WEBVTT 00:02.220 --> 00:04.320 Enable streamer mode. 00:05.820 --> 00:08.120 Do we want that disabled? 00:08.280 --> 00:10.480 I think you want it enabled, don't you? 00:15.660 --> 00:17.300 That was my assumption. 00:17.820 --> 00:21.440 Alright, well we should be going live. 00:22.400 --> 00:24.300 Now we're live. 00:24.800 --> 00:27.540 Okay, let's push that recording button. 00:30.700 --> 00:32.940 Alright, chat! 00:32.940 --> 00:41.680 If anybody is hanging out watching TrackOne, feel free to start talking in the TrackOne channel on Discord. 00:41.680 --> 00:49.260 You're also welcome to start giving us some questions over in the TrackOne live Q&A channel. 00:49.260 --> 00:56.800 In the meantime, let's introduce our guests for right now. 00:56.800 --> 00:59.480 We have Olek and we have Poontester. 00:59.480 --> 01:04.460 I'm sure you two will come up with better ways to explain how to pronounce your names. 01:04.480 --> 01:06.920 But thank you very much for joining us today. 01:06.920 --> 01:14.520 Give us the name of the talk that you did, and we'll start asking you some silly questions about it. 01:16.400 --> 01:23.800 Okay, so the talk was Room for Escape, Scribbling Outside the Lines of Template Security. 01:23.800 --> 01:38.420 A talk around content management systems, and in particular the template engines used in these systems, and how we were able to break out of the sandboxes that they put in place. 01:39.020 --> 01:46.960 If you have any questions about the talk or anything else, maybe we can help you. 01:47.660 --> 01:49.980 Just feel free to ask anything. 01:49.980 --> 01:52.040 How do you like your handle pronounced? 01:54.240 --> 01:56.160 I pronounce it Poontester. 01:56.160 --> 01:56.640 Poontester? 01:56.640 --> 01:58.000 I don't know if that's better. 01:58.640 --> 02:05.920 I think that we just entered into one of the mighty arguments in the hacker world, if it's Pwn or Pwn. 02:06.040 --> 02:09.740 So we're going to go with Pwn because that sounds a little bit better. 02:10.980 --> 02:14.540 So Olek, go ahead and give your little bit of an intro. 02:16.000 --> 02:16.960 About myself? 02:17.200 --> 02:18.880 Yeah, we'll click over to you. 02:20.080 --> 02:28.040 I'm a security researcher for already more than 10 years, and working for Micro Focus Spotify. 02:28.620 --> 02:40.920 And I'm happy to have a chance to work with Pwntester for a couple of years already, and it's our fourth shared research. 02:40.920 --> 02:47.440 And I'm happy with these results, and I hope to get something similar in the next years. 02:47.440 --> 02:48.720 Absolutely. 02:48.720 --> 02:50.300 I will retire. 02:51.600 --> 02:57.720 Yeah, so that's a good segue, actually, to talk while we're waiting for people to come up with some good questions for you. 02:57.720 --> 02:59.760 Tell us a little bit about some of the... 03:00.280 --> 03:17.540 This is definitely not your first talk here at DEF CON, so just briefly give us some background on where you came from and what the earlier talks were, so that people know how to reach back and find you in the archives. 03:17.540 --> 03:24.660 And then maybe touch on, how does this one feel different than the other talks that you've done? 03:27.610 --> 03:35.890 Okay, so I think the first one that we did together was Friday the 13th, JSON attacks. 03:36.310 --> 03:38.130 No, actually it was... 03:38.130 --> 03:40.970 Sorry, it was JNDI injections. 03:41.030 --> 03:41.770 It was the first one. 03:41.770 --> 03:44.810 Did we present that at DEF CON or just at Black Hat? 03:44.950 --> 03:46.330 Just at Black Hat, you're right. 03:47.240 --> 03:51.870 So the first one that we presented together was the JNDI injection. 03:51.870 --> 03:58.290 I think the full title was something like JNDI injection... 03:59.330 --> 04:01.470 How was that? 04:01.470 --> 04:03.970 Dreamland to RC something. 04:04.790 --> 04:07.750 Yeah, no, like a trip into RC. 04:07.750 --> 04:08.250 I don't know. 04:08.250 --> 04:10.930 I don't remember the title anymore. 04:10.930 --> 04:23.120 That was around JNDI injection in Java world of ecosystems, which was then used for many of the visualization gadgets. 04:23.630 --> 04:26.190 So that was a good one. 04:26.190 --> 04:38.330 And then before that one, I presented at DEF CON, one with Denis Cruz and AFPang, that was called resting in your laurels will get you pwned or pwned. 04:38.330 --> 04:42.030 Yeah, that was a nice one. 04:42.030 --> 04:46.510 So the first one that we did together was this about JNDI injection attacks. 04:46.510 --> 05:00.050 Then the first one that when we presented at DEF CON and we had to drink our shots as newbie speakers was this one about JSON attacks, JSON visualization attacks. 