusion

Transcript

1. Exploiting Dependency Confusion By Tuhin Bose
2. root@kali:~#whoami Bug Bounty Hunter CISO at DSPH Crowdsource Security Researcher at Detectify B. Tech in Cyber Security and Digital Forensics
3. Conclusion & QNA Packages & Dependencies Public registry vs private registry Attacking Live Targets AGENDA Dependency Confusion Attack
4. Packages and Dependencies
5. The term "package" is used to describe code that's been made publicly available. A package can contain a single file or many files of code. Generally, a package helps you to add some functionality to your application. A dependency in programming is an essential functionality, library or piece of code that's essential for a different part of the code to work.
8. Public registry vs private registry
9. pypi.org npmjs.com requirements.txt package.json
11. Dependency Confusion
12. What happens if malicious code is uploaded to npm under these names?
13. Attacking Live Targets
14. Step1: List all packages package.json js files For JS files, always look for the keyword require and import
16. Step2: Filter all private packages
17. Step3: Publishing Your Package
18. @tuhin1729 tuhinbose70@gmail.com