Attacking Secondary Contexts in Web Applications - Sam Curry

This talk explores attacking various 'secondary contexts' in web applications where data is being passed to an underlying internal HTTP server. We will explore the different approaches to targeting limited-access/internal APIs, the very strange interactions between different servers within the stack, and lastly the different types of vulnerabilities present in second stage HTTP services.