55. OWASP Cologne @ REWE digital - Exposed by Design

*****Please note: This is the same event as this one. Please register either here or there. Thank you! *****

OWASP COLOGNE is back at REWE digital 🐝

As always: Location, Food and Drink hosted by REWE digital.
Talks and Content by OWASP Cologne members. Hosts: Katherine & Lars.

Doors open: 6:30pm
Start: ~7:00pm

TALK OF THE DAY
Exposed by Design - Katherine Leese
Host header attacks, access control bypasses, SSRF. You've probably seen them in Burp, maybe exploited them in a lab. But what do they actually look like on the wire? Is anyone even looking?

This talk flips the perspective. Using a fictional scenario and a purpose-built Docker lab, we'll walk through five live attack chains, from SNI/Host mismatches to blind SSRF, and watch each one unfold in Wireshark packet captures. No decryption needed.
Modern web infrastructure routes on application-layer content (Host headers, X-Forwarded-For, URL paths), not IP addresses. TCP got you to the right box. Everything after that is just strings the next hop believes.

The rules are different in this upstream space. What's hidden behind TLS in Burp is plaintext between internal hops, and what looks like one request in the browser can split into traffic on interfaces nobody monitors.

----------

Adress:
REWE digital, Schanzenstraße 6-20, 51063 Köln, Gebäude 2.20, 1st floor

How to get here:
We recommend using public transportation to get here. For example, take KVB Line 4 to Keupstraße. From there, it’s about a 10-minute walk to REWE digital. From the Köln-Mülheim train station, the walk takes about 15 minutes. If you do end up coming by car, you can use the designated parking spaces on the REWE digital grounds for free.

Notes:

• Please update your RSVP if you can’t make it.
• We speak (at least) German, English, and code.
• Come as you are 🌈All Genders welcome.

REWE digital. Part of REWE Group.

----------

About Katherine:
Katherine is a tech professional with 4 years of experience, having retrained in her 40s to become a Computer Expert, specialising in System Integration. Originally from New Zealand, she is currently based in Germany. During her training, she undertook a practicum at SevenShift, a boutique IoT cybersecurity company in Cologne that recognised her enthusiasm, ultimately hiring her. She is now honing her skills and contributing to the company's security initiatives. Outside of her professional life, Katherine is a dedicated single mother to a teenager. She is a member of the Haecksen, the FINTA branch of the CCC, a Chapter Leader of OWASP Cologne, and is currently studying for the Burp Suite certification.

About OWASP:
The Open Worldwide Application Security Project (OWASP®) is a 501(c)(3) worldwide not-for-profit charitable organization focused on improving the security of software. Our mission is to make software security visible so individuals and organizations can make informed decisions. OWASP is uniquely positioned to provide impartial, practical information about AppSec to individuals, corporations, universities, government agencies, and other organizations worldwide. Operating as a community of like-minded professionals, OWASP issues software tools and knowledge-based documentation on application security.