Uncovering SAP vulnerabilities: Reversing and breaking the Diag protocol
|
|
|
- Annabelle Blake
- 6 years ago
- Views:
Transcription
1 Uncovering SAP vulnerabilities: Reversing and breaking the Diag protocol Martin Gallo Core Security Defcon 20 July 2012 P A G E
2 Agenda Introduction Motivation and related work SAP Netweaver architecture and protocols layout Dissecting and understanding the Diag protocol Results and findings Defenses and countermeasures Conclusion and future work P A G E 2
3 Introduction P A G E 3
4 Introduction Leader business software provider Sensitive enterprise business processes runs on SAP systems SAP security became a hot topic Some components still not well covered Proprietary protocols used at different components P A G E 4
5 Introduction Dynamic Information and Action Gateway (Diag) protocol (aka SAP GUI protocol ) Link between presentation layer (SAP GUI) and application layer (SAP Netweaver) Present in every SAP NW ABAP AS Compressed but unencrypted by default TCP ports 3200 to 3298 P A G E 5
6 Agenda Introduction Motivation and related work SAP Netweaver architecture and protocols layout Dissecting and understanding the Diag protocol Results and findings Defenses and countermeasures Conclusion and future work P A G E 6
7 Motivation and related work P A G E 7
8 Previous work on Diag protocol Proprietary tools? Sniffing through reflectionmethod Compression algorithm disclosed Proxy-like tool Decompression Wireshark plug-in Cain&Abel sniffing P A G E 8
9 # of Security Notes Motivation Previous work mostly focused on decompression Protocol inner workings remains unknown No practical tool for penetration testing Only 2 out of ~2300 security fixes published by SAP since 2009 affected components related to Diag P A G E 9
10 Agenda Introduction Motivation and related work SAP Netweaver architecture and protocols layout Dissecting and understanding the Diag protocol Results and findings Defenses and countermeasures Conclusion and future work P A G E 1 0
11 SAP Netweaver architecture and protocols layout P A G E 11
12 SAP Netweaver architecture P A G E 1 2
13 Relevant concepts and components ABAP SAP s programming language Dispatcher and work processes (wp) Dispatcher: distribute user requests across wp Work processes: handles specific tasks Types: dialog, spool, update, background, lock Dialog processing Programming method used by ABAP Separates business programs in screens and dialog steps P A G E 1 3
14 SAP Protocols layout RFC Diag Protocol Router BAPI SOAP NI (Network Interface) Protocol HTTP SSL Proprietary protocols Standard protocols P A G E 1 4
15 Agenda Introduction Motivation and related work SAP Netweaver architecture and protocols layout Dissecting and understanding the Diag protocol Results and findings Defenses and countermeasures Conclusion and future work P A G E 1 5
16 Dissecting and understanding the Diag protocol P A G E 16
17 Dissecting and understanding the Diag protocol Approach Black-box No binary reverse engineering techniques were used Enable system/developer traces (GUI/app server) Analyze network and application traces Learn by interacting with the components (GUI/app server) Continuous improvement of test tools based on gained knowledge P A G E 1 7
18 Dissecting and understanding the Diag protocol NI (Network Interface) Protocol Diag Protocol Payload DP Header (optional) Diag Header Compressio n Header (optional) Diag Item 1 Diag Item n P A G E 1 8
19 Dissecting and understanding the Diag protocol Initialization Identified only two relevant protocol states: Not initialized Initialized User s context assigned in shared memory Started by GUI application Only first packet Always uncompressed NI (Network Interface) Protocol Diag Protocol Payload DP Header (optional) Diag Header Compressi on Header (optional) Diag Item 1 Diag Item n P A G E 1 9
20 Dissecting and understanding the Diag protocol DP Header 200 bytes length Two different semantics IPC (inter process communication) Used in communications between dispatcher and work processes Synchronization and status Network Most fields filled with default values Relevant fields: Terminal name, Length Only present during initialization (first packet) DP Header (optional) NI (Network Interface) Protocol Diag Header Diag Protocol Compressi on Header (optional) Payload Diag Item 1 Diag Item n P A G E 2 0
21 Dissecting and understanding the Diag protocol Diag Header Compression enabled/disabled, encryption using SNC Mode Comm Flag Mode Stat Error Flag Msg type Msg Info Msg RC Comp Flag Identifies different sessions using the same channel DP Header (optional) NI (Network Interface) Protocol Diag Header Diag Protocol Compressi on Header (optional) Payload Diag Item 1 Diag Item n P A G E 2 1
22 Dissecting and understanding the Diag protocol Compression Enabled by default Uses two variants of Lempel-Ziv Adaptive Compression Algorithm LZH (Lempel-Ziv-Huffman) LZ77 LZC (Lempel-Ziv-Welch-Thomas) LZ78 Same implementation as SAP s MaxDB open source project Can be disabled in GUI by setting TDW_NOCOMPRESS environment variable DP Header (optional) NI (Network Interface) Protocol Diag Header Diag Protocol Compressi on Header (optional) Payload Diag Item 1 Diag Item n P A G E 2 2
23 Dissecting and understanding the Diag protocol Compression Header LZH: compression level LZC: max # of bits per code Uncompressed length Comp Alg Magic Bytes x1f x9d Special Byte LZH: 0x12 LZC: 0x10 DP Header (optional) NI (Network Interface) Protocol Diag Header Diag Protocol Compressi on Header (optional) Payload Diag Item 1 Diag Item n P A G E 2 3
