1
00:00:02,220 --> 00:00:04,320
Enable streamer mode.

2
00:00:05,820 --> 00:00:08,120
Do we want that disabled?

3
00:00:08,280 --> 00:00:10,480
I think you want it enabled, don't you?

4
00:00:15,660 --> 00:00:17,300
That was my assumption.

5
00:00:17,820 --> 00:00:21,440
Alright, well we should be going live.

6
00:00:22,400 --> 00:00:24,300
Now we're live.

7
00:00:24,800 --> 00:00:27,540
Okay, let's push that recording button.

8
00:00:30,700 --> 00:00:32,940
Alright, chat!

9
00:00:32,940 --> 00:00:41,680
If anybody is hanging out watching TrackOne, feel free to start talking in the TrackOne channel on Discord.

10
00:00:41,680 --> 00:00:49,260
You're also welcome to start giving us some questions over in the TrackOne live Q&A channel.

11
00:00:49,260 --> 00:00:56,800
In the meantime, let's introduce our guests for right now.

12
00:00:56,800 --> 00:00:59,480
We have Olek and we have Poontester.

13
00:00:59,480 --> 00:01:04,460
I'm sure you two will come up with better ways to explain how to pronounce your names.

14
00:01:04,480 --> 00:01:06,920
But thank you very much for joining us today.

15
00:01:06,920 --> 00:01:14,520
Give us the name of the talk that you did, and we'll start asking you some silly questions about it.

16
00:01:16,400 --> 00:01:23,800
Okay, so the talk was Room for Escape, Scribbling Outside the Lines of Template Security.

17
00:01:23,800 --> 00:01:38,420
A talk around content management systems, and in particular the template engines used in these systems, and how we were able to break out of the sandboxes that they put in place.

18
00:01:39,020 --> 00:01:46,960
If you have any questions about the talk or anything else, maybe we can help you.

19
00:01:47,660 --> 00:01:49,980
Just feel free to ask anything.

20
00:01:49,980 --> 00:01:52,040
How do you like your handle pronounced?

21
00:01:54,240 --> 00:01:56,160
I pronounce it Poontester.

22
00:01:56,160 --> 00:01:56,640
Poontester?

23
00:01:56,640 --> 00:01:58,000
I don't know if that's better.

24
00:01:58,640 --> 00:02:05,920
I think that we just entered into one of the mighty arguments in the hacker world, if it's Pwn or Pwn.

25
00:02:06,040 --> 00:02:09,740
So we're going to go with Pwn because that sounds a little bit better.

26
00:02:10,980 --> 00:02:14,540
So Olek, go ahead and give your little bit of an intro.

27
00:02:16,000 --> 00:02:16,960
About myself?

28
00:02:17,200 --> 00:02:18,880
Yeah, we'll click over to you.

29
00:02:20,080 --> 00:02:28,040
I'm a security researcher for already more than 10 years, and working for Micro Focus Spotify.

30
00:02:28,620 --> 00:02:40,920
And I'm happy to have a chance to work with Pwntester for a couple of years already, and it's our fourth shared research.

31
00:02:40,920 --> 00:02:47,440
And I'm happy with these results, and I hope to get something similar in the next years.

32
00:02:47,440 --> 00:02:48,720
Absolutely.

33
00:02:48,720 --> 00:02:50,300
I will retire.

34
00:02:51,600 --> 00:02:57,720
Yeah, so that's a good segue, actually, to talk while we're waiting for people to come up with some good questions for you.

35
00:02:57,720 --> 00:02:59,760
Tell us a little bit about some of the...

36
00:03:00,280 --> 00:03:17,540
This is definitely not your first talk here at DEF CON, so just briefly give us some background on where you came from and what the earlier talks were, so that people know how to reach back and find you in the archives.

37
00:03:17,540 --> 00:03:24,660
And then maybe touch on, how does this one feel different than the other talks that you've done?

38
00:03:27,610 --> 00:03:35,890
Okay, so I think the first one that we did together was Friday the 13th, JSON attacks.

39
00:03:36,310 --> 00:03:38,130
No, actually it was...

40
00:03:38,130 --> 00:03:40,970
Sorry, it was JNDI injections.

41
00:03:41,030 --> 00:03:41,770
It was the first one.

42
00:03:41,770 --> 00:03:44,810
Did we present that at DEF CON or just at Black Hat?

43
00:03:44,950 --> 00:03:46,330
Just at Black Hat, you're right.

44
00:03:47,240 --> 00:03:51,870
So the first one that we presented together was the JNDI injection.

45
00:03:51,870 --> 00:03:58,290
I think the full title was something like JNDI injection...

46
00:03:59,330 --> 00:04:01,470
How was that?

