PunkSPIDER and IOStation: Making a Mess
Alejandro Caceres and Jason Hopper reboot PunkSPIDER, a massive global web vulnerability search engine scanning millions of websites for critical flaws.
Summary
The History and Controversy of Mass Web Scanning
Originally funded by DARPA, PunkSPIDER operated as a public global vulnerability search engine before shutting down due to legal threats and terms-of-service disputes.
Rebuilding the Architecture: PunkSPIDER and IOStation
Alejandro Caceres and Jason Hopper present the next-generation distributed scanning infrastructure, capable of auditing tens of millions of web applications in real time.
Automating the Discovery of Critical Web Vulnerabilities
The scanner identifies pervasive SQL injection, cross-site scripting (XSS), and exposed backup files across municipal, educational, and commercial web applications.
Transparency, Policy, and Public Security Accountability
The authors debate the ethics of public vulnerability disclosure, urging the industry to embrace transparency to drive defensive remediation.
Related talks
Main Stage·42 min
James Kettle
James Kettle introduces multi-request single-packet race condition techniques, collapsing complex web application state machines within sub-millisecond windows.
Main Stage·40 min
Dongsung Kim
Dongsung Kim demonstrates how modern browser features and emerging Web APIs can be chained to resurrect Cross-Site Request Forgery (CSRF) despite SameSite cookies.
Main Stage·40 min
James Kettle
PortSwigger researcher James Kettle pioneers HTTP/2 request smuggling, uncovering critical implementation flaws when front-end reverse proxies downgrade to back-end HTTP/1.1.