1
00:00:00,000 --> 00:00:02,100
- [Announcer] The talk
going on next is by Ionut.

2
00:00:02,100 --> 00:00:05,469
So let's give him a big Defcon 30 welcome.

3
00:00:05,469 --> 00:00:06,499
Come on!

4
00:00:06,499 --> 00:00:09,499
(Round of applause)

5
00:00:15,510 --> 00:00:16,343
- [Ionut Cernica] Hello everyone.

6
00:00:16,343 --> 00:00:17,610
My name is Ionut Cernica,

7
00:00:17,610 --> 00:00:19,497
and I will be presenting
the organization of

8
00:00:19,497 --> 00:00:21,933
TOR HTTP hidden services.

9
00:00:23,070 --> 00:00:26,640
So I will have an introduction
about TOR then I will speak

10
00:00:26,640 --> 00:00:29,190
about non, the organization techniques,

11
00:00:29,190 --> 00:00:33,810
then how downgrading the HTTP
protocol can leak the IP.

12
00:00:33,810 --> 00:00:35,880
Other techniques developed
by me then how to

13
00:00:35,880 --> 00:00:39,390
fix these issues because
it's a configuration issues.

14
00:00:39,390 --> 00:00:41,343
Then demo time and closing remarks.

15
00:00:42,450 --> 00:00:43,380
Who am I?

16
00:00:43,380 --> 00:00:45,360
I'm an application security engineer

17
00:00:45,360 --> 00:00:47,100
and I'm working for UAP.

18
00:00:47,100 --> 00:00:49,293
This is my own research,
personal research.

19
00:00:50,220 --> 00:00:53,430
CTF player, PhD student,
security researcher,

20
00:00:53,430 --> 00:00:56,163
former bug bounty hunter
and former entrepreneur.

21
00:00:57,510 --> 00:00:59,760
The Onion Router known as TOR

22
00:00:59,760 --> 00:01:02,820
helps you to anonymize on the internet

23
00:01:02,820 --> 00:01:05,021
and helps you to reach the dark net.

24
00:01:05,021 --> 00:01:08,250
Where you can find the hidden services

25
00:01:08,250 --> 00:01:12,393
and that the URL that
ends in onion dot onion.

26
00:01:13,517 --> 00:01:16,920
The hidden service allow users
to publish their services

27
00:01:16,920 --> 00:01:21,360
and it hides their
identity, on the internet

28
00:01:21,360 --> 00:01:23,340
on the TOR network and the internet.

29
00:01:23,340 --> 00:01:26,717
Configuration a basic
configuration is when you

30
00:01:26,717 --> 00:01:28,770
declare a service directory

31
00:01:28,770 --> 00:01:31,650
where the TOR configuration files will go,

32
00:01:31,650 --> 00:01:34,740
then the service port
for, for the network.

33
00:01:34,740 --> 00:01:37,290
Then when we start the server service

34
00:01:37,290 --> 00:01:41,820
you'll have a URL like,
a long URL dot onion

35
00:01:41,820 --> 00:01:43,233
for your hidden service.

36
00:01:44,640 --> 00:01:47,520
Known Deanonymization
Techniques are server status.

37
00:01:47,520 --> 00:01:52,020
Key certificate, another
Deanonymization technique is search

38
00:01:52,020 --> 00:01:55,470
for the Onion address or the Gzip deflate.

39
00:01:55,470 --> 00:01:59,400
This is not the Deanonymization
it helps you to make a,

40
00:01:59,400 --> 00:02:00,600
I don't know

41
00:02:00,600 --> 00:02:03,870
to make an idea where the
server is located in what,

42
00:02:03,870 --> 00:02:05,310
which country.

43
00:02:05,310 --> 00:02:09,870
favicon hash and if you are skilled enough

44
00:02:09,870 --> 00:02:11,493
maybe you can hack the server.

45
00:02:12,994 --> 00:02:16,155
So the server status
technique implies to it's,

46
00:02:16,155 --> 00:02:21,060
it's only on a apache way,
apache two web servers.