47
00:04:01,470 --> 00:04:03,970
Dreamland to RC something.

48
00:04:04,790 --> 00:04:07,750
Yeah, no, like a trip into RC.

49
00:04:07,750 --> 00:04:08,250
I don't know.

50
00:04:08,250 --> 00:04:10,930
I don't remember the title anymore.

51
00:04:10,930 --> 00:04:23,120
That was around JNDI injection in Java world of ecosystems, which was then used for many of the visualization gadgets.

52
00:04:23,630 --> 00:04:26,190
So that was a good one.

53
00:04:26,190 --> 00:04:38,330
And then before that one, I presented at DEF CON, one with Denis Cruz and AFPang, that was called resting in your laurels will get you pwned or pwned.

54
00:04:38,330 --> 00:04:42,030
Yeah, that was a nice one.

55
00:04:42,030 --> 00:04:46,510
So the first one that we did together was this about JNDI injection attacks.

56
00:04:46,510 --> 00:05:00,050
Then the first one that when we presented at DEF CON and we had to drink our shots as newbie speakers was this one about JSON attacks, JSON visualization attacks.

57
00:05:00,050 --> 00:05:00,710
Gotcha.

58
00:05:00,710 --> 00:05:19,390
And then last year we presented SSL Wars, the token menace, where we presented an attack on some implementation in Microsoft stacks that was flowing in .NET framework.

59
00:05:19,830 --> 00:05:25,170
And now this year we repeat again as a team with this one.

60
00:05:26,350 --> 00:05:27,210
Excellent.

61
00:05:27,210 --> 00:05:29,730
We really appreciate that you both came out to do that.

62
00:05:31,070 --> 00:05:40,610
You two, as we're waiting for people to jump in with more questions, you did present me with one that I'm going to sneakily slide in here as if somebody else asked it.

63
00:05:40,610 --> 00:05:47,130
The vulnerabilities that you disclose all seem to require that the attacker have user-level access to the system.

64
00:05:47,130 --> 00:05:48,430
Is that true?

65
00:05:50,190 --> 00:05:51,890
Is that a hurdle for most...

66
00:05:51,890 --> 00:05:53,570
Oh, see, now I'm talking over you.

67
00:05:53,570 --> 00:05:54,850
So your turn, Hugo.

68
00:05:55,970 --> 00:05:58,350
Okay, I think it's mostly true.

69
00:05:58,350 --> 00:06:03,510
It still depends on applications, on configuration, on specific configuration.

70
00:06:03,510 --> 00:06:11,070
But to be able to perform such attacks, attackers should be able to create or at least modify some template.

71
00:06:11,210 --> 00:06:16,250
And in most cases, it's at least user-level account.

72
00:06:16,250 --> 00:06:18,790
For SharePoint, it's just user-level account.

73
00:06:18,790 --> 00:06:21,690
It's default configuration and just user-level account.

74
00:06:21,690 --> 00:06:24,810
Any user in default configuration can do this.

75
00:06:24,810 --> 00:06:28,330
For other applications, it still depends.

76
00:06:28,330 --> 00:06:30,270
Sometimes it's just user-level.

77
00:06:30,270 --> 00:06:36,410
Sometimes you need to be like writer or some other roles, more powerful roles.

78
00:06:36,410 --> 00:06:38,730
Sometimes even administrator.

79
00:06:39,330 --> 00:06:52,370
So one requirement for our attack, attackers should be able to manage these templates or ISPX pages in case of SharePoint.

80
00:06:52,370 --> 00:06:54,330
Okay, so maybe not.

81
00:06:54,330 --> 00:06:58,710
The minimum is just they have to be able to deal with the SharePoint side.

82
00:06:58,710 --> 00:07:00,990
They have to be able to control that.

83
00:07:00,990 --> 00:07:04,350
But it's not necessarily that...

84
00:07:04,350 --> 00:07:13,570
So for SharePoint, it's a bit simpler.

85
00:07:13,570 --> 00:07:18,610
Any user can have access to own private site and can manage it.

86
00:07:18,610 --> 00:07:20,650
It's your site.

87
00:07:20,650 --> 00:07:26,290
And you can use at least this site for performing attacks.

88
00:07:26,290 --> 00:07:28,730
For other applications, yes.

89
00:07:28,730 --> 00:07:38,750
It depends on configuration, depends on permission for specific projects, for specific sub-sites and other things.

90
00:07:38,750 --> 00:07:39,610
Okay.

91
00:07:41,230 --> 00:07:49,670
So I was going to add that our assumption in this talk is that we were able or the attacker were able to control the templates.

92
00:07:49,670 --> 00:07:57,130
And then our research was around breaking outside of those sandboxes.

