Yongtao Wang(sanr) works in Qihoo 360, a senior security researcher in PegasusTeam team. He specializes in penetration testing and wireless security research.
He has extensive experience in security research and penetration testing. He is a lecturer at the China Internet Security Conference (ISC) security training camp, Blackhat、CodeBlue, etc. Conference speaker.
Sai Cheng(Exist) is a student at Chengdu University of Information Technology. He is a security researcher at Syclover Team and worked as an intern at Qihoo 360 PegasusTeam Team. He specializes in penetration testing, Web security, and Windows security research. He has reported security vulnerabilities to some famous vendors such as Microsoft and Oracle.
Jie Fu is Senior researcher of PegasusTeam at 360 Radio Security Research Department in 360 Technology , with rich experience in embedded software and hardware security development and reverse development; Research and development of the first active NFC protective equipment --360 saferfid , and obtained a number of NFC security invention patents; International renowned security conference Blackhat, HITB (HackInTheBox) speaker.
[Abstract]
==========
SSRF is not a new technology. Over the past decades, many security researchers have proposed various attacks. Our research found that there are high-risk security flaws in the JDK, and WINDOWS credentials can be obtained by exploiting this security flaw. In the case of application has SSRF vulnerabilities, the effect of RCE can be achieved, this vulnerability has already been admitted by the official website of Oracle as an important patch update. In this speech, I will introduce the vulnerability principle, the discovery process, the attack scenario, and the attack process in detail. After that, we will release the exploit tool for this vulnerability.