{"guid":"3377f6aa-4668-5aa4-a3c0-4a2d7dea0cff","title":"Flipping Bits: Your Credentials Are Certainly Mine","subtitle":null,"slug":"why2025-268-flipping-bits-your-credentials-are-certainly-mine","link":"https://program.why2025.org/why2025/talk/WQEGCU/","description":"Did you know that if you change a single bit from 1 to 0 (or vice versa) in the first 'g' of the domain name google.com (which is 01100111 in binary) you will end up with variety of valid \"bitflip\" domains like coogle.com, oogle.com, \u0026 woogle.com\n\nSo what happens if you generate and register a bunch of cheap bitfliped versions of popular cloud / Saas provider domains, point them to your VPS, log all incoming requests \u0026 then forget about the whole thing for two years?\n\nWell you will in fact receive a stiff bill, generate huge log files and eventually run out of disk space. But on the upside, you will also have collected a treasure trove of legit credentials \u0026 interesting stuff like valid OAuth refresh tokens, JWT tokens, bearers, cookies, emails, meeting invites with passwords \u0026 truckloads of internet scanner noise.\n\nIn this session we will revisit bitflip research from the last decade and weponize it. Showcase 'Certainly' a pioneering offensive / defensive tool that employs Wildcard DNS matching \u0026 on-the-fly generated SSL certificates and custom payloads for incoming requests across various protocols. All with the intention to downgrade security, harvest credentials, capture emails and replacing dependencies with custom \"malicious\" payloads\n\nLicensed to the public under https://creativecommons.org/licenses/by/4.0/","original_language":"eng","persons":["STÖK","joohoi"],"tags":["268","2025","why2025","Hacking","Andromeda","why2025-eng","Day 5"],"view_count":430,"promoted":false,"date":"2025-08-11T23:00:00.000+02:00","release_date":"2025-08-12T00:00:00.000+02:00","updated_at":"2026-03-02T00:15:06.465+01:00","length":2512,"duration":2512,"thumb_url":"https://static.media.ccc.de/media/events/why2025/268-3377f6aa-4668-5aa4-a3c0-4a2d7dea0cff.jpg","poster_url":"https://static.media.ccc.de/media/events/why2025/268-3377f6aa-4668-5aa4-a3c0-4a2d7dea0cff_preview.jpg","timeline_url":"https://static.media.ccc.de/media/events/why2025/268-3377f6aa-4668-5aa4-a3c0-4a2d7dea0cff.timeline.jpg","thumbnails_url":"https://static.media.ccc.de/media/events/why2025/268-3377f6aa-4668-5aa4-a3c0-4a2d7dea0cff.thumbnails.vtt","frontend_link":"https://media.ccc.de/v/why2025-268-flipping-bits-your-credentials-are-certainly-mine","url":"https://api.media.ccc.de/public/events/3377f6aa-4668-5aa4-a3c0-4a2d7dea0cff","conference_title":"What Hackers Yearn 2025","conference_url":"https://api.media.ccc.de/public/conferences/WHY2025","related":[],"recordings":[{"size":558,"length":2512,"mime_type":"video/webm;codecs=av01","language":"eng","filename":"why2025-268-eng-Flipping_Bits_Your_Credentials_Are_Certainly_Mine_av1-hd.webm","state":"new","folder":"av1-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2025-08-12T17:35:44.427+02:00","recording_url":"https://cdn.media.ccc.de/events/why2025/av1-hd/why2025-268-eng-Flipping_Bits_Your_Credentials_Are_Certainly_Mine_av1-hd.webm","url":"https://api.media.ccc.de/public/recordings/89980","event_url":"https://api.media.ccc.de/public/events/3377f6aa-4668-5aa4-a3c0-4a2d7dea0cff","conference_url":"https://api.media.ccc.de/public/conferences/WHY2025"},{"size":38,"length":2512,"mime_type":"audio/mpeg","language":"eng","filename":"why2025-268-eng-Flipping_Bits_Your_Credentials_Are_Certainly_Mine_mp3.mp3","state":"new","folder":"mp3","high_quality":false