93
00:07:57,130 --> 00:08:09,930
So in a similar way that we may present something around breaking mitigations for buffer overflows, but our research was not how to find those buffer overflows in the first place.

94
00:08:09,930 --> 00:08:34,170
So I'm saying that because apart from being able to control the contents of the template, different vectors may include things like server-side template injection, or maybe, for example, if there is a cross-site scripting vulnerability in that page, you can use that to fool a victim into submit a malicious template on your behalf.

95
00:08:34,170 --> 00:08:41,910
Or maybe there is a cross-site request for you that you cannot use in order to manipulate or modify the template content.

96
00:08:41,910 --> 00:08:46,510
So we didn't really care about how you were able to get access to the content.

97
00:08:46,510 --> 00:08:58,370
It may be because you have access to, like Alexander explained, it's the normal case, for example, in things like SharePoint or a wiki, for example, where you can edit your own articles and things like that.

98
00:08:58,370 --> 00:09:05,950
But maybe in other systems, some of the ones that we reported, like Office, for example, they were vulnerable to server-side template injection.

99
00:09:06,110 --> 00:09:19,150
And for example, in some cases, we were able to request trial accounts in content management systems that were deployed on the cloud, like in software-as-a-service architectures.

100
00:09:19,150 --> 00:09:26,970
And with those trial accounts, we were able to hone those servers and compromise the underlying servers.

101
00:09:27,230 --> 00:09:39,110
So in a big way, you've given us another step in our chain, another tool to escalate how much damage we can do once we have a foothold.

102
00:09:40,390 --> 00:09:41,650
Yeah, exactly.

103
00:09:41,650 --> 00:09:42,310
Excellent.

104
00:09:42,310 --> 00:09:48,390
What level of access were you using to get that remote code execution?

105
00:09:48,390 --> 00:09:52,510
Were you just a regular user and able to escalate that far?

106
00:09:53,110 --> 00:10:02,970
So in some cases, like Alexander explained for SharePoint, just having an account in SharePoint, like a regular user account, allows you to create your own site.

107
00:10:02,970 --> 00:10:08,130
And then you can control the template or the ASPX page, in this case for SharePoint.

108
00:10:08,130 --> 00:10:12,690
And then you can use that to get remote code execution on the underlying server.

109
00:10:12,790 --> 00:10:16,390
In other cases, like XWiki, just a regular user as well.

110
00:10:16,410 --> 00:10:24,270
Other systems, like for example, Atlassian Confluence, you were required to be administrator in order to edit a template.

111
00:10:24,270 --> 00:10:48,030
So in those systems, either you are an administrator, so it's kind of more like an insider attack, or maybe those systems are vulnerable, as I explained before, you find a cross-site scripting vulnerability, and you can escalate from cross-site scripting to remote code execution by being able to fool the victim to submit or modify a template on your behalf.

112
00:10:50,430 --> 00:10:57,370
Okay , so can you give us a little bit of background on how you came upon this type of research?

113
00:10:57,370 --> 00:11:01,270
What was your entry point into doing this attack?

114
00:11:04,310 --> 00:11:06,790
It's not easy to answer.

115
00:11:06,790 --> 00:11:17,410
It's as usual, when you have some target that allows you something, and you think, wow, it's a lot of things for attackers, and it starts the game.

116
00:11:17,410 --> 00:11:21,250
You try to use one thing to bypass something.

117
00:11:21,250 --> 00:11:26,750
For example, SharePoint, it allows you to upload ASPX pages.

118
00:11:26,750 --> 00:11:33,890
So the first thing, why we cannot put only the code there and execute code there?

119
00:11:33,890 --> 00:11:35,090
No, we cannot.

120
00:11:35,090 --> 00:11:36,010
Why we cannot?

121
00:11:36,010 --> 00:11:38,110
And game starts.

122
00:11:39,630 --> 00:11:42,110
And it's not only SharePoint.

123
00:11:42,110 --> 00:11:53,650
There are a lot of such server or services that allows you to define some templates for dynamic content, and actually you can access getters.

124
00:11:53,650 --> 00:11:55,630
You can access some methods.

125
00:11:55,630 --> 00:11:58,270
You can access some objects.

126
00:11:58,750 --> 00:12:00,430
Why we cannot abuse them?

127
00:12:00,430 --> 00:12:01,270
Let's try.

128
00:12:01,270 --> 00:12:03,200
Let's see what we can do.

129
00:12:03,200 --> 00:12:06,360
What we can do further with all this stuff.

130
00:12:06,420 --> 00:12:13,580
And it starts our research investigation, and at the end, we have such results.

131
00:12:14,360 --> 00:12:16,320
You chained it down.

132
00:12:16,960 --> 00:12:18,220
I'm on mute.

