Langue: English
SQL injection is dead. Local file inclusion is a relic. And that PDF generator surely can’t be used to pivot into an internal network… right?
Well, think again.
In this presentation, we will explore web application exploits that (surprisingly) still let me in. The kind that have great impact, that should have disappeared years ago, yet still show up in real-world engagements. Well, if you can get them to work. They might be buried in business logic or something else.
This is what you will get from this presentation; that with a bit of wit and know how, you can turn a seemingly not exploitable vulnerability into a critical finding, even those that should not be out there anymore.
Oh, and this is not just a theoretical talk, there will be demos, and there will be code analysis.
Intro
Exploit 1: SQL Injection into Command Injection (Not How you Think)
https://n1h1lu5.com/2024/11/exploit-chronicles-sql-injection-into-command-injection/
Exploit 2: Json.NET Auto TypeNameHandling Deserialization Exploit
Exploit 3.1: Payload Length Limitation Bypass: Local File Inclusion Through Logs
https://n1h1lu5.com/2024/05/exploit-chronicles-local-file-inclusion-through-logs-with-a-catch/
Exploit 3.2: Payload Length Limitation Bypass: SQL Injection
To be created.
What happens if you have a SQL injection, but you are greatly limited in your payload length. How can you bypass that?
Exploit 5.1: When Base64 Goes Wrong: IDOR and Server-Side Parameter Injection
To be created.
You have found a base64 encoded value, and in it is an ID. You achieve an IDOR, great. But can you do more? Could you make the backend return user data?
Exploit 5.2: When Base64 Goes Wrong: SSRF with PDF Generator
To be created.
This is the gift that keeps on giving.
Exploit 6: Vulnerable File Upload, but you only control the extension
To be created.
The upload file is outside the website (meaning, it is not served), and you only have control over the file extension. Can you achieve a web shell?
Outro
We will hammer down on the fact that imagination, critical thinking, and wit is key when it comes to pushing exploits for maximum impact. Because in the end, if there is no impact, there is little reasons for people to fix it.
Note: Each exploit presentation should be 6-7 minutes long. Maybe some will take more and other less, but that would be the core of the presentation. We will also cover the mitigations for each one.
I am a Principal Security Analyst (Offensive Security) at iA Financial Group where I conduct penetration tests, purple team engagements, etc.
I have about 10 years of experience in cyber security. I started my career as a software developer, pivoted to application security, and finally ended up in offensive security.