47
00:02:21,060 --> 00:02:25,230
And when you go to server
status, maybe they didn't disable

48
00:02:25,230 --> 00:02:27,600
because it's enabled by
default on web servers

49
00:02:27,600 --> 00:02:28,658
like on the apache web servers,

50
00:02:28,658 --> 00:02:32,310
and maybe on the virtual host

51
00:02:32,310 --> 00:02:34,710
you'll find a public IP or public domain

52
00:02:34,710 --> 00:02:36,900
which you can visit and see

53
00:02:36,900 --> 00:02:41,010
on the server status of
the TOR, hidden service.

54
00:02:41,010 --> 00:02:45,050
The key certificate implies
that you can take, parameters

55
00:02:46,020 --> 00:02:47,220
like serial numbers and so on,

56
00:02:47,220 --> 00:02:49,860
and you can look for them on Shodan

57
00:02:49,860 --> 00:02:52,560
which indexes information
from the internet

58
00:02:52,560 --> 00:02:56,160
including the TLS information
like serial number.

59
00:02:56,160 --> 00:02:59,373
And maybe you can catch the,

60
00:03:00,210 --> 00:03:05,210
maybe the hidden services
use the same TLS certificate

61
00:03:05,850 --> 00:03:08,883
on the internet, and you can make a match.

62
00:03:09,780 --> 00:03:10,803
You can also meet, okay,

63
00:03:10,803 --> 00:03:13,020
It's not a big chance of success

64
00:03:13,020 --> 00:03:16,320
but you can search for the
onion address on the internet.

65
00:03:16,320 --> 00:03:19,560
And you can search on search
engines like Google, Bing

66
00:03:19,560 --> 00:03:22,773
DuckDuckGo, or Shodan, deserve a try.

67
00:03:23,940 --> 00:03:26,190
The Gzip compression,

68
00:03:26,190 --> 00:03:31,190
it's about to gives you an idea
where the server is located

69
00:03:32,550 --> 00:03:35,280
and Jose Carlos found it.

70
00:03:35,280 --> 00:03:39,240
And he said that around
10% of the web servers

71
00:03:39,240 --> 00:03:42,603
leak the remote data when
compressing HTTP responses.

72
00:03:43,740 --> 00:03:48,740
The favicon is that tiny
icon from the URL bar

73
00:03:49,530 --> 00:03:52,380
and it is possible to make a hash

74
00:03:52,380 --> 00:03:57,090
of it and then try to search it on Shodan.

75
00:03:57,090 --> 00:04:00,104
Maybe some other website is using

76
00:04:00,104 --> 00:04:03,360
and an example for this is
the Quantum ransomware group

77
00:04:03,360 --> 00:04:06,600
which were Deanonymized on TOR

78
00:04:06,600 --> 00:04:09,720
because they use the
favicon on the internet.

79
00:04:09,720 --> 00:04:12,813
And Talos found it
equivalent on the internet.

80
00:04:14,040 --> 00:04:16,470
Or hack the server with a
remote command execution

81
00:04:16,470 --> 00:04:19,080
local file, or make a
research on the server,

82
00:04:19,080 --> 00:04:22,083
maybe you'll find something that leaks IP.

83
00:04:23,520 --> 00:04:25,020
So downgrading the protocol.

84
00:04:25,020 --> 00:04:26,403
How did I find this?

85
00:04:27,480 --> 00:04:30,180
Some strange requests
were in my access logs.

86
00:04:30,180 --> 00:04:33,015
Something like get slash not found along

87
00:04:33,015 --> 00:04:35,940
not found, not found, not
found exactly like this.

88
00:04:35,940 --> 00:04:38,610
And it ends with HTTP/1.0

89
00:04:38,610 --> 00:04:43,547
the protocol with a 400
bad request, and masscan

90
00:04:44,976 --> 00:04:47,490
and the user agent were, was masscan

91
00:04:47,490 --> 00:04:50,820
and for more information, it
gave me a website where to go

92
00:04:50,820 --> 00:04:53,190
and read more information about this scan.

