BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//cfp.hackfest.ca//hf2023//speaker//Q9EHAP
BEGIN:VTIMEZONE
TZID:EST
BEGIN:STANDARD
DTSTART:20001029T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10;UNTIL=20061029T070000Z
TZNAME:EST
TZOFFSETFROM:-0400
TZOFFSETTO:-0500
END:STANDARD
BEGIN:STANDARD
DTSTART:20071104T030000
RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=11
TZNAME:EST
TZOFFSETFROM:-0400
TZOFFSETTO:-0500
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000402T030000
RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=4;UNTIL=20060402T080000Z
TZNAME:EDT
TZOFFSETFROM:-0500
TZOFFSETTO:-0400
END:DAYLIGHT
BEGIN:DAYLIGHT
DTSTART:20070311T030000
RRULE:FREQ=YEARLY;BYDAY=2SU;BYMONTH=3
TZNAME:EDT
TZOFFSETFROM:-0500
TZOFFSETTO:-0400
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-hf2023-Q9MVYT@cfp.hackfest.ca
DTSTART;TZID=EST:20231013T090000
DTEND;TZID=EST:20231013T095000
DESCRIPTION:Applications use secret servers to store the credentials requir
 ed for their day-to-day operations. Their usage increases as businesses im
 prove application security and follow best practices. When permissions giv
 en to an application are too broad\, the secret server becomes a central p
 oint of failure that can represent a new kind of weak link for an organiza
 tion. It may be used as a stepping stone to further compromise the network
 .\n\nAs an attacker\, when you compromise an application that can access a
  secret server and leak its credentials\, the next logical step is to remo
 tely access the secrets contained in the secret server. However\, it can b
 e tedious to thoroughly abuse secret servers within the duration of a secu
 rity assessment. Even more so when credentials obtained in the secret serv
 er can connect to the secret server themselves\, and recursivity comes int
 o play. Recursive extraction of credentials is useful to get the full pote
 ntial out of your obtained accesses. A tool to tackle the issue will be re
 leased and detailed.
DTSTAMP:20260815T123924Z
LOCATION:Track #1
SUMMARY:Weaponizing and auditing secret servers for further compromise - Si
 mon Lacasse
URL:https://cfp.hackfest.ca/hf2023/talk/Q9MVYT/
END:VEVENT
END:VCALENDAR