24 Dissecting and understanding the Diag protocol Payload SES Fixed length (16 bytes) Session information ICO Fixed length (20 bytes) Icon information TIT Fixed length (3 bytes) Title information DiagMessage Fixed length (76 bytes) Old Diag message OKC CHL (? Bytes) Fixed length (22 bytes) SBA Fixed length (9 bytes) List items EOM Fixed length (0 bytes) End of message NI (Network Interface) Protocol APPL/APPL4 Variable length Diag Protocol Payload DIAG_XMLBlob Variable length XML Blob DP Header (optional) Diag Header Compressi on Header (optional) Diag Item 1 SBA2 Fixed length (36 bytes) List items Diag Item n P A G E 2 4
25 Dissecting and understanding the Diag protocol APPL/APPL4 items Type Length Field ID SID NI (Network Interface) Protocol Diag Protocol Payload APPL: 0x10 APPL4: 0x12 APPL: 2 bytes APPL4: 4 bytes DP Header (optional) Diag Header Compressi on Header (optional) Diag Item 1 Diag Item n P A G E 2 5
26 Diag protocol security highlights Protocol version APPL item included in payload during initialization Can disable compression using version number 200 Authentication Performed as a regular dialog step Set user s context on work processes shared memory Embedded RFC calls APPL item that carries RFC calls in both directions Server doesn t accept RFC calls until authenticated P A G E 2 6
27 Agenda Introduction Motivation and related work SAP Netweaver architecture and protocols layout Dissecting and understanding the Diag protocol Results and findings Defenses and countermeasures Conclusion and future work P A G E 2 7
28 Results and findings P A G E 28
29 Packet dissection Wireshark plug-in written in C/C++ NI Protocol dissector TCP reassembling Router Protocol dissector Basic support Diag protocol dissector Decompression DP header / Diag Header / Compression Header Item ID/SID identification and dissection of relevant items Call RFC dissector for embedded calls RFC protocol dissector Basic coverage of relevant parts P A G E 2 9
30 Packet dissection P A G E 3 0
31 Packet crafting Scapy classes SAPNi SAPDiagDP (DP Header) SAPDiag (Diag header + compression) SAPDiagItem Custom classes for relevant Diag items PoC and example scripts Information gathering Login Brute Force Proxy/MITM script Diag server P A G E 3 1
32 Fuzzing approach Fuzzing scheme using scapy classes test cases generation delivery windbg monitoring xmlrpc syncronization Monitoring of all work processes P A G E 3 2
33 Vulnerabilities found 6 vulnerabilities released on May 2012 affecting SAP NW 7.01/7.02, fix available on SAP Note Unauthenticated remote denial of service when developed traces enabled CVE DiagTraceAtoms function CVE DiagTraceStreamI function CVE DiagTraceHex function P A G E 3 3
34 Vulnerabilities found Unauthenticated remote denial of service CVE Diaginput function CVE DiagiEventSource function Unauthenticated remote code execution when developer traces enabled CVE DiagTraceR3Info function Stack-based buffer overflow while parsing ST_R3INFO CODEPAGE item Thanks to Francisco Falcon for the exploit P A G E 3 4
35 Attack scenarios Target applications servers Attacker Exploit mentioned CVEs Gather server information Login brute force SAP NW AS P A G E 3 5
36 Attack scenarios Target GUI users Gather credentials Attacker Inject RFC calls in user s GUI Rogue Server GUI Shortcut MitM GUI User GUI User GUI User SAP NW AS P A G E 3 6
37 Agenda Introduction Motivation and related work SAP Netweaver architecture and protocols layout Dissecting and understanding the Diag protocol Results and findings Defenses and countermeasures Conclusion and future work P A G E 3 7
38 Defenses and countermeasures P A G E 38
39 Defenses and countermeasures Restrict network access to dispatcher service TCP ports Use application layer gateways Implement SNC client encryption Provides authentication and encryption Available for free at SAP Marketplace since 2011 See SAP Note Restrict use of GUI shortcuts SAP GUI > 7.20 disabled by default See SAP Note P A G E 3 9
40 Defenses and countermeasures Use WebGUI with HTTPS See SAP Note Patch regularly Patch Tuesday RSECNOTE program, see SAP Note Patch CVEs affecting Diag Look at CORE s advisory for mitigation/countermeasures See SAP Note Test regularly P A G E 4 0
41 Agenda Introduction Motivation and related work SAP Netweaver architecture and protocols layout Dissecting and understanding the Diag protocol Results and findings Defenses and countermeasures Conclusion and future work P A G E 4 1
42 Conclusion and future work P A G E 42
43 Conclusion Protocol details now available to the security community Practical tools for dissection and crafting of protocol s messages published New vectors for testing and assessing SAP environments Discussed countermeasures and defenses P A G E 4 3
44 Future work Security assessment and fuzzing of GUI/app server. Complete dissection of embedded RFC calls. Full implementation of attack scenarios Integration with external libraries and exploitation tools. Security assessment of SNC and coverage of encrypted traffic. P A G E 4 4
45 Q & A P A G E 45
46 Thank you! Thanks to Diego, Flavio, Dana, Wata and Euge P A G E 46
47 References P A G E 4 7
Intercepting SNC-protected traffic
Intercepting SNC-protected traffic Martin Gallo Penetration Testing SME March 2017 Agenda Introduction Problem SAP Protocols SAP SNC (Secure Network Connections) Attack vectors Vulnerable scenarios Demo
Systems Applications Proxy Pwnage!
