File Transfer: Embrace the "Die & Retry"
summary
A team validates a file-upload API with six concrete tests: renaming an EXE to .pdf, embedding a 7z-containing malicious binary, inserting Adobe JavaScript, adding attachments, including XML forms that fetch external entities, and appending data after the PDF trailer. They use a PDF parsing library and VirusTotal, implement checks to reject JavaScript, attachments and forms, whitelist link domains, and reserialise PDFs to strip trailing payloads; generated code from Claude Code required explicit security prompts to include these protections.
AI-written summary · about
chapters (10)
- 0:00File transfer problem
- 1:24Myth of secure PDF
- 3:30Test 1: Renamed binary file
- 4:33Test 2: PDF JavaScript
- 6:20Test 3: Malicious attached file
- 8:44Test 4: Malicious external XML
- 12:36Test 5: Binary link
- 15:23Test 6: Binary concatenation
- 18:53Solutions and conclusion
- 19:56AI-generated code
related talks
20mDetecting Malicious Files with YARA Rules as They Traverse the Network
41mDirty Tricks: Using nginx and Lua to thwart bots and skript kiddies
41mAPTs Way: Evading Your EBNIDS
36mThe Cost of Complexity: Different Vulnerabilities While Implementing the Same RFC
45mAutomatic Discovery of Evasion Vulnerabilities Using Targeted Protocol Fuzzing
06mClosing Remarks
46mCurio Collection of Web Protocols
32mHow Things Are Going For APT41 In 2024