54:45This recording is not available yet.
Cacher son traffic réseau à la Blue Team en opération Red Team
Download resourcesCategories
Threats & Threat IntelligenceMalware & Attack TechniquesNetwork Security & Zero TrustOffensive Security & ExposurePentesting & Red Teaming
Vendors and tools discussed
About this session
Joel Hien (a pentester turned Vulnerability Operations Center deputy lead) and Hocine Mahtout, Offensive Security Manager at Caisse des Depots, explain how red teams hide command-and-control traffic from blue teams. They start with classic domain fronting: abusing a CDN's good reputation by putting a trusted domain in the TLS SNI while a different, attacker-controlled domain sits in the HTTP host header, so the CDN forwards traffic to the attacker's server under cover of a trusted certificate and IP. They cover the countermeasures that have largely closed this off, including encrypted SNI, CDNs that verify SNI matches the host header, and Azure's recent block on cross-subscription domain fronting. They then pivot to modern equivalents: PaaS redirectors built on AWS Lambda plus API Gateway, Azure Functions, Cloudflare Workers and Google Cloud Functions, each reachable through a provider-specific URL backed by a trusted certificate that most enterprise proxies will never block, combinable with custom reverse proxies like YARP or NGINX for conditional redirection to a legitimate site or the attackers' team server. A live Terraform-deployed Azure Functions demo shows a beacon calling out through such a redirector. They close by naming other unmonitored channels, like Teams and Slack, that bypass corporate proxies entirely.
Dans le domaine de la cybersécurité, les opérations de Red Team sont des exercices cruciaux visant à évaluer la robustesse des infrastructures et des défenses d'un système face à des attaques simulées. Pour mener à bien ces missions, les équipes Red Team doivent constamment innover et adopter des stratégies d'attaque élaborées pour dissumuler leurs traffics une fois l'accès inital obtenu.
Deux approches utilisées dans ce contexte sont le “domain fronting“ et l'utilisation de redirecteurs Cloud PaaS (Platform as a Service). Cette présentation explorera les avantages offerts par les redirecteurs Cloud PaaS (CloudFront AWS Lambda, Azure Function, etc.) par rapport au “domain fronting“ dans le cadre des opérations de Red Team. Nous étudierons les différences fondamentales entre ces deux techniques, en mettant en évidence celle qui offre une solution plus évolutive, flexible et adaptable pour dissimuler le trafic réseau, fournissant ainsi à l'équipe Red Team : résilience, efficacité opérationnelle et capacité d'adaptation.
Key takeaways
- Do not assume a legitimate CDN certificate and IP mean safe traffic; compare the TLS SNI against the HTTP host header in your logs to catch classic domain fronting.
- Deploy encrypted SNI awareness and enterprise proxy features (such as Zscaler's SNI/host mismatch blocking) since standard SNI inspection alone no longer catches modern domain fronting.
- Expect attackers to route C2 traffic through AWS Lambda, Azure Functions, Cloudflare Workers or Google Cloud Functions precisely because blocking major cloud provider domains breaks legitimate business traffic.
- Treat unmonitored SaaS channels like Teams and Slack as potential exfiltration or C2 paths, since they often bypass the corporate proxy entirely.
- If you run a CDN or PaaS-fronted service, verify that SNI and host header match by policy, following the model Azure Front Door adopted to shut down cross-subscription domain fronting.