133
00:12:18,220 --> 00:12:19,620
So you pushed it down that direction.

134
00:12:19,620 --> 00:12:20,780
That makes sense.

135
00:12:21,440 --> 00:12:29,200
And I'm assuming then we're kind of talking to a general mindset when you're doing your normal day-to-day work.

136
00:12:29,200 --> 00:12:34,840
You find something that's a little funny, and you just can't let it go.

137
00:12:34,840 --> 00:12:40,020
I mean, this is that greater question about, what does it take to be a hacker?

138
00:12:40,480 --> 00:13:00,100
It's always nice to hear people who are out there in the world doing these presentations, doing this research, talk to the rest of us who are getting our feet wet in the world of web application security or whatever your niche is.

139
00:13:00,100 --> 00:13:08,060
How do the rest of you folks who are getting all of the success, doing these cool presentations and research, how do you approach these?

140
00:13:08,060 --> 00:13:10,180
How do you know when you have something cool?

141
00:13:12,940 --> 00:13:28,960
So in my case, and continuing Alexander's response, I guess that I started this research because Oleg came to me and said, like, okay, I found these four different ways of breaking the server in safe mode.

142
00:13:28,960 --> 00:13:32,760
For that time, I mean, we found a lot of more.

143
00:13:33,380 --> 00:13:46,560
So he said, like, maybe if we also look at the Java side, we get something interesting that can be interesting, like a full research, like something that is more self-contained somehow.

144
00:13:46,580 --> 00:13:52,320
And then he told me, like, can you take a look at some of the most popular engines in Java?

145
00:13:52,320 --> 00:13:55,500
And when I was there, I was like, okay, let's see.

146
00:13:55,500 --> 00:14:04,260
Before I started looking at the implementation of those engines and do, like, code review and things like that, it was like, okay, I'm here.

147
00:14:04,260 --> 00:14:04,880
I get access.

148
00:14:04,880 --> 00:14:07,220
I assume that I get access to a template.

149
00:14:07,220 --> 00:14:08,160
What can I do now?

150
00:14:08,160 --> 00:14:10,160
What objects are available?

151
00:14:10,160 --> 00:14:18,520
So I started looking and inspecting the template context by debugging the applications and setting some breakpoints.

152
00:14:18,520 --> 00:14:27,980
And then I was surprised that I was able to access thousands of objects that were non-intentionally exposed.

153
00:14:27,980 --> 00:14:31,860
They were, like, they're indirectly exposed by other objects.

154
00:14:32,000 --> 00:14:39,480
And with that big amount of attack surface, it was like, this is going to be easy to find something that I can use to get remote code execution.

155
00:14:39,480 --> 00:14:40,580
That was the case.

156
00:14:40,580 --> 00:14:46,540
And then as a second part of the research, we started looking at the implementation of those libraries.

157
00:14:46,540 --> 00:14:51,400
And then we found some specific flaws in the implementation.

158
00:14:51,400 --> 00:15:00,760
The way they were checking block lists, for example, or gaps on those block lists or things like that, that I explained in the talk.

159
00:15:01,000 --> 00:15:03,080
That was your entry.

160
00:15:03,080 --> 00:15:04,920
You , all of a sudden, you're like, I have something.

161
00:15:04,920 --> 00:15:14,640
And then you spent a significant amount of time testing the boundaries of the thing that you had until you worked your way towards where we are now.

162
00:15:14,740 --> 00:15:16,340
That makes sense.

163
00:15:16,340 --> 00:15:22,020
It's always good to hear from you folks, kind of where you're coming from on that.

164
00:15:22,460 --> 00:15:28,520
So I saw a few different content management systems that you looked at.

165
00:15:28,520 --> 00:15:34,060
And I imagine at some point, you just kind of run out of time to keep checking things.

166
00:15:34,060 --> 00:15:42,060
Do you think that there are still more out there that people could follow your techniques and do the same kind of thing to find vulnerabilities?

167
00:15:42,060 --> 00:15:46,940
Is that also going to be an area that you plan to continue to research?

168
00:15:46,940 --> 00:15:48,740
Or are you guys kind of done with this one?

169
00:15:49,980 --> 00:15:52,620
Definitely, there should be a lot of products.

170
00:15:52,620 --> 00:15:55,060
We think there are a lot of products.

171
00:15:55,060 --> 00:16:01,180
As you mentioned, just a couple of them are under our focus.

172
00:16:01,180 --> 00:16:06,480
And actually, for example, if you're talking about SharePoint, it is not an automated approach.

173
00:16:06,480 --> 00:16:09,240
It's just manual and just to find some patterns.

174
00:16:09,240 --> 00:16:13,440
And we try to show this pattern in our presentation.