Systems Applications Proxy Pwnage! ian@sensepost.com! about: us! Ian de Villiers! What weʼre going to talk about! Why this Talk?! The history of decompressing SAP DIAG! Understanding the fundamentals!
Using the Cisco ACE Application Control Engine Application Switches with the Cisco ACE XML Gateway
Using the Cisco ACE Application Control Engine Application Switches with the Cisco ACE XML Gateway Applying Application Delivery Technology to Web Services Overview The Cisco ACE XML Gateway is the newest
Foreword by Katie Moussouris... Acknowledgments... xvii. Introduction...xix. Chapter 1: The Basics of Networking... 1
Brief Contents Foreword by Katie Moussouris.... xv Acknowledgments... xvii Introduction...xix Chapter 1: The Basics of Networking... 1 Chapter 2: Capturing Application Traffic... 11 Chapter 3: Network
Rootkits and Trojans on Your SAP Landscape
Rootkits and Trojans on Your SAP Landscape SAP Security and the Enterprise Ertunga Arsal SAP systems are the heart of many enterprises. Most critical business functions run on SAP Applications and the
Monitoring SAP ENCYCLOPEDIA ... ENCYCLOPEDIA. Monitoring Secrets for SAP. ArgSoft Intellectual Property Holdings, Limited
Monitoring Secrets for SAP ENCYCLOPEDIA ENCYCLOPEDIA Monitoring SAP.... 1991-2010 Contents Argent for SAP Overview 3 Introduction 3 Monitoring With Argent for SAP 4 SAP Instance 4 SAP Processes 4 Work
MWR InfoSecurity Security Advisory. Sophos RMS / TAO Component DoS Vulnerability. 16 th January Contents
Contents MWR InfoSecurity Security Advisory Sophos RMS / TAO Component DoS Vulnerability 16 th January 2009 2009-01-16 Page 1 of 9 Contents Contents 1 Detailed Vulnerability Description...5 1.1 Introduction...5
Case Studies, Lessons Learned. Ing. Tijl Deneut Lecturer Applied Computer Sciences Howest Researcher XiaK, Ghent University
Case Studies, Lessons Learned Ing. Tijl Deneut Lecturer Applied Computer Sciences Howest Researcher XiaK, Ghent University Case Study Overview 3 different types of cases Troubleshooting We have systems
Preventing vulnerabilities in HANAbased MARCH TROOPERS SECURITY CONFERENCE
Preventing vulnerabilities in HANAbased deployments MARCH 2016 - TROOPERS SECURITY CONFERENCE Disclaimer This presentation contains references to the products of SAP SE. SAP, R/3, xapps, xapp, SAP NetWeaver,
Hackveda Training - Ethical Hacking, Networking & Security
Hackveda Training - Ethical Hacking, Networking & Security Day1: Hacking windows 7 / 8 system and security Part1 a.) Windows Login Password Bypass manually without CD / DVD b.) Windows Login Password Bypass
WiFuzz: Detecting and Exploiting Logical Flaws in the Wi-Fi Cryptographic Handshake
WiFuzz: Detecting and Exploiting Logical Flaws in the Wi-Fi Cryptographic Handshake Mathy Vanhoef - @vanhoefm imec-distrinet, KU Leuven Black Hat, 27 July 2017 Introduction More and more Wi-Fi network
How were the Credit Card Numbers Published on the Web? February 19, 2004
How were the Credit Card Numbers Published on the Web? February 19, 2004 Agenda Security holes? what holes? Should I worry? How can I asses my exposure? and how can I fix that? Q & A Reference: Resources
Fuzzing proprietary SCADA protocols
Fuzzing proprietary SCADA protocols Sergey Bratus Black Hat 2008 INSTITUTE FOR SECURITY TECHNOLOGY STUDIES Cyber Security and Trust Research & Development http:// Fuzzing SCADA Ganesh Devarajan (TippingPoint)
SAP NetWeaver 04 Security Guide. Network and Communication Security
SAP NetWeaver 04 Security Guide Network and Communication Security Document Version 1.00 May 11, 2004 SAP AG Neurottstraße 16 69190 Walldorf Germany T +49/18 05/34 34 24 F +49/18 05/34 34 20 www.sap.com
McAfee Certified Assessment Specialist Network
McAfee MA0-150 McAfee Certified Assessment Specialist Network Version: 4.0 Topic 1, Volume A QUESTION NO: 1 An attacker has compromised a Linux/Unix host and discovers a suspicious file called "password"
Protecting SAP HANA from vulnerabilities and exploits. MARCH TROOPERS Security Conference, Heidelberg
