Breaking Parser Logic - Take Your Path Normalization Off and Pop 0days Out

This course aims to teach learners a new exploit technique to target path normalization vulnerabilities. The goal is to introduce a novel attack surface that leverages the complexity of path normalization implementation, which has been overlooked by developers, making the proposed attack vector potent and versatile. The course covers various topics such as identifying vulnerabilities in popular frameworks like Nginx, Spring, and Rails, understanding the risks associated with URL path parameters, reverse proxies, and misconfigurations leading to remote code execution. The teaching method involves presenting real-world case studies, demonstrating the impact of path normalization bugs, and providing mitigation strategies. This course is designed for cybersecurity professionals, penetration testers, web developers, and anyone interested in understanding and exploiting path normalization vulnerabilities.