This document introduces IronSAP, an open source SAP security scanner being developed to automate testing SAP systems for vulnerabilities. It describes several vulnerabilities IronSAP aims to detect, such as revealing sensitive information from error messages, discovering and testing ICF services, bypassing authentication via HTTP header tampering, and remotely managing users without authentication on the SAP management console. The goal is for IronSAP to simplify security testing of SAP systems for penetration testers unfamiliar with SAP.

1. IronSAP

2. Who Am i
Prasanna Kanagasabai
Work @ MNC in Bangalore India
Pen tester in the DAY, Programmer by NIGHT
@prasannain

3. Scenario
My BOSS wants me to test our internal SAP servers and report
findings…
PROBLEM
I have never seen a SAP system
I have no knowledge of SAP vulnerabilities
Were is the documents available
People who deploy and maintain SAP have poor knowledge of
security

4. Solution
Download documents on SAP from various sites.
Understand the architecture
Understand SAP security vulnerabilities
Test each vulnerabilities manually
Try some of the Open Source SAP testing tools:
1. Bizsploit (http://www.onapsis.com/research-free-solutions.php)
2. Metasploit Modules (http://labs.mwrinfosecurity.com/blog/2012/04/27/mwr-sap-metasploit-
modules/)
3. ERPScan's SAP Pentesting Tool (http://erpscan.com/products/erpscan-pentesting-tool/)
Buy and run a commercial SAP security scanner

5. This was case till today

6. Fortunately it changes tomorrow
Introducing "IronSAP"
Open Source SAP Security Scanner

7. Identification via banner
Server Header could provide information what
the underlying infrastructure is hosted on
“Server: SAP J2EE Engine/7.00”
Sap systems are no different
IronWASP has a passive plug-in that
automatically picks these and raises it as a
finding

8. Error Messages
SAP Error messages could revel a big deal of critical
information.
“Errorcode: ICF-NF-http-XXXX_EAZ_00-…………”
XXXX -- > Hostname
EAZ -- > SAPSID
00 -- > System Number
IronSAP can detect this information, it will raise a
finding with the pages and critical information found

9. ICF
There are 1500 ICF services that are shipped
They behave like any normal server side pages
do.
They receive web input, process, and output the
results
Services are divided into
Public Services
Private Services

10. ICF
Public services are responded without any
authentication
Private services can request authentication as
configured…
Most services require authentication

11. ICF & IronSAP
IronSAP can find all the services that respond to
a request. (200 OK)
If the response was 200 it continues to check If it
is a login page or has some interesting content
If login is Basic authentication it launches a brute
force attack.
Automatically checks all HTTP(s) ports and finds
interesting pages.

12. ICF - Info Service
A dangerous Public ICF service
Found @ /sap/public/info
Returns SAP internal information as a XML
ironSAP: Icf Finger printer scans and finds the
info service and raises a finding in the system.

13. ICF 2 – SOAP RFC
RFC is a protocol to call ABAP programs
Not available on the internet
ICF service allows access to the underlying RFC
If enabled the malicious user can run RFC
programs as present in the local network
IronSAP: fingerprint finds presence of this ICF
service and raises the finding.

14. Admin Pages
SAP has web administration page that has in store real time information on
SAP infrastructure.
Can be found without authentication
IronSAP: fingerprint finds presence of this ICF service and raises the finding

15. Verb Tampering
Web.xml defines if a request should challenge a
with a authentication for a given HTTP method
A faulty implementation can allow a user to
bypass the authentication.
IronSAP: attempts to access the resource using
“HEAD” for all requests that challenged with a
request, records positive outcome.

16. REMOTE_USER
SAP EP can use web access manger for
authentication
The user contacts the WAM with his credentials
The WAM verifies his identity
The WAM forwards the user to the SAP EP with a HTTP header
with the username of the successful logged in user
EP checks its database if the user exists
EP sets the SSO logged in cookie

17. REMOTE_USER
The problem is if a request is sent to the SAP EP
with the correct header a user could be logged
in without having credentials.
IronSAP: on finding a portal login it would try to
login to the system with different users in
REMOTE_USER header.

18. SAP Start Service
SAP management Console found on the SAP
system on port 5<instance id>13/14
Installed by Default
Remote management of users
Information Disclosure
No or basic Authentication
IronSAP: Queries this web service and retrieves
the information from the SAP system and
raises the finding

19. Next For IronSAP
Database Security
RFC
SAP Client attacks
SAP Transactions
Passwords
ABAP

20. Thank You
IronSAP automates the process discovery of the
SAP attacks found by the following researchers:
Mariano Nuñez DiCroce
Chris John Riley
Alexander Polyakov
Dave Hartley
I would also like to thank:
Lavakumar (Author of IronWASP)
Pavan Kumar (I bugged him nearly every night for information on SAP)
Garrage4Hackers (I got a lot of resources from here)

22. Prasanna Kanagasabai
Prasanna.in@gmail.com
@prasannain