Protecting SAP HANA from vulnerabilities and exploits MARCH 2017 - TROOPERS Security Conference, Heidelberg Disclaimer This presentation contains references to the products of SAP SE. SAP, R/3, xapps,
9. Wireshark I: Protocol Stack and Ethernet
Distributed Systems 205/2016 Lab Simon Razniewski/Florian Klement 9. Wireshark I: Protocol Stack and Ethernet Objective To learn how protocols and layering are represented in packets, and to explore the
Drone /12/2018. Threat Model. Description. Threats. Threat Source Risk Status Date Created
Drone - 2 04/12/2018 Threat Model Description Threats Threat Source Risk Status Date Created Mobile Phone: Sensitive Data Leakage Smart Devices Mobile Phone: Session Hijacking Smart Devices Mobile Phone:
Bank Infrastructure - Video - 1
Bank Infrastructure - 1 05/09/2017 Threats Threat Source Risk Status Date Created Account Footprinting Web Browser Targeted Malware Web Browser Man in the browser Web Browser Identity Spoofing - Impersonation
Fuzzing Proprietary Protocols
Corporate Technology Fuzzing Proprietary Protocols A Practical Approach Dr. Thomas Pröll Siemens CERT Copyright Siemens AG 2010. All rights reserved. Overview Fuzzing: What is it? Proprietary Protocols
SOLUTION BRIEF CA API MANAGEMENT. Enable and Protect Your Web Applications From OWASP Top Ten With CA API Management
SOLUTION BRIEF CA API MANAGEMENT Enable and Protect Your Web Applications From OWASP Top Ten With CA API Management 2 SOLUTION BRIEF ENABLE AND PROTECT YOUR WEB APPLICATIONS WITH CA API MANAGEMENT ca.com
Malware and Vulnerability Check Point. 1. Find Problems 2. Tell Vendors 3. Share with Community
Malware and Vulnerability Research @ Check Point 1. Find Problems 2. Tell Vendors 3. Share with Community TR-069 quick tour / DEF CON recap Motivation The TR-069 Census 2014 Research Highlights Mass Pwnage
When the Lights go out. Hacking Cisco EnergyWise. Version: 1.0. Date: 7/1/14. Classification: Ayhan Koca, Matthias Luft
When the Lights go out Hacking Cisco EnergyWise Version: 1.0 Date: 7/1/14 Classification: Author(s): Public Ayhan Koca, Matthias Luft TABLE OF CONTENT 1 HANDLING... 5 1.1 DOCUMENT STATUS AND OWNER... 5
Objectives: (1) To learn to capture and analyze packets using wireshark. (2) To learn how protocols and layering are represented in packets.
Team Project 1 Due: Beijing 00:01, Friday Nov 7 Language: English Turn-in (via email) a.pdf file. Objectives: (1) To learn to capture and analyze packets using wireshark. (2) To learn how protocols and
Smart Fuzzing. Lidong LI & Naijie XU I.
802.11 Smart Fuzzing Lidong LI & Naijie XU I CyberPeace@AD-LAB About us Lidong LI: Security Researcher at CyberPeace-ADLAB Research:WIFI,BLE,Zigbee,Wireless Protocol Bug Hunter Jiangnan University Naijie
Symantec Ransomware Protection
Symantec Ransomware Protection Protection Against Ransomware Defense in depth across all control points is required to stop ransomware @ Email Symantec Email Security.cloud, Symantec Messaging Gateway
Hunting crypto secrets in SAP systems. Martin Gallo, Product Owner/Security Researcher
Hunting crypto secrets in SAP systems Martin Gallo, Product Owner/Security Researcher AGENDA Problem definition Cryptographic material Personal Security Environment (PSE) SSO credentials (cred_v2) Local
Check Point DDoS Protector Introduction
Check Point DDoS Protector Introduction Petr Kadrmas SE Eastern Europe pkadrmas@checkpoint.com Agenda 1 (D)DoS Trends 2 3 4 DDoS Protector Overview Protections in Details Summary 2 (D)DoS Attack Methods
SAP Web Dispatcher 6.40 for SAP Web AS Java. Jochen Rundholz NW RIG APA
SAP Web Dispatcher 6.40 for SAP Web AS Java Jochen Rundholz NW RIG APA RIG Know How Conf Calls Please: All participants will be muted Questions in the Q&A section at the end Important issues via WebEx
MWR InfoSecurity Security Advisory. IBM WebSphere MQ - rridecompress Remote Denial of Service Vulnerability. 4th March 2010
MWR InfoSecurity Security Advisory IBM WebSphere MQ - rridecompress Remote Denial of Service Vulnerability 4th March 2010 2010-03-04 Page 1 of 9 Contents Contents 1 Detailed Vulnerability Description...
