AppSec California 2020

Browsers are an excellent and ubiquitous tool for accessing and sharing information. With their wide feature set, it's sometimes overlooked that they are in fact tools for remotely executing code on a user, or in our case, target's system, and can play a strong role in the overall infrastructure of a network. In this talk, we'll learn how an attacker can abuse the browser and network in order to remotely access any TCP/UDP service bound to that victim's machine, entirely bypassing the victim’s NAT and firewall, providing arbitrary firewall pinhole control, simply by the victim visiting a website.