Guillaume Croteau
I am a Principal Security Analyst (Offensive Security) at iA Financial Group where I conduct penetration tests, purple team engagements, etc.
I have about 10 years of experience in cyber security. I started my career as a software developer, pivoted to application security, and finally ended up in offensive security.
Session
SQL injection is dead. Local file inclusion is a relic. And that PDF generator surely can’t be used to pivot into an internal network… right?
Well, think again.
In this presentation, we will explore web application exploits that (surprisingly) still let me in. The kind that have great impact, that should have disappeared years ago, yet still show up in real-world engagements. Well, if you can get them to work. They might be buried in business logic or something else.
This is what you will get from this presentation; that with a bit of wit and know how, you can turn a seemingly not exploitable vulnerability into a critical finding, even those that should not be out there anymore.
Oh, and this is not just a theoretical talk, there will be demos, and there will be code analysis.