93
00:04:53,190 --> 00:04:55,320
So when I entered in on that website

94
00:04:55,320 --> 00:04:57,630
it was about university from Germany

95
00:04:57,630 --> 00:05:00,690
which they said they scan all the internet

96
00:05:00,690 --> 00:05:03,660
and they tried to find something.

97
00:05:03,660 --> 00:05:07,140
They didn't reveal what
they are were looking for

98
00:05:07,140 --> 00:05:12,140
but this behavior keep
coming for days on my server.

99
00:05:12,750 --> 00:05:16,170
Also, I was seeing this
behavior on my honey pots

100
00:05:16,170 --> 00:05:18,630
and I was thinking to
dump the whole request to

101
00:05:18,630 --> 00:05:21,180
see what's going on there
because it's strange to

102
00:05:21,180 --> 00:05:25,050
see such request and what
they are looking for.

103
00:05:25,050 --> 00:05:29,100
So when I dumped their
request, the whole request

104
00:05:29,100 --> 00:05:30,930
I was thinking they have been exploiting

105
00:05:30,930 --> 00:05:34,080
in the header and the access
log doesn't have the parameters

106
00:05:34,080 --> 00:05:36,243
in headers in the log file.

107
00:05:37,530 --> 00:05:42,180
I replicated and I saw
that one of my virtual host

108
00:05:42,180 --> 00:05:45,540
was publicly revealed
in the response server

109
00:05:45,540 --> 00:05:49,920
and this was, I realized that
this have a big potential

110
00:05:49,920 --> 00:05:52,200
on TOR or even in the internet,

111
00:05:52,200 --> 00:05:54,692
because you can find unknown

112
00:05:54,692 --> 00:05:59,692
or unplugged, unpublished, domains

113
00:05:59,700 --> 00:06:01,413
virtual domains from one IP.

114
00:06:02,580 --> 00:06:06,960
So why this behavior?

115
00:06:06,960 --> 00:06:09,060
So is not a security problem apache

116
00:06:09,060 --> 00:06:12,250
but based servers like apache two

117
00:06:12,250 --> 00:06:16,680
Nginx or tomcat, it's
all about configuration.

118
00:06:16,680 --> 00:06:17,940
The server must choose one

119
00:06:17,940 --> 00:06:20,790
of the domains to forward the request.

120
00:06:20,790 --> 00:06:24,240
So if you downgrade the protocol to 1.0

121
00:06:24,240 --> 00:06:25,680
you don't need the host header anymore

122
00:06:25,680 --> 00:06:28,320
and you can erase it from your request.

123
00:06:28,320 --> 00:06:31,200
So the server will choose
the first virtual domain

124
00:06:31,200 --> 00:06:33,330
from the configuration file.

125
00:06:33,330 --> 00:06:36,090
And in the response, you'll find the IP

126
00:06:36,090 --> 00:06:39,093
or maybe something that doesn't
help you maybe local host.

127
00:06:40,380 --> 00:06:42,660
So do leak is in the triggered exceptions

128
00:06:42,660 --> 00:06:47,640
like 400 bad request, 403 forbidden

129
00:06:47,640 --> 00:06:51,960
or even in 404, not found sometimes.

130
00:06:51,960 --> 00:06:55,710
But the best way to leak the
IP is in server redirect,

131
00:06:55,710 --> 00:06:56,940
you have to trigger redirect

132
00:06:56,940 --> 00:06:59,040
on the server on something else.

133
00:06:59,040 --> 00:07:03,090
And this is working on
Nginx, apache two and tomcat,

134
00:07:03,090 --> 00:07:06,243
and it's very easy to trigger
or redirect on every server.

135
00:07:08,700 --> 00:07:11,700
Now, I just want to show
you how the response

136
00:07:11,700 --> 00:07:16,260
is when we try to go to slash dot HTML.

137
00:07:16,260 --> 00:07:18,030
So it's a 403, forbidden.

138
00:07:18,030 --> 00:07:23,030
We have that server at my onion domain.

139
00:07:23,250 --> 00:07:26,160
It's a big one and dot onion in the end.