Frequently Asked Questions WPA2 Vulnerability (KRACK)
Frequently Asked Questions WPA2 Vulnerability (KRACK) Release Date: October 20, 2017 Document version: 1.0 What is the issue? A research paper disclosed serious vulnerabilities in the WPA and WPA2 key
Web Application & Web Server Vulnerabilities Assessment Pankaj Sharma
Web Application & Web Server Vulnerabilities Assessment Pankaj Sharma Indian Computer Emergency Response Team ( CERT - IN ) Department Of Information Technology 1 Agenda Introduction What are Web Applications?
CIT 380: Securing Computer Systems. Network Security Concepts
CIT 380: Securing Computer Systems Network Security Concepts Topics 1. Protocols and Layers 2. Layer 2 Network Concepts 3. MAC Spoofing 4. ARP 5. ARP Spoofing 6. Network Sniffing Protocols A protocol defines
Network Model: Each layer has a specific function.
OBJECTIVES: To discuss the OSI model and its layer architecture and to show the interface between the layers. To briefly discuss the functions of each layer in the OSI model. To introduce the TCP/IP protocol.
CTS2134 Introduction to Networking. Module 08: Network Security
CTS2134 Introduction to Networking Module 08: Network Security Denial of Service (DoS) DoS (Denial of Service) attack impacts system availability by flooding the target system with traffic or by exploiting
Penetration Testing with Kali Linux
Penetration Testing with Kali Linux PWK Copyright Offensive Security Ltd. All rights reserved. Page 1 of 11 All rights reserved to Offensive Security No part of this publication, in whole or in part, may
DKT 224/3 LAB 2 NETWORK PROTOCOL ANALYZER DATA COMMUNICATION & NETWORK SNIFFING AND IDENTIFY PROTOCOL USED IN LIVE NETWORK
DKT 224/3 DATA COMMUNICATION & NETWORK LAB 2 NETWORK PROTOCOL ANALYZER SNIFFING AND IDENTIFY PROTOCOL USED IN LIVE NETWORK Lab #2 2 Lab #2 : Network Protocol Analyzer (Sniffing and Identify Protocol used
A Framework for Optimizing IP over Ethernet Naming System
www.ijcsi.org 72 A Framework for Optimizing IP over Ethernet Naming System Waleed Kh. Alzubaidi 1, Dr. Longzheng Cai 2 and Shaymaa A. Alyawer 3 1 Information Technology Department University of Tun Abdul
Microsoft Office Protected-View Out-Of- Bound Array Access
Microsoft Office Protected-View Out-Of- Bound Array Access 2017-11-23 Software Microsoft Office Affected Versions Microsoft Excel 2010, 2013, 2016 (x86 and x64) CVE Reference Author Severity Vendor CVE-2017-8502
Ethical Hacking and Countermeasures: Web Applications, Second Edition. Chapter 3 Web Application Vulnerabilities
Ethical Hacking and Countermeasures: Web Chapter 3 Web Application Vulnerabilities Objectives After completing this chapter, you should be able to: Understand the architecture of Web applications Understand
Locking down a Hitachi ID Suite server
Locking down a Hitachi ID Suite server 2016 Hitachi ID Systems, Inc. All rights reserved. Organizations deploying Hitachi ID Identity and Access Management Suite need to understand how to secure its runtime
9. Security. Safeguard Engine. Safeguard Engine Settings
9. Security Safeguard Engine Traffic Segmentation Settings Storm Control DoS Attack Prevention Settings Zone Defense Settings SSL Safeguard Engine D-Link s Safeguard Engine is a robust and innovative technology
Wireless LAN Security. Gabriel Clothier
Wireless LAN Security Gabriel Clothier Timeline 1997: 802.11 standard released 1999: 802.11b released, WEP proposed [1] 2003: WiFi alliance certifies for WPA 2004: 802.11i released 2005: 802.11w task group
Activating Intrusion Prevention Service
Activating Intrusion Prevention Service Intrusion Prevention Service Overview Configuring Intrusion Prevention Service Intrusion Prevention Service Overview Intrusion Prevention Service (IPS) delivers
Security Testing Summary of Konica Minolta bizhub vcare 2.8 Device Management and Communications System and Various bizhub Products
Security Testing Summary of Konica Minolta bizhub vcare 2.8 Device Management and Communications System and Various bizhub Products SR140630B July 2014 Miercom www.miercom.com Overview Konica Minolta Business
Man-In-The-Browser Attacks. Daniel Tomescu
Man-In-The-Browser Attacks Daniel Tomescu 1 About me Work and education: Pentester @ KPMG Romania Moderator @ Romanian Security Team MSc. Eng. @ University Politehnica of Bucharest OSCP, CREST CRT Interests:
ECCouncil Exam v8 Certified Ethical Hacker v8 Exam Version: 7.0 [ Total Questions: 357 ]
![ECCouncil Exam v8 Certified Ethical Hacker v8 Exam Version: 7.0 [ Total Questions: 357 ]](/thumbs/89/101183176.jpg "ECCouncil Exam v8 Certified Ethical Hacker v8 Exam Version: 7.0 [ Total Questions: 357 ]")