175
00:16:13,580 --> 00:16:24,220
And I believe there's still a lot of things to look for in SharePoint specifically and about other content, even not content management system.

176
00:16:24,220 --> 00:16:42,680
In any other system, like maybe email servers, if you can define a template for dynamic content for some auto-creation emails, it can be a starting point for your research as well.

177
00:16:42,680 --> 00:17:01,920
So our purpose of our research, our presentation, just show our patterns, our approaches and say, hey guys, we use this and we got such results, like 30 new vulnerabilities.

178
00:17:02,080 --> 00:17:03,900
You can use the same.

179
00:17:03,900 --> 00:17:05,820
It's not only for offensive side.

180
00:17:05,820 --> 00:17:08,180
It's for defensive as well.

181
00:17:08,180 --> 00:17:26,660
Guys, if you are developing something that go in this bucket, you need to look on these areas to check this because you can see what can happen.

182
00:17:26,820 --> 00:17:31,520
So, of course, anybody welcome to continue this research.

183
00:17:31,520 --> 00:17:34,400
About myself, I'm not sure.

184
00:17:34,400 --> 00:17:40,220
I need to have some rest, vacation, couple months after that, maybe.

185
00:17:40,220 --> 00:17:45,780
But usually, if you can see our talks, they are not linear.

186
00:17:45,860 --> 00:17:48,600
We are jumping from one topic to another topic.

187
00:17:48,600 --> 00:17:51,220
It's more interesting for me.

188
00:17:51,220 --> 00:17:53,820
But I do not know, maybe.

189
00:17:54,060 --> 00:17:58,140
If I still find something interesting, I will continue.

190
00:17:58,140 --> 00:18:04,220
But for the next year, to be honest, it will be more difficult because competition will be more higher.

191
00:18:04,220 --> 00:18:10,460
Maybe it's better to leave this for others and try to find some new areas.

192
00:18:11,620 --> 00:18:22,320
Based on all the different presentations that you two described earlier, it seems like you two work together really well in finding these types of things.

193
00:18:22,320 --> 00:18:30,700
I know some people earlier were asking, how should somebody go about starting out research and picking out targets?

194
00:18:30,700 --> 00:18:40,840
Do you have any suggestions for people on how they can start getting into the type of research field that you two seem to do really well?

195
00:18:43,080 --> 00:18:47,900
I don't think that one is easy to answer.

196
00:18:49,020 --> 00:18:59,680
It's just like, at least for me, being up to date with the latest research from other people in the community and industry.

197
00:18:59,680 --> 00:19:04,660
Or maybe reading articles that are not directly related with what you do.

198
00:19:04,660 --> 00:19:16,440
For example, I think that the JNDI injection that was the first one that we did together started out of reading an article about a malware analysis.

199
00:19:16,720 --> 00:19:21,800
And in that malware analysis, the malware was using some JNDI lookups.

200
00:19:21,800 --> 00:19:22,980
We found that interesting.

201
00:19:22,980 --> 00:19:24,900
We started researching that.

202
00:19:24,940 --> 00:19:28,020
And that led to the JNDI injection attack.

203
00:19:28,020 --> 00:19:37,060
As part of that attack, we found some gadgets that were using setters instead of magic methods in Java deserialization and so on.

204
00:19:37,060 --> 00:19:43,320
And we found that as an entry point to the JSON deserialization attacks that we did the following year.

205
00:19:43,320 --> 00:19:46,800
So sometimes one thing takes you to the next one.

206
00:19:46,800 --> 00:19:48,820
Sometimes they are not even related.

207
00:19:48,820 --> 00:19:56,000
Like jumping from JNDI to JSON deserialization or Mars Alert deserialization.

208
00:19:56,000 --> 00:20:01,880
So sometimes just reading a lot of stuff gives you ideas.

209
00:20:01,880 --> 00:20:11,600
Sometimes you just are playing with something in your regular work and then you find something interesting and you just pull the thread and find something else.

210
00:20:12,060 --> 00:20:15,900
It's just... I mean, things are not going to come to you.

211
00:20:15,900 --> 00:20:25,540
You have to be actively reading, looking for things, and then you will always find something that is interesting and you can pull the thread and find something more.

212
00:20:25,540 --> 00:20:38,360
If you just stay passive, like reading, but not asking yourself why things are working in such or such other way, then I don't think that there is room for research.

213
00:20:38,900 --> 00:20:43,220
And my suggestion is not to be focused on the results of the talk.

214
00:20:45,220 --> 00:20:52,860
It's very difficult on the first year to be accepted in Black Hat or DEF CON or something like that and produce such level of results.

215
00:20:52,860 --> 00:21:02,960
I would suggest just to be focused on something, some area, what you like best and you are passionate on that and follow for new research.