140
00:07:26,160 --> 00:07:28,050
And if I remove the host header

141
00:07:28,050 --> 00:07:31,470
and I downgrade the protocol,
now I have my IP leaked.

142
00:07:31,470 --> 00:07:34,710
So I just click my IP.

143
00:07:34,710 --> 00:07:39,000
With 400 bad request, long
header, via long header,

144
00:07:39,000 --> 00:07:40,470
if you put a long header enough

145
00:07:40,470 --> 00:07:42,720
you trigger the bad request.

146
00:07:42,720 --> 00:07:44,820
And as well, we have the IP address

147
00:07:44,820 --> 00:07:48,813
in the response server
at my real IP address.

148
00:07:49,650 --> 00:07:51,870
Again, the result with long URL

149
00:07:51,870 --> 00:07:55,320
like the university from
Germany, I said earlier

150
00:07:55,320 --> 00:07:59,190
they did with the long URL,
it's triggering a bad request.

151
00:07:59,190 --> 00:08:00,450
Maybe that's why, I don't know,

152
00:08:00,450 --> 00:08:02,130
maybe that's why they are,

153
00:08:02,130 --> 00:08:04,500
they, they were doing this

154
00:08:04,500 --> 00:08:06,900
or a file upload that
exceeds the server limits.

155
00:08:06,900 --> 00:08:09,450
There are other ways to do
that to trigger a bad request.

156
00:08:09,450 --> 00:08:11,433
You just have to find other ways.

157
00:08:12,360 --> 00:08:15,900
The 403 forbidden is triggered
when you visit something

158
00:08:15,900 --> 00:08:17,160
with slash dot ht.

159
00:08:17,160 --> 00:08:19,560
That's because the
default configuration file

160
00:08:19,560 --> 00:08:24,560
of apache tries to protect
files like htacces or htpasswd,

161
00:08:25,020 --> 00:08:29,370
so you can easily trigger
these 403 forbidden

162
00:08:29,370 --> 00:08:32,400
and you downgrade the protocol,
remove the host header.

163
00:08:32,400 --> 00:08:36,210
Then you have the server
at with something in there

164
00:08:36,210 --> 00:08:37,620
maybe on local host

165
00:08:37,620 --> 00:08:42,620
or something that doesn't
help you or the public IP.

166
00:08:45,291 --> 00:08:46,950
Maybe the server directs the best way to

167
00:08:46,950 --> 00:08:50,520
trigger the server directs
is the best way to find

168
00:08:50,520 --> 00:08:52,830
out the primary virtual host.

169
00:08:52,830 --> 00:08:57,830
And an example is like, if you
have a directory that exists

170
00:08:58,590 --> 00:09:00,540
on the route of the server

171
00:09:00,540 --> 00:09:04,050
you can try to visit it
without the last slash.

172
00:09:04,050 --> 00:09:06,005
And the server will auto redirect

173
00:09:06,005 --> 00:09:09,480
to the same directory, but
with a slash after the final.

174
00:09:09,480 --> 00:09:12,780
So in most cases you can find a directory

175
00:09:12,780 --> 00:09:16,200
on the first HTML page of the web server.

176
00:09:16,200 --> 00:09:17,700
Maybe you are dealing

177
00:09:17,700 --> 00:09:21,240
with an API server and
you don't have directories

178
00:09:21,240 --> 00:09:25,290
but you can use the predefine
directories from apache server

179
00:09:25,290 --> 00:09:30,290
like CSS icons js, and these
directories are available only

180
00:09:30,570 --> 00:09:33,180
if you visit from the local host IP

181
00:09:33,180 --> 00:09:35,970
and in TOR most of the
hidden services are visited

182
00:09:35,970 --> 00:09:37,233
with the local host.

183
00:09:38,220 --> 00:09:39,480
To trigger the redirect.

184
00:09:39,480 --> 00:09:40,920
Look at the, as I said

185
00:09:40,920 --> 00:09:45,270
you look on the source code of the HTML.

