2013.zeronights.ru

2013 Zeronights Ru-ppt Download

  • Date:17 Sep 2020
  • Views:4
  • Downloads:0
  • Size:4.93 MB

Share Presentation : 2013 Zeronights Ru

Download and Preview : 2013 Zeronights Ru

Report CopyRight/DMCA Form For : 2013 Zeronights Ru


Transcription:

Invest in securityto secure investmentsBI hacking Breaking ICCubeDmitry Chastukhin Director of SAP pentest research team Dmitry chipik Chastuhin.
Yet another securityresearcherBusiness applicationsecurity expert .
OLAP Big Dataerpscan com ERPScan invest in security to secure investments 3 WTH is OLAP Online analytical processing OLAP is an approach to.
formulate and answer multidimensional queries to large OLAP technologies developed by many software giantssince the 199x Business intelligence BI is a methodology that helpsmanagers in the analysis of information inside and.
outside the company OLAP is all about BI and Big Data erpscan com ERPScan invest in security to secure investments 4 Usage areasa Government.
Dat EnergyHealthcareAdvertisingerpscan com ERPScan invest in security to secure investments 5 Main players of OLAP industry.
erpscan com ERPScan invest in security to secure investments 6 Google dorkMany of these servers can be accessed directlyfrom the Web here are some dorks Service Dork.
Pentaho Business Analytics inurl mondrian testpage jspXMLA interface inurl pentaho testpage jspPentaho Business Analytics intitle Pentaho User Console ISAPI MS Analysis Services inurl msmdpump dllSAP NetWeawer inurl sap bc bsp.
Oracle EssBase intitle Hyperion System 9 inurl asperpscan com ERPScan invest in security to secure investments 7 A Quick Glance And here they are erpscan com ERPScan invest in security to secure investments 8.
A quick glance erpscan com ERPScan invest in security to secure investments 9 Basic entitiesSimple table CountryProduct Cities Supplier.
What if we need to get totals by countries andsuppliers vs cities Can we really do it in 2D erpscan com ERPScan invest in security to secure investments 10 So what We re in N dimensions .
erpscan com ERPScan invest in security to secure investments 11 Cube will help erpscan com ERPScan invest in security to secure investments 13 WTH is MDX SQL isn t convenient to access Big Data .
MDX MultiDimension eXpressions comes toreplace it MDX looks like SQL but it s not SQL usually you can t modify data MDX is much stricter than SQL.
erpscan com ERPScan invest in security to secure investments 14 MDX query form WITH SELECT WITH clause SELECT WITH clause n SELECT query axis clause .
SELECT query axis clause n FROM SELECT subcube clause SELECT slicer axis clause SELECT cell property list clause erpscan com ERPScan invest in security to secure investments 15.
MDX SELECT query sampleMEMBER SelectedMeasure AS Measures Salary SelectedMeasure ON COLUMNS Employee Department Departmen... .
Marketing Gender Gender M WHERE Store Store AllMembers erpscan com ERPScan invest in security to secure investments 16 MDX ProcessingMDX Data SQL .
Application Dataerpscan com ERPScan invest in security to secure investments 17 Attacks on MDXmdXML attacks good old XXE andmuch more .
MDX injectionsUser defined functions attackserpscan com ERPScan invest in security to secure investments 18 MDX Injectionserpscan com ERPScan invest in security to secure investments 19.
What will help to inject Commentaries single line as in SQL multiline Special functions for dimensions and members.
crawling Parent FirstChild LastChild DefaultMember e t c Subqueries in FROM erpscan com ERPScan invest in security to secure investments 20 Where to inject .
MEMBER SelectedMeasure AS Measures Salary Paid SelectedMeasure ON COLUMNS Employee Department Departmen... Marketing Gender Gender M .
WHERE Store Store AllMembers hereerpscan com ERPScan invest in security to secure investments 21 Types of injectionsPre SELECT You can do everything Partial access to cube data.