,"width":0,"height":0,"updated_at":"2025-08-12T14:53:58.974+02:00","recording_url":"https://cdn.media.ccc.de/events/why2025/mp3/why2025-268-eng-Flipping_Bits_Your_Credentials_Are_Certainly_Mine_mp3.mp3","url":"https://api.media.ccc.de/public/recordings/89819","event_url":"https://api.media.ccc.de/public/events/3377f6aa-4668-5aa4-a3c0-4a2d7dea0cff","conference_url":"https://api.media.ccc.de/public/conferences/WHY2025"},{"size":569,"length":2512,"mime_type":"video/webm","language":"eng","filename":"why2025-268-eng-Flipping_Bits_Your_Credentials_Are_Certainly_Mine_webm-hd.webm","state":"new","folder":"webm-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2025-08-12T20:06:04.609+02:00","recording_url":"https://cdn.media.ccc.de/events/why2025/webm-hd/why2025-268-eng-Flipping_Bits_Your_Credentials_Are_Certainly_Mine_webm-hd.webm","url":"https://api.media.ccc.de/public/recordings/90065","event_url":"https://api.media.ccc.de/public/events/3377f6aa-4668-5aa4-a3c0-4a2d7dea0cff","conference_url":"https://api.media.ccc.de/public/conferences/WHY2025"},{"size":132,"length":2512,"mime_type":"video/webm","language":"eng","filename":"why2025-268-eng-Flipping_Bits_Your_Credentials_Are_Certainly_Mine_webm-sd.webm","state":"new","folder":"webm-sd","high_quality":false,"width":720,"height":576,"updated_at":"2025-08-12T19:36:11.654+02:00","recording_url":"https://cdn.media.ccc.de/events/why2025/webm-sd/why2025-268-eng-Flipping_Bits_Your_Credentials_Are_Certainly_Mine_webm-sd.webm","url":"https://api.media.ccc.de/public/recordings/90054","event_url":"https://api.media.ccc.de/public/events/3377f6aa-4668-5aa4-a3c0-4a2d7dea0cff","conference_url":"https://api.media.ccc.de/public/conferences/WHY2025"},{"size":164,"length":2512,"mime_type":"video/mp4","language":"eng","filename":"why2025-268-eng-Flipping_Bits_Your_Credentials_Are_Certainly_Mine_sd.mp4","state":"new","folder":"h264-sd","high_quality":false,"width":720,"height":576,"updated_at":"2025-08-12T14:56:10.928+02:00","recording_url":"https://cdn.media.ccc.de/events/why2025/h264-sd/why2025-268-eng-Flipping_Bits_Your_Credentials_Are_Certainly_Mine_sd.mp4","url":"https://api.media.ccc.de/public/recordings/89842","event_url":"https://api.media.ccc.de/public/events/3377f6aa-4668-5aa4-a3c0-4a2d7dea0cff","conference_url":"https://api.media.ccc.de/public/conferences/WHY2025"},{"size":25,"length":2512,"mime_type":"audio/opus","language":"eng","filename":"why2025-268-eng-Flipping_Bits_Your_Credentials_Are_Certainly_Mine_opus.opus","state":"new","folder":"opus","high_quality":false,"width":0,"height":0,"updated_at":"2025-08-12T14:53:54.765+02:00","recording_url":"https://cdn.media.ccc.de/events/why2025/opus/why2025-268-eng-Flipping_Bits_Your_Credentials_Are_Certainly_Mine_opus.opus","url":"https://api.media.ccc.de/public/recordings/89818","event_url":"https://api.media.ccc.de/public/events/3377f6aa-4668-5aa4-a3c0-4a2d7dea0cff","conference_url":"https://api.media.ccc.de/public/conferences/WHY2025"},{"size":889,"length":2512,"mime_type":"video/mp4","language":"eng","filename":"why2025-268-eng-Flipping_Bits_Your_Credentials_Are_Certainly_Mine_hd.mp4","state":"new","folder":"h264-hd","high_quality":true,"width":1920,"height":1080,"updated_at":"2025-08-12T14:32:41.317+02:00","recording_url":"https://cdn.media.ccc.de/events/why2025/h264-hd/why2025-268-eng-Flipping_Bits_Your_Credentials_Are_Certainly_Mine_hd.mp4","url":"https://api.media.ccc.de/public/recordings/89797","event_url":"https://api.media.ccc.de/public/events/3377f6aa-4668-5aa4-a3c0-4a2d7dea0cff","conference_url":"https://api.media.ccc.de/public/conferences/WHY2025"}]}