05:00.050 --> 05:00.710 Gotcha. 05:00.710 --> 05:19.390 And then last year we presented SSL Wars, the token menace, where we presented an attack on some implementation in Microsoft stacks that was flowing in .NET framework. 05:19.830 --> 05:25.170 And now this year we repeat again as a team with this one. 05:26.350 --> 05:27.210 Excellent. 05:27.210 --> 05:29.730 We really appreciate that you both came out to do that. 05:31.070 --> 05:40.610 You two, as we're waiting for people to jump in with more questions, you did present me with one that I'm going to sneakily slide in here as if somebody else asked it. 05:40.610 --> 05:47.130 The vulnerabilities that you disclose all seem to require that the attacker have user-level access to the system. 05:47.130 --> 05:48.430 Is that true? 05:50.190 --> 05:51.890 Is that a hurdle for most... 05:51.890 --> 05:53.570 Oh, see, now I'm talking over you. 05:53.570 --> 05:54.850 So your turn, Hugo. 05:55.970 --> 05:58.350 Okay, I think it's mostly true. 05:58.350 --> 06:03.510 It still depends on applications, on configuration, on specific configuration. 06:03.510 --> 06:11.070 But to be able to perform such attacks, attackers should be able to create or at least modify some template. 06:11.210 --> 06:16.250 And in most cases, it's at least user-level account. 06:16.250 --> 06:18.790 For SharePoint, it's just user-level account. 06:18.790 --> 06:21.690 It's default configuration and just user-level account. 06:21.690 --> 06:24.810 Any user in default configuration can do this. 06:24.810 --> 06:28.330 For other applications, it still depends. 06:28.330 --> 06:30.270 Sometimes it's just user-level. 06:30.270 --> 06:36.410 Sometimes you need to be like writer or some other roles, more powerful roles. 06:36.410 --> 06:38.730 Sometimes even administrator. 06:39.330 --> 06:52.370 So one requirement for our attack, attackers should be able to manage these templates or ISPX pages in case of SharePoint. 06:52.370 --> 06:54.330 Okay, so maybe not. 06:54.330 --> 06:58.710 The minimum is just they have to be able to deal with the SharePoint side. 06:58.710 --> 07:00.990 They have to be able to control that. 07:00.990 --> 07:04.350 But it's not necessarily that... 07:04.350 --> 07:13.570 So for SharePoint, it's a bit simpler. 07:13.570 --> 07:18.610 Any user can have access to own private site and can manage it. 07:18.610 --> 07:20.650 It's your site. 07:20.650 --> 07:26.290 And you can use at least this site for performing attacks. 07:26.290 --> 07:28.730 For other applications, yes. 07:28.730 --> 07:38.750 It depends on configuration, depends on permission for specific projects, for specific sub-sites and other things. 07:38.750 --> 07:39.610 Okay. 07:41.230 --> 07:49.670 So I was going to add that our assumption in this talk is that we were able or the attacker were able to control the templates. 07:49.670 --> 07:57.130 And then our research was around breaking outside of those sandboxes. 07:57.130 --> 08:09.930 So in a similar way that we may present something around breaking mitigations for buffer overflows, but our research was not how to find those buffer overflows in the first place. 08:09.930 --> 08:34.170 So I'm saying that because apart from being able to control the contents of the template, different vectors may include things like server-side template injection, or maybe, for example, if there is a cross-site scripting vulnerability in that page, you can use that to fool a victim into submit a malicious template on your behalf. 08:34.170 --> 08:41.910 Or maybe there is a cross-site request for you that you cannot use in order to manipulate or modify the template content. 08:41.910 --> 08:46.510 So we didn't really care about how you were able to get access to the content. 08:46.510 --> 08:58.370 It may be because you have access to, like Alexander explained, it's the normal case, for example, in things like SharePoint or a wiki, for example, where you can edit your own articles and things like that. 08:58.370 --> 09:05.950 But maybe in other systems, some of the ones that we reported, like Office, for example, they were vulnerable to server-side template injection. 09:06.110 --> 09:19.150 And for example, in some cases, we were able to request trial accounts in content management systems that were deployed on the cloud, like in software-as-a-service architectures. 09:19.150 --> 09:26.970 And with those trial accounts, we were able to hone those servers and compromise the underlying servers. 09:27.230 --> 09:39.110 So in a big way, you've given us another step in our chain, another tool to escalate how much damage we can do once we have a foothold. 