216
00:21:02,960 --> 00:21:08,040
Try to understand each novel technique and maybe try own thing.

217
00:21:08,040 --> 00:21:11,860
Maybe you have ideas and be passionate.

218
00:21:12,080 --> 00:21:14,100
I think... I do not know.

219
00:21:14,100 --> 00:21:17,880
For me, it took a couple of years to get some...

220
00:21:17,880 --> 00:21:28,120
If you are new, start to give your results and you can start to think about how to summarize this and present to others.

221
00:21:28,960 --> 00:21:36,900
And just to start a career from Let's Talk at DEF CON, for me, it's difficult to imagine.

222
00:21:36,900 --> 00:21:42,860
You need to have some background in this area and produce something new.

223
00:21:42,860 --> 00:21:46,380
And for this, you need year... not years, you need time.

224
00:21:46,780 --> 00:21:48,620
For somebody, it's months.

225
00:21:48,620 --> 00:21:50,440
For somebody, it's years.

226
00:21:50,800 --> 00:21:56,660
But still, for me, it's main target, it's my passion in that areas.

227
00:21:57,280 --> 00:21:59,720
Not just talk in DEF CON.

228
00:21:59,720 --> 00:22:00,780
DEF CON, it's results.

229
00:22:00,780 --> 00:22:02,860
If you have results, you can present it in DEF CON.

230
00:22:02,860 --> 00:22:07,000
If you do not have results, let's wait, let's try other direction.

231
00:22:07,000 --> 00:22:08,860
But you need to like this.

232
00:22:08,860 --> 00:22:11,420
Without passion, it's difficult.

233
00:22:11,420 --> 00:22:16,320
I love that you two said really quite different things there.

234
00:22:16,320 --> 00:22:21,320
In one case, you have, hey, I was reading an article and then I thought really deep about that article.

235
00:22:21,320 --> 00:22:25,480
But it seemed like it was something different from your previous research.

236
00:22:25,500 --> 00:22:31,820
And then the other answer would be, I just really like this stuff and I learned everything I could about it.

237
00:22:31,820 --> 00:22:43,240
So it's nice to hear the two different sides, if not the two different sides, about how to approach a new topic and how to find something cool in it.

238
00:22:43,240 --> 00:22:48,740
Which is probably why they work together so well and have had so much great research through the years.

239
00:22:48,760 --> 00:22:52,760
We have very different approaches for everything.

240
00:22:53,600 --> 00:22:55,960
Even research is different.

241
00:22:55,960 --> 00:23:07,940
For example, I never read documentation before research.

242
00:23:07,940 --> 00:23:11,920
It took more time, but I have some rules.

243
00:23:11,920 --> 00:23:15,980
Do not open documentation.

244
00:23:15,980 --> 00:23:20,330
Arvaro starts with documentation and can find something more quickly.

245
00:23:21,400 --> 00:23:23,280
Significantly quickly.

246
00:23:30,580 --> 00:23:34,780
So what did we not get to see during this presentation?

247
00:23:34,780 --> 00:23:39,740
I know you've already talked about when your presentations tend to jump around a little bit.

248
00:23:39,740 --> 00:23:47,300
So maybe you have the opportunity to hit more content or whatever you wanted to present during your go.

249
00:23:47,300 --> 00:24:00,600
But due to time or due to not having it fully formed in your head, what would you have liked to have put into this presentation where there was more time, more ability?

250
00:24:01,920 --> 00:24:07,440
So there is a lot of content that is not in the actual talk, in the actual video.

251
00:24:07,440 --> 00:24:12,000
But it's available in the white paper that we released as part of the talk.

252
00:24:12,000 --> 00:24:16,560
It's simply that we were not able to fit all the content in those 40 minutes.

253
00:24:16,560 --> 00:24:24,580
Apart from that, that's something that just didn't fit into the time allocated for the video.

254
00:24:24,640 --> 00:24:28,840
I think that I would also like to have looked into other languages.

255
00:24:28,840 --> 00:24:31,480
We just focused on .NET and Java.

256
00:24:31,660 --> 00:24:39,040
And maybe for .NET, I would also have looked into other content management systems that are different from ServePoint.

257
00:24:39,040 --> 00:24:39,940
Maybe, I don't know.

258
00:24:39,940 --> 00:24:43,660
I'm not really very familiar with .NET ecosystems.

259
00:24:43,660 --> 00:24:52,400
But, for example, .NET Nuke is a potential target that we just didn't have time to look into.

260
00:24:54,280 --> 00:24:55,320
I agree with Alvaro.

261
00:24:55,320 --> 00:24:57,400
Actually, we have more findings.

262
00:24:57,400 --> 00:25:01,440
And usually, when you start to search something, you have more findings.

