Breaking SAP Portal - Proidea

More documents

Recommendations

Info

Prevention •Install <strong>SAP</strong> notes 1503579,1616259, 1589525, 1624450 •Install other <strong>SAP</strong> notes about Verb Tampering •Scan applications with ERPScan WEB.XML checker •Disable the applications that are not necessary
Investigation [Apr 3, 2013 1:23:59 AM ] - 192.168.192.14 : GET /ctc/ConfigServlet HTTP/1.1 401 1790 [Apr 3, 2013 1:30:01 AM ] - 192.168.192.14 : HEAD /ctc/ConfigServlet HTTP/1.1 200 0 [Apr 3, 2013 1:30:01 AM ] - 192.168.192.14 : HEAD /ctc/ConfigServlet?param=com.sap.ctc.util.UserConfig;CREATE USER;USERNAME=CONF,PASSWORD=idence HTTP/1.0 200 0 j2ee\cluster\\log\system\httpaccess\responses.trc
Page 1 and 2: Invest in security to secure invest
Page 3 and 4: Evgeny Neyolov
Page 5 and 6: SAP security Agenda SAP forensics W
Page 7 and 8: SAP security Espionage Stealing fin
Page 9 and 10: How easy? SAP Security Notes http:/
Page 11 and 12: What about unpublished threats? •
Page 13 and 14: What do we see? • A lot of resear
Page 15 and 16: Say hello to Portal • Point of we
Page 17 and 18: Okay, okay. SAP Portal is important
Page 19 and 20: Full logging is not always the best
Page 21 and 22: SAP Management Console • SAP MC -
Page 23 and 24: SAP Management Console true
Page 25 and 26: Prevention • The HTTP Provider se
Page 27 and 28: Declarative By WEB.XML Access contr
Page 29 and 30: web.xml CriticalAction com.sap.adm
Page 31: Verb Tampering Need Admin account i
Page 35 and 36: Invoker Servlet • Want to execute
Page 37 and 38: Prevention • Update to the latest
Page 39 and 40: Investigation
Page 41 and 42: EPCF EPCF provides a JavaScript API
Page 43 and 44: Investigation #Plain###192.168.192.
Page 45 and 46: Webdynpro JAVA http://help.sap.com/
Page 47 and 48: Investigation • Most actions have
Page 49 and 50: Directory traversal fix bypass
Page 51 and 52: ../ !252f..!252f Investigation
Page 53 and 54: Read file How we can read the file?
Page 55 and 56: XXE in Portal
Page 57 and 58: XXE Error based XXE
Page 59 and 60: $internal/version=Ni4zFF4wMSeasefor
Page 61 and 62: Prevention • Install SAP note 161
Page 63 and 64: Investigation • The only one way
Page 65 and 66: Malicious file upload: Attack http:
Page 67 and 68: Malicious file upload: Forensics [A
Page 69 and 70: Portal post exploitation • Lot of
Page 71 and 72: SSRF Attack Direct attack GET /vuln
Page 73 and 74: Portal post-exploitation
Page 75 and 76: • Flooding • Deleting • Chang
Page 77 and 78: Log deleting • Flooding is the su
Page 79 and 80: Log archiving • Archiving when al
Page 81 and 82: Securing SAP Portal • Patching
Page 83 and 84:
Future work I'd like to thank SAP's
show all

Breaking SAP Portal - Proidea

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?