Breaking SAP Portal - Proidea

More documents

Recommendations

Info

Conclusion It is possible to protect yourself from these kinds of issues, and we are working close with SAP to keep customers secure SAP Guides Regular security assessments Monitoring technical security ABAP code review Segregation of Duties Security events monitoring It’s all in your hands
Future work I'd like to thank SAP's Product Security Response Team for the great cooperation to make SAP systems more secure. Research is always ongoing, and we can't share all of it today. If you want to be the first to see new attacks and demos, follow us at @erpscan and attend future presentations: • June 5-6 – Presentation at RSA (Marina Bay Sands, Singapore) • September 10-12 – BlackHat Trainings (Istanbul, Turkey)
Page 1 and 2:
Invest in security to secure invest
Page 3 and 4:
Evgeny Neyolov
Page 5 and 6:
SAP security Agenda SAP forensics W
Page 7 and 8:
SAP security Espionage Stealing fin
Page 9 and 10:
How easy? SAP Security Notes http:/
Page 11 and 12:
What about unpublished threats? •
Page 13 and 14:
What do we see? • A lot of resear
Page 15 and 16:
Say hello to Portal • Point of we
Page 17 and 18:
Okay, okay. SAP Portal is important
Page 19 and 20:
Full logging is not always the best
Page 21 and 22:
SAP Management Console • SAP MC -
Page 23 and 24:
SAP Management Console true
Page 25 and 26:
Prevention • The HTTP Provider se
Page 27 and 28:
Declarative By WEB.XML Access contr
Page 29 and 30:
web.xml CriticalAction com.sap.adm
Page 31 and 32: Verb Tampering Need Admin account i
Page 33 and 34: Investigation [Apr 3, 2013 1:23:59
Page 35 and 36: Invoker Servlet • Want to execute
Page 37 and 38: Prevention • Update to the latest
Page 39 and 40: Investigation
Page 41 and 42: EPCF EPCF provides a JavaScript API
Page 43 and 44: Investigation #Plain###192.168.192.
Page 45 and 46: Webdynpro JAVA http://help.sap.com/
Page 47 and 48: Investigation • Most actions have
Page 49 and 50: Directory traversal fix bypass
Page 51 and 52: ../ !252f..!252f Investigation
Page 53 and 54: Read file How we can read the file?
Page 55 and 56: XXE in Portal
Page 57 and 58: XXE Error based XXE
Page 59 and 60: $internal/version=Ni4zFF4wMSeasefor
Page 61 and 62: Prevention • Install SAP note 161
Page 63 and 64: Investigation • The only one way
Page 65 and 66: Malicious file upload: Attack http:
Page 67 and 68: Malicious file upload: Forensics [A
Page 69 and 70: Portal post exploitation • Lot of
Page 71 and 72: SSRF Attack Direct attack GET /vuln
Page 73 and 74: Portal post-exploitation
Page 75 and 76: • Flooding • Deleting • Chang
Page 77 and 78: Log deleting • Flooding is the su
Page 79 and 80: Log archiving • Archiving when al
Page 81: Securing SAP Portal • Patching
show all

Breaking SAP Portal - Proidea

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?