186
00:09:45,270 --> 00:09:48,990
You find the directory
like CSS in this case

187
00:09:48,990 --> 00:09:52,530
and then you try to trigger the redirect

188
00:09:52,530 --> 00:09:57,000
like get slash CSS without the last slash.

189
00:09:57,000 --> 00:09:59,700
The server tries to correct this,

190
00:09:59,700 --> 00:10:03,893
and tries to put a slash
at the end, but redirects

191
00:10:03,893 --> 00:10:07,950
to your virtual hosts,
the primary virtual host

192
00:10:07,950 --> 00:10:10,923
because I already downgraded the protocol.

193
00:10:11,940 --> 00:10:13,980
So applying this on internet

194
00:10:13,980 --> 00:10:16,200
maybe you can find important information.

195
00:10:16,200 --> 00:10:17,700
If you are assist admin

196
00:10:17,700 --> 00:10:22,410
you have to be careful how you
configure your virtual hosts.

197
00:10:22,410 --> 00:10:25,050
I didn't make a research on
this because I don't know,

198
00:10:25,050 --> 00:10:27,300
I I'm at the limit of legality.

199
00:10:27,300 --> 00:10:29,940
It appears that others did
this before, but I don't know

200
00:10:29,940 --> 00:10:31,440
if they follow this problem,

201
00:10:31,440 --> 00:10:34,470
with the downgraded of protocol.

202
00:10:34,470 --> 00:10:36,600
So I expect to exfiltrate domains

203
00:10:36,600 --> 00:10:39,090
that normally you cannot get from an IP.

204
00:10:39,090 --> 00:10:42,123
It's kind of DNS reserve, reverse.

205
00:10:44,610 --> 00:10:47,650
Another technique which would be the Etag

206
00:10:48,510 --> 00:10:49,680
from the response header.

207
00:10:49,680 --> 00:10:51,000
You can take its value,

208
00:10:51,000 --> 00:10:53,640
and if the first page is a static page.

209
00:10:53,640 --> 00:10:58,233
Maybe you can look for it
on the Shodan search engine.

210
00:11:01,578 --> 00:11:03,671
Another, an example of ITAG, you can see

211
00:11:03,671 --> 00:11:06,100
I make a request on the
first page on the slash

212
00:11:07,203 --> 00:11:12,203
and the server respond with
Etag and it's a unique value.

213
00:11:13,020 --> 00:11:17,940
You should not find this on
other servers only if the same

214
00:11:17,940 --> 00:11:22,940
it's a, I don't know, it's
a VMware image or something.

215
00:11:23,550 --> 00:11:26,130
Other techniques, same
network techniques implies

216
00:11:26,130 --> 00:11:28,050
that you have an Onion.

217
00:11:28,050 --> 00:11:29,350
You try to deanonymize it.

218
00:11:32,460 --> 00:11:34,230
You didn't find anything

219
00:11:34,230 --> 00:11:37,800
but you have a list of all
the onions, all the onions,

220
00:11:37,800 --> 00:11:40,230
a lot of onions from the tour network.

221
00:11:40,230 --> 00:11:42,540
And you try to replace the host

222
00:11:42,540 --> 00:11:47,233
Header with each one at a time with the,

223
00:11:47,233 --> 00:11:49,740
which with every onion
address from your list.

224
00:11:49,740 --> 00:11:53,040
And maybe one of them will response

225
00:11:53,040 --> 00:11:58,040
as you would request at that onion.

226
00:11:59,896 --> 00:12:00,757
So this implies,

227
00:12:02,190 --> 00:12:07,190
this can help you to
increase the attack surface.

228
00:12:07,530 --> 00:12:10,290
You don't need to attack the first onion.

229
00:12:10,290 --> 00:12:14,883
Maybe you can try to
deanonyamize the second one.

230
00:12:17,727 --> 00:12:21,060
So right now put on the
demo, at the end of the demo

231
00:12:21,060 --> 00:12:25,503
I have something very,
very, an impressive finding.

232
00:12:26,970 --> 00:12:31,260
So right now I'm trying
to access an HT anything.

