Download as PDF, PPTX
Uploaded bySensePost
Enterprise portals, gate to the gold
The document discusses enterprise portals, which integrate information, people, and processes, and are popular for application deployment due to their frameworks and functionality. It covers various enterprise portal vendors, portlet components, and common shortcomings related to security and access issues. The content also highlights potential attacks on portals and tools for scanning and exploiting vulnerabilities within them.
More Related Content
Similar to Enterprise portals, gate to the gold
Enterprise portals, gate to the gold
- 1. Enterprise Portals Gate tothe Gold
- 2. `whoami` • SensePost – Specialist Security firm based in Pretoria – Customers all over the globe – Talks / Papers / Books • ian@sensepost.com – Associate security analyst – I break stuff and write reports about breaking stuff • Why this talk?
- 3. EP Vendors • IBMWebSphere Portal • SAP NetWeaver Portal • Oracle Portal Products (PlumTree, BEA, SUN, ∞) • OpenText Portal (Formerly Vignette) • JBoss Portal • Microsoft SharePoint Server • Apache Jetspeed, Interwoven TeamPortal, …, ∞
- 4. EP Overview • Frequenton intranets. • Also frequent on the Internet… :) • Framework for integrating information, people and processes** • Consolidate and summarise diverse sources of information • Provide customisable home-page for registered users **
- 5. EP Overview • Popularplatform for deployment of applications due to framework and built-in functionality • Provide SDK’s for customisation and deployment of custom applications • Support pluggable components called portlets • Generally J2EE-based, but there are some alternate platforms (i.e.: .NET, PHP, ∞)
- 6. Portlet Overview • Pluggable user interface components which are managed and displayed in a portal** • Fragments of markup code (i.e: HTML / XML etc) which are aggregated in a portal page** • Adhere to various standards – WSRP (web services for remote portlets) – Java Portlet Specification GET /moo?portlet=id&URI=http%3A%2F%2FHR%2Fbaa • JSR168 HTTP 200 OK • JSR268 • Proprietary **
- 7. Functionality++ • User Registration • Portals are generally designed to share information – provide functionality for searching documents, users, ..., ∞ • Workflow components • Messaging / Social networking • Configuration and administrative components
- 8. Common Shortcomings • Generallycater for multiple portal applications – May expose intranet applications to the Internet • Frequently allow registration for public users – Functionality++ • Due to complex installation of J2EE application servers and lazy sys-admins, frequently run with elevated privileges
- 9. Common Shortcomings • Diverselog-in capabilities – LDAP, XML, Database, ..., ∞, * == SSO • Developers of custom applications deployed on portal platforms frequently have not considered the underlying functionality of the platform • Custom error pages defined for platform • Complexity++
- 10. Breaking Out • Customapplications frequently exploit functionality of portal framework but don’t allow users direct access to framework functions… • … or do they ?
- 11. Breaking Out • Directobject access • Google is your friend… :> • Forcing errors to display generic portal error messages • Accessing site-registration • HTML source comments and JavaScript • Once we can break out of the custom application, we expose the full functionality of the portal…
- 12. Finding Portals • GoogleHacks (nods at Johnny Long…) • site:, insite:, inurl:, …, ∞ • Demo… – site:za – inurl:/portal/site – inurl:/template.REGISTER
- 13. Abusing Portlets • OriginalAdvisory pertaining to IBM WebSphere – WebSphere – 2006/01/24 – EPAM Systems • Port Scanning • Accessing protected resources • Attacks at third parties • Blended Attack Scenarios – Denial Of Service – Brute-Force – Attacks against other protocols
- 14. PortletSuite.tgz • PortletScan.py – Scan for open ports by abusing portlets • Pikto.py – Scan for common virtual directory names and web server misconfigurations • PorProx.py – Provides proxy server functionality tunnelling HTTP requests through remote portlets
- 15. PortletSuite.tgz • http://www.sensepost.com/blog • Demo… – Breaking out – Portlet-scanning – Pikto – Accessing protected resources – PortletProx
- 16.