Breaking SAP Portal - Proidea

More documents

Recommendations

Info

ERPScan • Developing software for SAP security monitoring • Leader by the number of acknowledgements from SAP • Invited to talk at more than 35 security conferences worldwide BlackHat (US/EU/DC/UAE), RSA, Defcon, CONFidence, HITB, etc. • First to software for NetWeaver J2EE assessment • The only solution to assess all areas of SAP Security • Research team with experience in different areas of security from ERP and web security to mobile, embedded devices, and critical infrastructure, accumulating their knowledge on SAP research. Leading SAP AG partner in the field of discovering security vulnerabilities by the number of found vulnerabilities
SAP security Agenda SAP forensics WTF?! Say hello to SAP Portal Breaking SAP Portal Catch me if you can Conclusion erpscan.com ERPScan — invest in security to secure investments 5
Page 1 and 2: Invest in security to secure invest
Page 3: Evgeny Neyolov
Page 7 and 8: SAP security Espionage Stealing fin
Page 9 and 10: How easy? SAP Security Notes http:/
Page 11 and 12: What about unpublished threats? •
Page 13 and 14: What do we see? • A lot of resear
Page 15 and 16: Say hello to Portal • Point of we
Page 17 and 18: Okay, okay. SAP Portal is important
Page 19 and 20: Full logging is not always the best
Page 21 and 22: SAP Management Console • SAP MC -
Page 23 and 24: SAP Management Console true
Page 25 and 26: Prevention • The HTTP Provider se
Page 27 and 28: Declarative By WEB.XML Access contr
Page 29 and 30: web.xml CriticalAction com.sap.adm
Page 31 and 32: Verb Tampering Need Admin account i
Page 33 and 34: Investigation [Apr 3, 2013 1:23:59
Page 35 and 36: Invoker Servlet • Want to execute
Page 37 and 38: Prevention • Update to the latest
Page 39 and 40: Investigation
Page 41 and 42: EPCF EPCF provides a JavaScript API
Page 43 and 44: Investigation #Plain###192.168.192.
Page 45 and 46: Webdynpro JAVA http://help.sap.com/
Page 47 and 48: Investigation • Most actions have
Page 49 and 50: Directory traversal fix bypass
Page 51 and 52: ../ !252f..!252f Investigation
Page 53 and 54: Read file How we can read the file?
Page 55 and 56:
XXE in Portal
Page 57 and 58:
XXE Error based XXE
Page 59 and 60:
$internal/version=Ni4zFF4wMSeasefor
Page 61 and 62:
Prevention • Install SAP note 161
Page 63 and 64:
Investigation • The only one way
Page 65 and 66:
Malicious file upload: Attack http:
Page 67 and 68:
Malicious file upload: Forensics [A
Page 69 and 70:
Portal post exploitation • Lot of
Page 71 and 72:
SSRF Attack Direct attack GET /vuln
Page 73 and 74:
Portal post-exploitation
Page 75 and 76:
• Flooding • Deleting • Chang
Page 77 and 78:
Log deleting • Flooding is the su
Page 79 and 80:
Log archiving • Archiving when al
Page 81 and 82:
Securing SAP Portal • Patching
Page 83 and 84:
Future work I'd like to thank SAP's
show all

Breaking SAP Portal - Proidea

Create successful ePaper yourself

Delete template?

Save as template?