toctou
toctou holds a master’s degree in Cybersecurity Engineering from the University of Verona. He began his career as a cybersecurity analyst before taking a sharp turn into database administration, becoming a Senior Oracle Database Administrator. With over ten years of experience in IT, he recently returned to his roots, making another career change to become a penetration tester. He holds the OffSec Certified Professional (OSCP) and OffSec Experienced Penetration Tester (OSEP) certifications. A cybersecurity enthusiast, he is always eager to expand his knowledge and hone his practical security skills in his spare time. Alongside his main role, he currently creates vulnerable machines for OffSec as a freelance author.
Session
Standard OIDC bearer tokens are deceptively simple and highly attractive to developers, but they hide a structurally weak security posture: anyone who holds them can spend them. Following up on our previous deep dive @MOCA24 into securing OIDC code exchanges, this presentation is a hands-on, exploit-driven exploration of token-usage security.
We will begin by demonstrating how easily standard bearer tokens are stolen and replayed remotely from an attacker's terminal. We will then look "beyond the basics" to live-demo a hardened implementation of RFC 9449 (DPoP) using a Keycloak identity provider and an Express.js resource server.