233
00:12:31,260 --> 00:12:35,250
to see if that I can
trigger the 403 forbidden,

234
00:12:35,250 --> 00:12:36,910
but I have the HTTP 1.1

235
00:12:36,910 --> 00:12:40,650
which the host header of
my onion address on TOR.

236
00:12:40,650 --> 00:12:43,670
Now, if I remove the
host header, ah okay, now

237
00:12:43,670 --> 00:12:47,430
I, I'm showing you that I don't
want to make a lot of noise.

238
00:12:47,430 --> 00:12:52,430
So I put a h dot html, not really big URL

239
00:12:53,790 --> 00:12:56,690
like not found, not found, not
found, like how others did.

240
00:12:58,776 --> 00:13:01,575
And if I remove the host header
I downgrade the protocol,

241
00:13:01,575 --> 00:13:04,590
you can find a hidden
domain on my web server.

242
00:13:04,590 --> 00:13:07,260
And maybe that domain
it's publicly available,

243
00:13:07,260 --> 00:13:09,240
you can come from the internet

244
00:13:09,240 --> 00:13:13,350
on it and you can disclose its IP.

245
00:13:13,350 --> 00:13:16,620
Now I try, I'm trying
to trigger a bad request

246
00:13:16,620 --> 00:13:21,150
by putting the long header.

247
00:13:21,150 --> 00:13:26,150
So I put a long, long header
to trigger the 400 bad request,

248
00:13:28,170 --> 00:13:33,170
and the response will be the
same server at and the address.

249
00:13:36,660 --> 00:13:40,503
So the server at hidden domain dot ml.

250
00:13:41,970 --> 00:13:46,800
Another technique is, as I
said, is the redirect technique.

251
00:13:46,800 --> 00:13:50,913
So the CSS directory should be available

252
00:13:52,590 --> 00:13:55,020
by default on apache servers,

253
00:13:55,020 --> 00:13:58,533
but only if you visited
from the local host.

254
00:14:00,120 --> 00:14:01,980
And right now, if I visit

255
00:14:01,980 --> 00:14:06,090
with my HTP 1.1 protocol
with the host header

256
00:14:06,090 --> 00:14:08,460
it redirects me to the onion address.

257
00:14:08,460 --> 00:14:10,290
So nothing was leaked.

258
00:14:10,290 --> 00:14:13,470
If I remove the line and
I downgrade the protocol,

259
00:14:13,470 --> 00:14:17,163
now in the response again,
we have the domain leaked.

260
00:14:18,630 --> 00:14:20,613
So hidden domain dot ml.

261
00:14:22,470 --> 00:14:24,090
Right now, what I can do it

262
00:14:24,090 --> 00:14:28,320
I'm going to find out
more about this domain.

263
00:14:28,320 --> 00:14:32,550
Let's take it's IP
address, make who is on it

264
00:14:32,550 --> 00:14:35,553
and maybe it's public from the internet.

265
00:14:36,610 --> 00:14:38,070
That's what I, I'm trying to do right now.

266
00:14:38,070 --> 00:14:39,180
And after that

267
00:14:39,180 --> 00:14:44,180
I'm trying to see if
this public address it's

268
00:14:45,630 --> 00:14:49,830
really hosting the TOR hidden service.

269
00:14:49,830 --> 00:14:53,040
So I'm looking at the ETag.

270
00:14:53,040 --> 00:14:57,000
It responds from the, I
came from the internet

271
00:14:57,000 --> 00:14:58,890
and it has an ETag.

272
00:14:58,890 --> 00:15:01,413
If I go, I'm going back
to the TOR network,

273
00:15:02,730 --> 00:15:05,163
in the next few seconds,

274
00:15:06,330 --> 00:15:08,763
you'll see that it has the same ETag.

275
00:15:11,340 --> 00:15:14,260
And in the end, I will
show that the server status

276
00:15:15,112 --> 00:15:20,112
will show me that there is the same server

277
00:15:20,220 --> 00:15:23,883
for this onion and the
IP address I visited.