09:40.390 --> 09:41.650 Yeah, exactly. 09:41.650 --> 09:42.310 Excellent. 09:42.310 --> 09:48.390 What level of access were you using to get that remote code execution? 09:48.390 --> 09:52.510 Were you just a regular user and able to escalate that far? 09:53.110 --> 10:02.970 So in some cases, like Alexander explained for SharePoint, just having an account in SharePoint, like a regular user account, allows you to create your own site. 10:02.970 --> 10:08.130 And then you can control the template or the ASPX page, in this case for SharePoint. 10:08.130 --> 10:12.690 And then you can use that to get remote code execution on the underlying server. 10:12.790 --> 10:16.390 In other cases, like XWiki, just a regular user as well. 10:16.410 --> 10:24.270 Other systems, like for example, Atlassian Confluence, you were required to be administrator in order to edit a template. 10:24.270 --> 10:48.030 So in those systems, either you are an administrator, so it's kind of more like an insider attack, or maybe those systems are vulnerable, as I explained before, you find a cross-site scripting vulnerability, and you can escalate from cross-site scripting to remote code execution by being able to fool the victim to submit or modify a template on your behalf. 10:50.430 --> 10:57.370 Okay , so can you give us a little bit of background on how you came upon this type of research? 10:57.370 --> 11:01.270 What was your entry point into doing this attack? 11:04.310 --> 11:06.790 It's not easy to answer. 11:06.790 --> 11:17.410 It's as usual, when you have some target that allows you something, and you think, wow, it's a lot of things for attackers, and it starts the game. 11:17.410 --> 11:21.250 You try to use one thing to bypass something. 11:21.250 --> 11:26.750 For example, SharePoint, it allows you to upload ASPX pages. 11:26.750 --> 11:33.890 So the first thing, why we cannot put only the code there and execute code there? 11:33.890 --> 11:35.090 No, we cannot. 11:35.090 --> 11:36.010 Why we cannot? 11:36.010 --> 11:38.110 And game starts. 11:39.630 --> 11:42.110 And it's not only SharePoint. 11:42.110 --> 11:53.650 There are a lot of such server or services that allows you to define some templates for dynamic content, and actually you can access getters. 11:53.650 --> 11:55.630 You can access some methods. 11:55.630 --> 11:58.270 You can access some objects. 11:58.750 --> 12:00.430 Why we cannot abuse them? 12:00.430 --> 12:01.270 Let's try. 12:01.270 --> 12:03.200 Let's see what we can do. 12:03.200 --> 12:06.360 What we can do further with all this stuff. 12:06.420 --> 12:13.580 And it starts our research investigation, and at the end, we have such results. 12:14.360 --> 12:16.320 You chained it down. 12:16.960 --> 12:18.220 I'm on mute. 12:18.220 --> 12:19.620 So you pushed it down that direction. 12:19.620 --> 12:20.780 That makes sense. 12:21.440 --> 12:29.200 And I'm assuming then we're kind of talking to a general mindset when you're doing your normal day-to-day work. 12:29.200 --> 12:34.840 You find something that's a little funny, and you just can't let it go. 12:34.840 --> 12:40.020 I mean, this is that greater question about, what does it take to be a hacker? 12:40.480 --> 13:00.100 It's always nice to hear people who are out there in the world doing these presentations, doing this research, talk to the rest of us who are getting our feet wet in the world of web application security or whatever your niche is. 13:00.100 --> 13:08.060 How do the rest of you folks who are getting all of the success, doing these cool presentations and research, how do you approach these? 13:08.060 --> 13:10.180 How do you know when you have something cool? 13:12.940 --> 13:28.960 So in my case, and continuing Alexander's response, I guess that I started this research because Oleg came to me and said, like, okay, I found these four different ways of breaking the server in safe mode. 13:28.960 --> 13:32.760 For that time, I mean, we found a lot of more. 13:33.380 --> 13:46.560 So he said, like, maybe if we also look at the Java side, we get something interesting that can be interesting, like a full research, like something that is more self-contained somehow. 13:46.580 --> 13:52.320 And then he told me, like, can you take a look at some of the most popular engines in Java? 13:52.320 --> 13:55.500 And when I was there, I was like, okay, let's see. 13:55.500 --> 14:04.260 Before I started looking at the implementation of those engines and do, like, code review and things like that, it was like, okay, I'm here. 14:04.260 --> 14:04.880 I get access. 