263
00:25:01,440 --> 00:25:05,240
But you need to collect them in some topic, in some scope.

264
00:25:05,240 --> 00:25:07,780
Of course, a lot of things are out of scope.

265
00:25:07,780 --> 00:25:11,680
Maybe for the later research, maybe for some blog posts.

266
00:25:11,680 --> 00:25:12,420
Maybe not.

267
00:25:12,420 --> 00:25:14,120
Maybe it's not interesting.

268
00:25:14,400 --> 00:25:15,660
Something like that.

269
00:25:16,060 --> 00:25:17,360
It depends.

270
00:25:17,360 --> 00:25:23,040
If you have, like, a two-hour talk, maybe we will include some new stuff for SharePoint.

271
00:25:23,040 --> 00:25:28,780
There was some interesting stuff, because there was some playing with roles and other things.

272
00:25:29,900 --> 00:25:41,580
But I think our current white paper meets the scope of what we drew before this white paper and talks.

273
00:25:41,580 --> 00:25:42,780
And it's more interesting.

274
00:25:42,780 --> 00:25:49,520
When you have a lot of stuff, it's not good as well, because it's very difficult to focus on something.

275
00:25:49,540 --> 00:25:52,720
Even this stuff, we have two parts, .NET and Java.

276
00:25:52,720 --> 00:25:53,720
It's a bit different.

277
00:25:53,720 --> 00:25:57,080
Java has a lot of templates and giants.

278
00:25:58,300 --> 00:26:00,480
.NET has only SharePoint.

279
00:26:00,480 --> 00:26:05,820
It's a bit difficult to keep focus audience for these two parts.

280
00:26:05,820 --> 00:26:14,080
I think if you want to include something else, maybe it's better to have separate talk, not in this.

281
00:26:14,080 --> 00:26:15,300
To build a new talk.

282
00:26:15,300 --> 00:26:16,540
Makes sense.

283
00:26:16,540 --> 00:26:18,920
It's nice to be able to isolate down.

284
00:26:18,920 --> 00:26:22,760
We always keep some sprouts.

285
00:26:22,760 --> 00:26:24,180
How do you say that in English?

286
00:26:25,600 --> 00:26:29,180
Something like seed sprouts for the next talk.

287
00:26:29,180 --> 00:26:31,280
Something that looks promising.

288
00:26:31,700 --> 00:26:38,440
Maybe it's a new way into a new road that can lead to something.

289
00:26:39,720 --> 00:26:43,540
That's also something that we normally don't include in the talks.

290
00:26:44,920 --> 00:26:47,280
You're never going to retire from this, are you?

291
00:26:47,280 --> 00:26:51,220
There's always going to be something new and interesting to do a talk on.

292
00:26:51,740 --> 00:26:56,500
It's difficult because competition from year to year, it's more harder and harder.

293
00:26:56,500 --> 00:27:00,000
A lot of new guys and a lot of old guys.

294
00:27:01,240 --> 00:27:03,020
It's not easy.

295
00:27:03,540 --> 00:27:08,160
Let's hope that we will have motivation and time and resources for new researchers.

296
00:27:08,160 --> 00:27:09,380
We like this.

297
00:27:09,680 --> 00:27:11,380
Life will show.

298
00:27:13,380 --> 00:27:16,940
We have about five minutes left in our scheduled time here.

299
00:27:18,920 --> 00:27:20,920
What's your call to action?

300
00:27:20,940 --> 00:27:26,000
Where would you direct people to keep poking at this?

301
00:27:26,000 --> 00:27:38,140
Or what's something that, as you were hunting through all of this, that you were like, Oh, this would be something that I want somebody to look at, but maybe I don't have the background or the time.

302
00:27:39,220 --> 00:27:41,340
What's the gap?

303
00:27:45,370 --> 00:27:47,410
There's your question out of the blue.

304
00:27:48,150 --> 00:27:54,490
Yeah, so as I said, we didn't look at other languages.

305
00:27:54,690 --> 00:28:02,710
I know there is a lot of research around server-side template injection in JavaScript and Python.

306
00:28:03,630 --> 00:28:06,510
But yeah, so those are sandboxes as well.

307
00:28:06,510 --> 00:28:10,450
And probably those sandboxes need to be bypassed.

308
00:28:10,450 --> 00:28:24,850
A good direction for people wanting to look into this area of research is looking at how these other languages implement sandboxes and maybe try to find a way to break them.

309
00:28:25,770 --> 00:28:27,010
I agree with Edovara.

310
00:28:27,010 --> 00:28:30,930
Actually, we have two different .NET and Java languages.

311
00:28:30,930 --> 00:28:37,470
I think if we found something similar in these two languages, we can assume that many others are affected.