s@lm@n ECCouncil Exam 312-50v8 Certified Ethical Hacker v8 Exam Version: 7.0 [ Total Questions: 357 ] Topic break down Topic No. of Questions Topic 1: Background 38 Topic 3: Security 57 Topic 4: Tools
How to perform the DDoS Testing of Web Applications
How to perform the DDoS Testing of Web Applications Peerlyst November 02, 2017 Nasrumminallah Zeeshan (zeeshan@nzwriter.com) A Denial of Service (DoS) attack is consisted of carrying out traffic flooding
Cyber Security & Ethical Hacking Training. Introduction to Cyber Security Introduction to Cyber Security. Linux Operating System and Networking: LINUX
Cyber Security & Ethical Hacking Training. Introduction to Cyber Security Introduction to Cyber Security HTML PHP Database Linux Operating System and Networking: LINUX NETWORKING Information Gathering:
Scribe Notes -- October 31st, 2017
Scribe Notes -- October 31st, 2017 TCP/IP Protocol Suite Most popular protocol but was designed with fault tolerance in mind, not security. Consequences of this: People realized that errors in transmission
NETWORK PACKET ANALYSIS PROGRAM
NETWORK PACKET ANALYSIS PROGRAM Duration: 3 days (21 hours) Mode: 1. Instructor Led Class room Training and Labs 2. Online In this hands-on course, you will receive in-depth training on Protocol analysis
SAP Security In-Depth
SAP Security In-Depth by Mariano Nunez Vol. 5 / May 2012 Abstract "SAP platforms are only accessible internally". While that was true in many organizations more than a decade ago, today, driven by modern
Evaluation Criteria for Web Application Firewalls
Evaluation Criteria for Web Application Firewalls Ivan Ristić VP Security Research Breach Security 1/31 Introduction Breach Security Global headquarters in Carlsbad, California Web application security
Binary Analysis for Botnet Reverse Engineering & Defense. Dawn Song UC Berkeley
Binary Analysis for Botnet Reverse Engineering & Defense Dawn Song UC Berkeley Plans Building on BitBlaze to develop new techniques Automatic Reverse Engineering of C&C protocols of botnets Automatic rewriting
Transport Level Security
2 Transport Level Security : Security and Cryptography Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 28 October 2013 css322y13s2l12, Steve/Courses/2013/s2/css322/lectures/transport.tex,
CIS 700/002 : Special Topics : OWASP ZED (ZAP)
CIS 700/002 : Special Topics : OWASP ZED (ZAP) Hitali Sheth CIS 700/002: Security of EMBS/CPS/IoT Department of Computer and Information Science School of Engineering and Applied Science University of
Certified Penetration Testing Consultant
Certified Penetration Testing Consultant Duration: 4 Days Language: English Course Delivery: Classroom COURSE BENEFITS The vendor neutral Certified Penetration Testing Consultant course is designed for
Going Without CPU Patches on Oracle E-Business Suite 11i?
Going Without CPU Patches on E-Business Suite 11i? September 17, 2013 Stephen Kost Chief Technology Officer Integrigy Corporation Phil Reimann Director of Business Development Integrigy Corporation About
n Given a scenario, analyze and interpret output from n A SPAN has the ability to copy network traffic passing n Capacity planning for traffic
Chapter Objectives n Understand how to use appropriate software tools to assess the security posture of an organization Chapter #7: Technologies and Tools n Given a scenario, analyze and interpret output
Curso: Ethical Hacking and Countermeasures
Curso: Ethical Hacking and Countermeasures Module 1: Introduction to Ethical Hacking Who is a Hacker? Essential Terminologies Effects of Hacking Effects of Hacking on Business Elements of Information Security
CSC 6575: Internet Security Fall Attacks on Different OSI Layer Protocols OSI Layer Basic Attacks at Lower Layers
CSC 6575: Internet Security Fall 2017 Attacks on Different OSI Layer Protocols OSI Layer Basic Attacks at Lower Layers Mohammad Ashiqur Rahman Department of Computer Science College of Engineering Tennessee
CSC Network Security
CSC 474 -- Security Topic 9. Firewalls CSC 474 Dr. Peng Ning 1 Outline Overview of Firewalls Filtering Firewalls Proxy Servers CSC 474 Dr. Peng Ning 2 Overview of Firewalls CSC 474 Dr. Peng Ning 3 1 Internet
SAP Document. SAP GUI Technical Infrastructure. SAP AG Neurottstr. 16 D Walldorf
SAP Document SAP GUI Technical Infrastructure SAP AG Neurottstr. 16 D-69190 Walldorf Copyright Copyright 2001 SAP AG. All rights reserved. No part of this publication may be reproduced or transmitted in
Post Connection Attacks
Post Connection Attacks All the attacks we carried out in the previous sections can be done without knowing the key to the AP, ie: without connecting to the target network. We saw how we can control all