In SELECT queries Partial cube info gathering and cross cubeIn WHERE Blind MDXerpscan com ERPScan invest in security to secure investments 22 Pre SELECT injection.
MEMBER SelectedMeasure AS Measures Salary Paid MEMBER Rank AS Rank Employee Employee current... Head Employee Employee members Dimensions count 1 MEMBER HierName AS Dimensions Rank uniquename .
Rank HierName on 0 Head Employee Employee member... Dimensions count 1 on 1 Salary Paid SelectedMeasure rest of query .
erpscan com ERPScan invest in security to secure investments 23 In SELECT injectionMEMBER SelectedMeasure AS Measures Salary Paid SelectedMeasure ON COLUMNS .
Employee Department Departmen... Marketing Gender Gender AllMembers User name User name AllMembers WHERE Store Store AllMembers rest of request erpscan com ERPScan invest in security to secure investments 24.
MDX Tips Tricks 1 Use null on axis to get all or nothingYou can use Dimensions to access cube dimensionsLOOKUPCUBE provides access to another cubeYou can use multiline commentary without closing .
Use DESCENDANTS to get all data about a memberYou can convert to from strings to pass data within queryerpscan com ERPScan invest in security to secure investments 25 Modifying data with MDXNormally you can t modify data with MDX .
MDX was created for data extraction notmodification ALTER CREATE and DROP are used for operationswith measures and temporary sets not forchanging cube data .
But in rare cases you can modify data with UPDATEstatement erpscan com ERPScan invest in security to secure investments 26 MDX Update QuerySimple update query .
UPDATE CUBE Sales SET Geography Geo Europe Measures Amount So if you can control all query AND datamodification in cube is enabled you can modifydata in any cube that you have permissions to.
erpscan com ERPScan invest in security to secure investments 27erpscan com ERPScan invest in security to secure investments 28 User Defined FunctionUser Defined Function UDF these are functionswritten by the user or a third party developer.
which can take and return values in the MDX ProgramID FunctionName Argume... Argument2 erpscan com ERPScan invest in security to secure investments 29 Attack on UDF IcCube OLAP Server.
IcCube OLAP Server Popular OLAP Server Free Has a Community edition Cross platform Java app Windows Linux Has many utilities IDE web reports.
etc erpscan com ERPScan invest in security to secure investments 30 IcCube OLAP Servererpscan com ERPScan invest in security to secure investments 31 IcCube OLAP Server.
erpscan com ERPScan invest in security to secure investments 32 IcCube OLAP Server Of course IcCube used MDX but where Send some request in WebReport and look inerpscan com ERPScan invest in security to secure investments 33.
IcCube OLAP ServerPOST icCube gviaction executeMdx mdx SELECT Measures Cashflow M Measures Cumulative Cashflow M ONCOLUMNS Calendar Calendar Quarter all... ON ROWS FROM SELECT Product Type ProductType Product Type L Fixed Income I Product Type Product Type Product Type L Fixed Income II Product.
Type Product Type Product Type L Saving Account Product Type Product Type Product Type L FixedIncome Derivative I Product Type Product Type Product Type L Fixed Income Derivative II Product Type Product Type Product Type L Other ON 0 Currency Currency Currency L ... Currency Currency Currency L 114 Currency Currency Currency L ... Currency Currency Currency L ... Currency Currency Currency L ... Currency Currency Currency L ... Currency Currency .
Currency L 122 Currency Currency Currency L ... Currency Currency Currency L ... Currency Currency Currency L ... Currency Currency Currency L ... Currency Currency Currency L 118 Currency Currency Currency L ... Currency Currency Currency L ... Currency Currency Currency L ... Currency Currency Currency L ... Currency Currency Currency L 132 Currency Currency Currency L ... Currency Currency Currency L ... ON 1 .