312
00:28:37,470 --> 00:28:40,430
It's not a problem in languages, it's a problem in design.

313
00:28:40,430 --> 00:28:45,650
Actually, it's very difficult to implement good sandboxes for these cases, I believe.

314
00:28:45,750 --> 00:28:47,490
It's very difficult.

315
00:28:47,490 --> 00:28:53,550
There are a lot of potential areas and we try to highlight the most obvious of them.

316
00:28:53,550 --> 00:29:06,450
And I think it's a good idea to look in any places, in any languages, in any system, in any other place.

317
00:29:06,450 --> 00:29:07,970
That makes sense.

318
00:29:07,970 --> 00:29:09,350
Well, thank you for that.

319
00:29:09,610 --> 00:29:16,910
If you would be so kind, you can toss us in probably the TrackOne channel would be a good place for this.

320
00:29:16,910 --> 00:29:20,250
Any place that folks can contact you later.

321
00:29:20,270 --> 00:29:29,630
Since this is a new format, we can actually put down if there's an email address or a Twitter profile or a GitHub.

322
00:29:29,650 --> 00:29:31,570
You could post that in that channel.

323
00:29:31,570 --> 00:29:32,870
I don't know if you can hear me.

324
00:29:33,450 --> 00:29:35,170
I can, as a matter of fact.

325
00:29:35,170 --> 00:29:36,450
Oh, maybe.

326
00:29:37,130 --> 00:29:38,530
I can hear you.

327
00:29:39,710 --> 00:29:42,190
We might have just lost him.

328
00:29:42,190 --> 00:29:43,230
You're back.

329
00:29:43,230 --> 00:29:44,990
Yeah, I'm back.

330
00:29:45,110 --> 00:29:46,910
I lost all of you.

331
00:29:47,630 --> 00:29:48,830
Well, welcome back.

332
00:29:48,830 --> 00:29:55,370
So we were just chatting about if there is a GitHub or a Twitter profile or an email or something that you...

333
00:29:55,370 --> 00:29:59,610
I believe you put something like that in your talk, but...

334
00:29:59,610 --> 00:30:01,410
Can everybody hear me?

335
00:30:02,150 --> 00:30:07,190
So my personal Twitter handle is Pontester, obviously.

336
00:30:07,190 --> 00:30:22,970
And also I work for the GitHub Security Lab, where all the advisories for the different content management systems with the details about how we were able to exploit them or break their sandboxes are being published.

337
00:30:22,970 --> 00:30:25,790
Some of them have been published already.

338
00:30:25,790 --> 00:30:27,670
Some of them are still to be published.

339
00:30:27,670 --> 00:30:30,450
So you may also want to follow that one.

340
00:30:30,450 --> 00:30:34,630
I think it's ghsecuritylab.

341
00:30:34,630 --> 00:30:35,630
Just let me...

342
00:30:35,630 --> 00:30:41,870
You can type that into the TrackOne channel at your leisure.

343
00:30:42,830 --> 00:30:45,410
And people can see that there.

344
00:30:46,310 --> 00:30:47,450
If there's...

345
00:30:47,970 --> 00:30:50,650
And that's pretty much the last of the questions I have.

346
00:30:50,650 --> 00:30:59,450
I want to thank you both very much for building this presentation and taking time out of your day to come and do this QA with us.

347
00:30:59,450 --> 00:31:04,250
This is what makes this community better than anything else I've ever been a part of.

348
00:31:04,250 --> 00:31:06,870
So thank you very much for your efforts.

349
00:31:06,870 --> 00:31:10,250
And I hope to see more from you folks in the near future.

350
00:31:11,590 --> 00:31:13,530
Thank you very much for having us.

351
00:31:13,530 --> 00:31:17,750
And hopefully, yeah, we can present again in DEF CON next year.

352
00:31:18,110 --> 00:31:19,670
And next time in person.

353
00:31:20,310 --> 00:31:21,190
Definitely.

354
00:31:21,370 --> 00:31:22,690
Next time in person.

355
00:31:22,690 --> 00:31:24,430
Well, I appreciate it.

356
00:31:24,430 --> 00:31:25,970
Have a great rest of your day.

357
00:31:25,970 --> 00:31:26,970
Enjoy the con.

358
00:31:26,970 --> 00:31:38,070
And to everyone watching, you should be able to see here in the next little while the contact information show up in the TrackOne channel.

359
00:31:38,070 --> 00:31:40,570
Otherwise, we will see you for the next one.

360
00:31:40,630 --> 00:31:41,610
Bye, everyone.

361
00:31:42,210 --> 00:31:43,350
Have a good one.

362
00:31:43,530 --> 00:31:44,470
Bye-bye.