SAP NetWeaver Performance and Availability
SAP NetWeaver Performance and SAP NetWeaver Performance and During the discovery process, the mapping of monitored elements is created, based on your SAP landscape. If you have both J2EE and R/3 stacks
A Perfect CRIME? TIME Will Tell. Tal Be ery, Imperva
A Perfect CRIME? TIME Will Tell Tal Be ery, Imperva Presenter: Tal Be ery, CISSP Web Security Research Team Leader at Imperva Holds MSc & BSc degree in CS/EE from TAU 10+ years of experience in IS domain
Host Identity Sources
The following topics provide information on host identity sources: Overview: Host Data Collection, on page 1 Determining Which Host Operating Systems the System Can Detect, on page 2 Identifying Host Operating
A Surfeit of SSH Cipher Suites
A Surfeit of SSH Cipher Suites Jean Paul Degabriele Information Security Group www.isg.rhul.ac.uk/~psai074 Based in part on slides by Kenny Paterson Outline of this talk Overview of SSH and related work
Security Concerns in Automotive Systems. James Martin
Security Concerns in Automotive Systems James Martin Main Questions 1. What sort of security vulnerabilities do modern cars face today? 2. To what extent are external attacks possible and practical? Background
IPSec. Overview. Overview. Levente Buttyán
IPSec - brief overview - security associations (SAs) - Authentication Header (AH) protocol - Encapsulated Security Payload () protocol - combining SAs (examples) Overview Overview IPSec is an Internet
MBFuzzer - MITM Fuzzing for Mobile Applications
MBFuzzer - MITM Fuzzing for Mobile Applications Fatih Özavcı Mentor of MBFuzer @ yakindanegitim.org fatih.ozavci at gamasec.net gamasec.net/fozavci Scope Yakindan Egitim Project Security Vulnerabilities
EAS- SEC: Framework for Securing Enterprise Business Applica;ons
Invest in security to secure investments EAS- SEC: Framework for Securing Enterprise Business Applica;ons Alexander Polyakov CTO ERPScan About ERPScan The only 360- degree SAP Security solu8on - ERPScan
Lecture 6. Internet Security: How the Internet works and some basic vulnerabilities. Thursday 19/11/2015
Lecture 6 Internet Security: How the Internet works and some basic vulnerabilities Thursday 19/11/2015 Agenda Internet Infrastructure: Review Basic Security Problems Security Issues in Routing Internet
12 th January MWR InfoSecurity Security Advisory. WebSphere MQ xcsgetmem Heap Overflow Vulnerability. Contents
Contents MWR InfoSecurity Security Advisory WebSphere MQ xcsgetmem Heap Overflow Vulnerability 12 th January 2009 2009-01-05 Page 1 of 9 Contents Contents 1 Detailed Vulnerability Description...5 1.1 Introduction...5
Securing Wireless Networks by By Joe Klemencic Mon. Apr
http://www.cymru.com/ Securing Wireless Networks by By Joe Klemencic (faz@home.com) Mon. Apr 30 2001 Many companies make attempts to embrace new technologies, but unfortunately, many of these new technologies
Host Website from Home Anonymously
Abstract Host Website from Home Anonymously Prerna Mahajan 1 and Kashish Gupta 2 1 Professor, Department of Computer Science, IITM Janakpuri, New Delhi, India 2 Research Scholar, Department of Computer
Memcached DDoS Vulnerability Proof-of-Concept for Memory Injection and Mass Exploitation
Memcached DDoS Vulnerability Proof-of-Concept for Memory Injection and Mass Exploitation Author: Amir Khashayar Mohammadi Twitter: @037 Blog: spuz.me Table of Contents; 1. Abstract 2. Background 3. UDP
When Hardware Attacks. Marc Witteman
When Hardware Attacks scale Marc Witteman Croatian Summer school 2017 Attack exploitation space: time vs distance Remote software protocol key brute force Fast relay attack mitm side channel Slow Hardware
Change and Transport Management
Armin Kösegi, Rainer Nerding SAP Change and Transport Management Bonn Boston Contents at a Glance Part I The Big Picture 1 SAP ERP Architecture and Data Components... 31 2 Realizing Business Processes
Solutions Business Manager Web Application Security Assessment
White Paper Solutions Business Manager Solutions Business Manager 11.3.1 Web Application Security Assessment Table of Contents Micro Focus Takes Security Seriously... 1 Solutions Business Manager Security
Web Application Penetration Testing
Web Application Penetration Testing COURSE BROCHURE & SYLLABUS Course Overview Web Application penetration Testing (WAPT) is the Security testing techniques for vulnerabilities or security holes in corporate
The SAP Internet Programming Model, Part 1
The SAP Internet Programming Model, Part 1 Since the first SAP ITS-enabled R/3 release (R/3 3.1G), the number of standard Internet Applications Components (IACs) provided by SAP has constantly increased.