278
00:15:31,170 --> 00:15:32,643
Okay, I'll go to the,

279
00:15:43,634 --> 00:15:44,790
Last demo it's from here.

280
00:15:44,790 --> 00:15:49,790
So I'm right now I configure
the hidden domain dot ml.

281
00:15:49,950 --> 00:15:52,200
So this is another configuration.

282
00:15:52,200 --> 00:15:55,290
I configure the hidden
domain, in front of,

283
00:15:55,290 --> 00:15:58,650
so I have the in front of
hidden domain, the CloudFlare.

284
00:15:58,650 --> 00:16:01,710
So I'm trying to leak the IP address

285
00:16:01,710 --> 00:16:05,610
of a cloud domain,

286
00:16:05,610 --> 00:16:07,380
of a CloudFlare domain.

287
00:16:07,380 --> 00:16:12,380
So I just try to, even I
don't downgrade the protocol

288
00:16:12,960 --> 00:16:14,640
for the long header exception,

289
00:16:14,640 --> 00:16:18,780
just for the long header
exception it'll treat will it'll

290
00:16:18,780 --> 00:16:22,353
serve me the first virtual host
from the configuration file.

291
00:16:23,430 --> 00:16:25,920
So I can leak the IP address of the server

292
00:16:25,920 --> 00:16:28,110
which is protected by CloudFlare.

293
00:16:28,110 --> 00:16:29,040
This is not a problem

294
00:16:29,040 --> 00:16:32,880
in CloudFlare, it is just a
problem on the configuration.

295
00:16:32,880 --> 00:16:35,733
Either is not a problem
in apache two server.

296
00:16:35,733 --> 00:16:37,080
It's just a problem

297
00:16:37,080 --> 00:16:42,080
in the way we configure the
virtual host of our web servers.

298
00:16:44,040 --> 00:16:48,723
So right now I'm trying
to insert a long header,

299
00:16:50,160 --> 00:16:52,320
and we'll see what's happening.

300
00:16:52,320 --> 00:16:53,910
This is a default configuration.

301
00:16:53,910 --> 00:16:56,013
So I installed a apache, I put CloudFlare,

302
00:16:56,969 --> 00:16:57,802
then just,

303
00:16:59,250 --> 00:17:03,720
I put a virtual host and then I just send

304
00:17:03,720 --> 00:17:07,230
a long header and let's
see what's happening.

305
00:17:07,230 --> 00:17:10,350
Look, I just leak my IP address.

306
00:17:10,350 --> 00:17:14,910
So now maybe it's open
for direct requests.

307
00:17:14,910 --> 00:17:16,710
I don't need the CloudFlare anymore.

308
00:17:21,177 --> 00:17:22,010
No, no.

309
00:17:24,249 --> 00:17:27,249
(Round of applause)

310
00:17:28,410 --> 00:17:30,540
So in conclusion,

311
00:17:30,540 --> 00:17:35,540
triggering bad requests for
403 forbidden and so on,

312
00:17:36,330 --> 00:17:39,660
maybe can leak the IP address
of your apache server.

313
00:17:39,660 --> 00:17:41,220
You have to choose very carefully

314
00:17:41,220 --> 00:17:44,296
what virtual host you
configure, even on CloudFlare

315
00:17:44,296 --> 00:17:46,380
this doesn't help you.

316
00:17:46,380 --> 00:17:47,700
It's not a problem in CloudFlare,

317
00:17:47,700 --> 00:17:51,510
its a problem in how you
configure the virtual host.

318
00:17:51,510 --> 00:17:53,430
Try to not to use the certificates

319
00:17:53,430 --> 00:17:56,850
from other projects and
disable the service status.

320
00:17:56,850 --> 00:17:59,070
When you give access

321
00:17:59,070 --> 00:18:03,120
to other persons to access
your server from local host.

322
00:18:03,120 --> 00:18:05,943
And thank you,

323
00:18:07,080 --> 00:18:08,630
I'm waiting for your questions.

324
00:18:09,855 --> 00:18:12,168
(Round of applause)