I Know Your Filtering Policy Better than You Do
summary
A lightweight JavaScript agent called webfeet requests many file types and harvests modified responses and headers (Via, cache, X-) so external attackers learn vendor and versions and capture block pages that leak internal hostnames, IPs and usernames; many sites do not inspect HTTPS. Automated SMTP probes with mailfeet send varied attachments and measure outcomes: about 31% of tested Fortune 500 domains accept and respond to non‑existent recipients, executables in Word deliver ~60%, VBS ~75%. The method—block page harvesting*—finds which policies and deep‑content checks actually run.
AI-written summary · about
chapters (8)
- 0:00Introduction and context
- 3:01Philosophy of low-severity
- 7:36Web filtering enumeration
- 13:52Analyzing block pages
- 20:14Web filtering survey results
- 27:28Email filtering analysis
- 34:32Email security case studies
- 40:40Conclusion and Q&A
related talks
52mBreaking Fraud and Bot Detection Solutions
43mPassive Fingerprinting of HTTP/2 Clients.
20m"Return to Sender: Bypassing Email Spam & Malware Filters"
51mWanna Get Malware Out of Emails? CISA’s Latest Research
44mDigital Cat-and-Mouse: Strategies to Outsmart Scrapers, Phishers, and Thieves
52mFlying Under the Radar - New Security Evasion Techniques
49mSecurity and Insecurity of HTTP Headers
43mBypassing Malware Detection Mechanisms in Online Banking