Module 1: Penetration Testing Planning and Scoping. Module 2: Basic Usage of Linux and its services
Following topics will be covered: Module 1: Penetration Testing Planning and Scoping - Types of penetration testing and ethical hacking projects - Penetration testing methodology - Limitations and benefits
RiskSense Attack Surface Validation for Web Applications
RiskSense Attack Surface Validation for Web Applications 2018 RiskSense, Inc. Keeping Pace with Digital Business No Excuses for Not Finding Risk Exposure We needed a faster way of getting a risk assessment
MikroTik Security : The Forgotten Things
Michael Takeuchi, MTC(ALL)E, CEH MikroTik Security : The Forgotten Things 21 January 2019, Phnom Penh MikroTik User Meeting Cambodia MikroTik Certified Engineer (ALL) (MTCNA, MTCRE, MTCINE, MTCWE, MTCUME,
Chapter 9. Firewalls
Chapter 9 Firewalls The Need For Firewalls Internet connectivity is essential Effective means of protecting LANs Inserted between the premises network and the Internet to establish a controlled link however
Infecting the Embedded Supply Chain
SESSION ID: PDAC-F01 Infecting the Embedded Supply Chain Zach Miller Security Researcher in8 Solutions (Formerly Somerset Recon) @bit_twidd1er Inspiration Inspiration Countless embedded devices exist Each
SAP ABAP Training Course Content :
SAP ABAP Training Course Content : Topics Covered: Introduction to ERP Introduction to SAP & R/3 Architecture Introduction to ABAP/4 What is ABAP? Logon to SAP Environment Transaction Codes Multitasking
SAP Certified Technology Associate - System Administration (SAP HANA) with SAP NetWeaver 7.5
SAP EDUCATION SAMPLE QUESTIONS: C_TADM55_75 SAP Certified Technology Associate - System Administration (SAP HANA) with SAP NetWeaver 7.5 Disclaimer: These sample questions are for self-evaluation purposes
ETHICAL HACKING & COMPUTER FORENSIC SECURITY
ETHICAL HACKING & COMPUTER FORENSIC SECURITY Course Description From forensic computing to network security, the course covers a wide range of subjects. You will learn about web hacking, password cracking,
COMPUTER NETWORK SECURITY
COMPUTER NETWORK SECURITY Prof. Dr. Hasan Hüseyin BALIK (9 th Week) 9. Firewalls and Intrusion Prevention Systems 9.Outline The Need for Firewalls Firewall Characterictics and Access Policy Type of Firewalls
Engineering Your Software For Attack
Engineering Your Software For Attack Robert A. Martin Senior Principal Engineer Cyber Security Center Center for National Security The MITRE Corporation 2013 The MITRE Corporation. All rights reserved.
In-Memory Fuzzing in JAVA
Your texte here. In-Memory Fuzzing in JAVA 2012.12.17 Xavier ROUSSEL Summary I. What is Fuzzing? Your texte here. Introduction Fuzzing process Targets Inputs vectors Data generation Target monitoring Advantages
Computer Networks Security: intro. CS Computer Systems Security
Computer Networks Security: intro CS 166 - Computer Systems Security A very easy network 3/14/16 Computer Networks: Intro 2 Two philosophers example Translator Language Translator Engineer Communication
Specialized Security Services, Inc. REDUCE RISK WITH CONFIDENCE. s3security.com
Specialized Security Services, Inc. REDUCE RISK WITH CONFIDENCE s3security.com Security Professional Services S3 offers security services through its Security Professional Services (SPS) group, the security-consulting
Exam4Free. Free valid exam questions and answers for certification exam prep
Exam4Free http://www.exam4free.com Free valid exam questions and answers for certification exam prep Exam : MA0-150 Title : McAfee Certified Assessment Specialist- UH Vendors : McAfee Version : DEMO Get
Lab Exercise Protocol Layers
Lab Exercise Protocol Layers Objective To learn how protocols and layering are represented in packets. They are key concepts for structuring networks that are covered in 1.3 and 1.4 of your text. Review
Scan Report Executive Summary. Part 2. Component Compliance Summary IP Address :
Scan Report Executive Summary Part 1. Scan Information Scan Customer Company: Date scan was completed: Vin65 ASV Company: Comodo CA Limited 03/18/2015 Scan expiration date: 06/16/2015 Part 2. Component
HP 2012 Cyber Security Risk Report Overview
HP 2012 Cyber Security Risk Report Overview September 2013 Paras Shah Software Security Assurance - Canada Copyright 2012 Hewlett-Packard Development Company, L.P. The information contained herein is subject
Release Notes for Epilog for Windows Release Notes for Epilog for Windows v1.7/v1.8
Release Notes for Epilog for Windows v1.7/v1.8 About this document InterSect Alliance International Pty Ltd Page 1 of 29 This document provides release notes for Snare Enterprise Epilog for Windows release