Interest Principal Interest P... Interest Principal Interest P... Principal L 2 Interest Principal Interest P... ON 2 Profit Unit ProfitUnit Profit Unit L1 Profit Unit Profit Unit Profit Unit L1 Corporate Profit Unit Profit Unit ProfitUnit L1 Debt Profit Unit Profit Unit Profit Unit L1 Funding Profit Unit Profit Unit Profit Unit L1 Investments Profit Unit Profit Unit Profit Unit L1 Special Purpose ON 3 FROM.
Cube schema Bank I tqx out jsonerpscan com ERPScan invest in security to secure investments 34 IcCube OLAP Server Try to use user defined functions As we remember icCube is a Java application.
Let s try JAVA functionserpscan com ERPScan invest in security to secure investments 35 IcCube OLAP Servererpscan com ERPScan invest in security to secure investments 36 IcCube OLAP Server.
Probably we can call public static JAVA functions J System getProperty user dir erpscan com ERPScan invest in security to secure investments 37 IcCube OLAP Server IcCube developers restrict access from user defined functions to.
dangerous JAVA functions From MDX we can use some JAVA classes like Math and if you need JAVA classes from JAR that are not availablewith icCube simply add them to the icCube install lib directory c www iccube com.
erpscan com ERPScan invest in security to secure investments 38 IcCube OLAP Server icCube install lib directory containsa lot of interesting jar files with interestingfunctions which we can call.
For example org apache commons io FileUtils readFileToString FIL... file from commons io 1 4 jarerpscan com ERPScan invest in security to secure investments 39 UDF IcCube OLAP Server.
Let s try to read file c 111 txt from server whichcontains text hello MDX For input we can use error messages J org apache commons io FileUt... Final MDX request.
SELECT StrToTuple J org apache commons io FileUtil... File c 111 txt ON COLUMNS FROM Sales erpscan com ERPScan invest in security to secure investments 40 UDF IcCube OLAP Server.
erpscan com ERPScan invest in security to secure investments 41 UDF IcCube OLAP Server But if the file contains special charsets or evenwhitespaces MDX parser won t return their For example if we try to read the file hello MDX.
blabla we will get this error syntax error unexpected statement blabla REGULAR IDENTIFIER erpscan com ERPScan invest in security to secure investments 42 UDF IcCube OLAP Server.
Ok Just encode the file content Base64 for We found a method org apache commons codec binar... binaryData in the file commons codec 1 6 jar tried it and got the error .
syntax error unexpected statement EQ erpscan com ERPScan invest in security to secure investments 43 UDF IcCube OLAP Server Hmm probably the Base64 string contained an EQ sequence which means equivalent .
Ok encoded the file content twice and got the error syntax error missing expression following erpscan com ERPScan invest in security to secure investments 44 UDF IcCube OLAP Server.
oh the symbol is often found in the Base64 to resolve this problem just concatenate theBase64 string which contains with one letterWhen MDX parser works it drops and allsymbols after that But is always at the end of.
Base64 we can still decode it erpscan com ERPScan invest in security to secure investments 45 UDF IcCube OLAP Server Final user defined function call StrToTuple J .
org apache commons codec binar... org apache commons codec binar... org apache commons io FileUtil... 111 txt s erpscan com ERPScan invest in security to secure investments 46.
UDF IcCube OLAP ServerDecode WVVkV2MySkhPV1pVVlZKWlNVZEtjMW... WTH is OLAP? Online analytical processing (OLAP) is an approach to formulate and answer multidimensional queries to . large. datasets. OLAP technologies developed by many software

