55. OWASP Cologne @ REWE digital - Exposed by Design

Exposed by Design - Katherine Leese
Host header attacks, access control bypasses, SSRF. You've probably seen them in Burp, maybe exploited them in a lab. But what do they actually look like on the wire? Is anyone even looking?
This talk flips the perspective. Using a fictional scenario and a purpose-built Docker lab, we'll walk through five live attack chains, from SNI/Host mismatches to blind SSRF, and watch each one unfold in Wireshark packet captures. No decryption needed.
Modern web infrastructure routes on application-layer content (Host headers, X-Forwarded-For, URL paths), not IP addresses. TCP got you to the right box. Everything after that is just strings the next hop believes.
The rules are different in this upstream space. What's hidden behind TLS in Burp is plaintext between internal hops, and what looks like one request in the browser can split into traffic on interfaces nobody monitors.