#NahamCon2024

Modern WAF Bypass Techniques on Large Attack Surfaces 👇
Shubham Shah is a security researcher and entrepreneur, known for co-founding Assetnote - a leading attack surface management platform. He's ranked as the #1 bug bounty hunter in Australia for three consecutive years and #27 in the world on HackerOne. Shubham specializes in discovering complex vulnerabilities in enterprise software and engineering security automation.
nowafpls:
github.com/assetnote/nowafpls
JOIN DISCORD:
discord.gg/NahamSec
💬 Social Media
- / nahamsec
- / nahamsec
- twitch.com/nahamsec
- / nahamsec1

[@detecht]

Shubs is like, "Have you ever heard of the internet? Yeah, I own it."
Wow! This was amazing! Thank you, sir. Greatly appreciated.

[@Ott3rly]

Thanks, Shubs for showing some cool techniques for WAF bypasses. I guess the community had long waited for this! Even though some WAF bypasses were not new, but many people knew this for sure.

[@Dkdiebebdjdb]

Great talk, glad to see it here too

[@golfreeze]

Thank you Shah , Good topic

[@HopliteSecurity]

Great presentation and really appreciated the fun and engaging delivery. Big thanks again for putting on NahamCon2024 ❤❤

[@Blu3ther]

ANYTIME I see Shubs in the thumbnail, I'm clicking on it! Thanx for the tips!! 💪

[@MFoster392]

Great talk thanks for NAHAMCON Ben :)

[@rctech1237]

Wow keep it up , present 😊

[@thatonesecguy]

Brilliant!!!

[@d1_v_1ne]

Thanks

[@bokfpv]

Nice!!

[@WebWonders1]

Super infromative

[@breakoutgaffe4027]

Nice tips

[@ranoshlover]

wow

[@romeokoati5385]

Nice talk

[@MFoster392]

Can these tools be ran from a laptop this is the first video I've seen on them thanks again Ben you still da man Bro :)

[@trustedsecurity6039]

Shadow clone is like axiom finally

[@Mersal-tq9lm]

With the shared certificates trick(cross-tenant attacks). You will have to know the origin IP of the target right?

[@InfoSecIntel]

Will/Have the slides been released?

[@parthshukla1216]

Amazing Doc.
I certainly doubt nowafpls working, but happy to be wrong.

[@trustedsecurity6039]

And i highly doubt you know anything about web hacking and who is this guy lmao

[@jesperwall839]

Ok. This only applies to cloud WAF.

[@TheRustyCodger]

Taking the piss with the advertisements

[@NahamSec]

?

[@TheRustyCodger]

@@NahamSec Love the video but 8 adverts really cheesed me off

[@okonkwochukwudalu9340]

Use of shared certificates is why I disliked akamai, they do not support bring your own certs....terrible!