14:04.880 --> 14:07.220 I assume that I get access to a template. 14:07.220 --> 14:08.160 What can I do now? 14:08.160 --> 14:10.160 What objects are available? 14:10.160 --> 14:18.520 So I started looking and inspecting the template context by debugging the applications and setting some breakpoints. 14:18.520 --> 14:27.980 And then I was surprised that I was able to access thousands of objects that were non-intentionally exposed. 14:27.980 --> 14:31.860 They were, like, they're indirectly exposed by other objects. 14:32.000 --> 14:39.480 And with that big amount of attack surface, it was like, this is going to be easy to find something that I can use to get remote code execution. 14:39.480 --> 14:40.580 That was the case. 14:40.580 --> 14:46.540 And then as a second part of the research, we started looking at the implementation of those libraries. 14:46.540 --> 14:51.400 And then we found some specific flaws in the implementation. 14:51.400 --> 15:00.760 The way they were checking block lists, for example, or gaps on those block lists or things like that, that I explained in the talk. 15:01.000 --> 15:03.080 That was your entry. 15:03.080 --> 15:04.920 You , all of a sudden, you're like, I have something. 15:04.920 --> 15:14.640 And then you spent a significant amount of time testing the boundaries of the thing that you had until you worked your way towards where we are now. 15:14.740 --> 15:16.340 That makes sense. 15:16.340 --> 15:22.020 It's always good to hear from you folks, kind of where you're coming from on that. 15:22.460 --> 15:28.520 So I saw a few different content management systems that you looked at. 15:28.520 --> 15:34.060 And I imagine at some point, you just kind of run out of time to keep checking things. 15:34.060 --> 15:42.060 Do you think that there are still more out there that people could follow your techniques and do the same kind of thing to find vulnerabilities? 15:42.060 --> 15:46.940 Is that also going to be an area that you plan to continue to research? 15:46.940 --> 15:48.740 Or are you guys kind of done with this one? 15:49.980 --> 15:52.620 Definitely, there should be a lot of products. 15:52.620 --> 15:55.060 We think there are a lot of products. 15:55.060 --> 16:01.180 As you mentioned, just a couple of them are under our focus. 16:01.180 --> 16:06.480 And actually, for example, if you're talking about SharePoint, it is not an automated approach. 16:06.480 --> 16:09.240 It's just manual and just to find some patterns. 16:09.240 --> 16:13.440 And we try to show this pattern in our presentation. 16:13.580 --> 16:24.220 And I believe there's still a lot of things to look for in SharePoint specifically and about other content, even not content management system. 16:24.220 --> 16:42.680 In any other system, like maybe email servers, if you can define a template for dynamic content for some auto-creation emails, it can be a starting point for your research as well. 16:42.680 --> 17:01.920 So our purpose of our research, our presentation, just show our patterns, our approaches and say, hey guys, we use this and we got such results, like 30 new vulnerabilities. 17:02.080 --> 17:03.900 You can use the same. 17:03.900 --> 17:05.820 It's not only for offensive side. 17:05.820 --> 17:08.180 It's for defensive as well. 17:08.180 --> 17:26.660 Guys, if you are developing something that go in this bucket, you need to look on these areas to check this because you can see what can happen. 17:26.820 --> 17:31.520 So, of course, anybody welcome to continue this research. 17:31.520 --> 17:34.400 About myself, I'm not sure. 17:34.400 --> 17:40.220 I need to have some rest, vacation, couple months after that, maybe. 17:40.220 --> 17:45.780 But usually, if you can see our talks, they are not linear. 17:45.860 --> 17:48.600 We are jumping from one topic to another topic. 17:48.600 --> 17:51.220 It's more interesting for me. 17:51.220 --> 17:53.820 But I do not know, maybe. 17:54.060 --> 17:58.140 If I still find something interesting, I will continue. 17:58.140 --> 18:04.220 But for the next year, to be honest, it will be more difficult because competition will be more higher. 18:04.220 --> 18:10.460 Maybe it's better to leave this for others and try to find some new areas. 18:11.620 --> 18:22.320 Based on all the different presentations that you two described earlier, it seems like you two work together really well in finding these types of things. 18:22.320 --> 18:30.700 I know some people earlier were asking, how should somebody go about starting out research and picking out targets? 