Related Presentations

 Zeronights 2017

Gemalto License tokens in a nutshell . Gemalto’s USB License tokens. Hardware. Software. USB token itself. Driver. Web. Service. Binaries. Other stuff. Gemalto License tokens behavior. Plug-in USB . PC with internet access. Downloads driver. Installation. Opens port 1947. Adds to firewall whitelist . Manual driver download. Installation ...

0 Views0 Downloads

 ZeroNights

Web server . WebLogic /WebSphere. PS Servlets. Forwards request from a browser to an App Server. Application server . PS Services +Tuxedo + Jolt . Business logic, SQL transaction management, Transport. Database server. SystemTables, PeopleToolsmetadata, PeopleSoftapplicationdata. erpscan.com. ERPScan — invest in security to secure investments

0 Views0 Downloads

2013 CSTE Conference Pasadena CAJune 10th 2013

2013 CSTE Conference, Pasadena, CAJune 10th, 2013. Topic: Prevalence of chronic diseases among excessive alcohol drinkers ... Coordinates the development of grant applications and is responsible for the implementation and monitoring of epidemiology team work plan activities. ... Planning, Analytic Knowledge, Communication, Basic Public Health ...

13 Views0 Downloads

update vennootschapsbelasting Aj 2013 mei 2013

Zie Lexfin, commentaar Vennootschapsbelasting > DEEL 2 Inkomsten en kosten > HOOFDSTUK 3 Beroepskosten > 10 Bezoldigingen van het personeel > 10.2 Sociale lasten > 10.2.1 Werkgeversbijdrage 30.000 EUR drempel geldt per vennootschap en per WN/BL Bijdrage wordt berekend o.b.v. premies van het voorgaande jaar externalisatie van de interne ...

20 Views0 Downloads

2013 NFPA ANNUAL CONVENTION OCTOBER 3 6 2013 HARTFORD

2012 NFPA Membership Survey: the Results Are in! 34% decrease of respondents to 2012 NFPA Membership Survey (370 respondents – some did not respond to all questions) 77% of respondents agreed NFPA provided resources they expected from a professional organization . 81% of respondents provided ideas of what NFPA did well in 2012

9 Views0 Downloads

New Manager Meeting 2013 New York State Education Department

If a student has been identified as living in the same household as a student directly certified, the SFA should keep the enrollment records on file for that student and provide free meal benefits without further application. ... Room 375 EBA. Albany, NY . 12234. 518-473-8781. August 2015. Author: Administrator Created Date: 06/11/2013 08:47:01 ...

26 Views0 Downloads

Bookkeeping Workshop 2013

Uniform regardless of the bank card or credit card used. 11/5//2013. Held at Indiana State Library November 6 and repeated November 19, 2013 ... Library Board resolution to establish cash on hand for change. ... Resolution and Letter to State Board of Accounts.

22 Views0 Downloads

NON POLICY MATTERS SEPTEMBER DECEMBER 2013

issued Resolution No. 052-12 ratifying said contract. The Notice to Proceed was thereafter issued on 22 February 2012. The NHCP, in a letter dated 20 February 2012, asked the Provincial Government to stop the demolition of the side wings of the Provincial Capitol Building and preserve the neo-classic edifice.

24 Views0 Downloads

Tri West Hendricks High School Class of 2013

Introduction To Engineering (9-12) Principles of Engineering. Civil Engineering & Architecture. Digital Electronics. Computer Science A. Spanish III . Spanish IV . Honors Algebra II (MATH 136) Pre-Calculus (MATH 137) AP Biology I (Trine University only) ($80) Senior IVY Tech Courses ($155/course) Most Area 31 Courses. Must pass Accuplacer Test

21 Views0 Downloads

6th Grade Athletic Orientation Program June 3 2013

723 students (7th – 12th grade) participate on our 46 interscholastic teams over three seasons. 2015 - 2016: our teams won 7 divisional titles, 4 league and 2 section championships. Girls’ Soccer – won 5th consecutive Section 9 championship. Girls’ Tennis – won 5th consecutive league championship

25 Views0 Downloads

2013 OALM template draft NIH Supply Center

The IC representatives play a key role in our Supply Chain Due Diligence.The Service Representative acts as the liaison between prescribers, patients, and pharmacy operations in order to maintain and cultivate business in support of the Supply Center. Supporting by soliciting feedback on new initiatives, surveys, disseminating new product information, the IC Representative promotes Supply ...

21 Views0 Downloads

Collaborators 2013 Present

DSE prediction for mass of the quark core of the nucleon’s first radial excitation = 1.73 GeV. CLAS: 2-4 Nov. 2016 (50p) Craig Roberts. CLAS & Continuum QCD . Agreement between two completely unrelated approaches to the same problem is very unlikely to be an accident. H. Kamano , S.X. Nakamura, T. -S. H. Lee , T. Sato, Phys.Rev. C . 88 (2013 ...

16 Views0 Downloads