Top 10 winner

Abusing CDNs with SSRF Flash and DNS

Black Hat USA (2015) - Bypass Surgery - Abusing CDNs with SSRF Flash and DNS - 06Aug2015

Mike Brooks and Matthew Bryant · Bishop Fox · 14 September 2015

Combines DNS reconnaissance, Akamai EdgeSuite’s legacy ARLv1 fetching, and vulnerable FlowPlayer plugin loading. ARLv1 can place a whitelisted FlowPlayer SWF under a trusted CDN subdomain; attacker-loaded plugins then use Flash crossdomain.xml trust to make authenticated requests. Also demonstrates three FlowPlayer URL-check bypasses, including protocol-relative URLs, triple-slash parsing and an open redirect.

Record

Document

Black Hat USA (2015) - Bypass Surgery - Abusing CDNs with SSRF Flash and DNS - 06Aug2015

Researcher

Mike Brooks and Matthew Bryant

Published by

Bishop Fox

Date

14 September 2015

Format

Recording

Topic

HTTP

In the archive

• Ranked #5 in the 2015 Top 10 Web Hacking Techniques

Related sources

• Bypass Surgery: Abusing Content Delivery Networks With Server Side Request Forgery (SSRF), Flash, and DNS Slides

Tags

• ssrf
• cdn
• flash
• dns
• sop-bypass
• filter-bypass
• attack-chain
• owasp-a01-2021
• owasp-a05-2021
• owasp-a10-2021

This page is the archive's own catalogue record. The research is the work of Mike Brooks and Matthew Bryant, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 September 2026.