Breaking SAP Portal - Proidea

Investigation
• Most actions have icons
• They have to be loaded from the server
• Usually, legitimate users have them all in cache
• Attackers usually don’t have them, so they make requests to
the server
• That’s how we can identify potentially malicious actions
• But there should be correlation with a real user’s activity
• False positives are possible:
•New legitimate user
•Old user clears cache
•Other