18:30.700 --> 18:40.840 Do you have any suggestions for people on how they can start getting into the type of research field that you two seem to do really well? 18:43.080 --> 18:47.900 I don't think that one is easy to answer. 18:49.020 --> 18:59.680 It's just like, at least for me, being up to date with the latest research from other people in the community and industry. 18:59.680 --> 19:04.660 Or maybe reading articles that are not directly related with what you do. 19:04.660 --> 19:16.440 For example, I think that the JNDI injection that was the first one that we did together started out of reading an article about a malware analysis. 19:16.720 --> 19:21.800 And in that malware analysis, the malware was using some JNDI lookups. 19:21.800 --> 19:22.980 We found that interesting. 19:22.980 --> 19:24.900 We started researching that. 19:24.940 --> 19:28.020 And that led to the JNDI injection attack. 19:28.020 --> 19:37.060 As part of that attack, we found some gadgets that were using setters instead of magic methods in Java deserialization and so on. 19:37.060 --> 19:43.320 And we found that as an entry point to the JSON deserialization attacks that we did the following year. 19:43.320 --> 19:46.800 So sometimes one thing takes you to the next one. 19:46.800 --> 19:48.820 Sometimes they are not even related. 19:48.820 --> 19:56.000 Like jumping from JNDI to JSON deserialization or Mars Alert deserialization. 19:56.000 --> 20:01.880 So sometimes just reading a lot of stuff gives you ideas. 20:01.880 --> 20:11.600 Sometimes you just are playing with something in your regular work and then you find something interesting and you just pull the thread and find something else. 20:12.060 --> 20:15.900 It's just... I mean, things are not going to come to you. 20:15.900 --> 20:25.540 You have to be actively reading, looking for things, and then you will always find something that is interesting and you can pull the thread and find something more. 20:25.540 --> 20:38.360 If you just stay passive, like reading, but not asking yourself why things are working in such or such other way, then I don't think that there is room for research. 20:38.900 --> 20:43.220 And my suggestion is not to be focused on the results of the talk. 20:45.220 --> 20:52.860 It's very difficult on the first year to be accepted in Black Hat or DEF CON or something like that and produce such level of results. 20:52.860 --> 21:02.960 I would suggest just to be focused on something, some area, what you like best and you are passionate on that and follow for new research. 21:02.960 --> 21:08.040 Try to understand each novel technique and maybe try own thing. 21:08.040 --> 21:11.860 Maybe you have ideas and be passionate. 21:12.080 --> 21:14.100 I think... I do not know. 21:14.100 --> 21:17.880 For me, it took a couple of years to get some... 21:17.880 --> 21:28.120 If you are new, start to give your results and you can start to think about how to summarize this and present to others. 21:28.960 --> 21:36.900 And just to start a career from Let's Talk at DEF CON, for me, it's difficult to imagine. 21:36.900 --> 21:42.860 You need to have some background in this area and produce something new. 21:42.860 --> 21:46.380 And for this, you need year... not years, you need time. 21:46.780 --> 21:48.620 For somebody, it's months. 21:48.620 --> 21:50.440 For somebody, it's years. 21:50.800 --> 21:56.660 But still, for me, it's main target, it's my passion in that areas. 21:57.280 --> 21:59.720 Not just talk in DEF CON. 21:59.720 --> 22:00.780 DEF CON, it's results. 22:00.780 --> 22:02.860 If you have results, you can present it in DEF CON. 22:02.860 --> 22:07.000 If you do not have results, let's wait, let's try other direction. 22:07.000 --> 22:08.860 But you need to like this. 22:08.860 --> 22:11.420 Without passion, it's difficult. 22:11.420 --> 22:16.320 I love that you two said really quite different things there. 22:16.320 --> 22:21.320 In one case, you have, hey, I was reading an article and then I thought really deep about that article. 22:21.320 --> 22:25.480 But it seemed like it was something different from your previous research. 22:25.500 --> 22:31.820 And then the other answer would be, I just really like this stuff and I learned everything I could about it. 22:31.820 --> 22:43.240 So it's nice to hear the two different sides, if not the two different sides, about how to approach a new topic and how to find something cool in it. 22:43.240 --> 22:48.740 Which is probably why they work together so well and have had so much great research through the years. 22:48.760 --> 22:52.760 We have very different approaches for everything. 22:53.600 --> 22:55.960 Even research is different. 22:55.960 --> 23:07.940 For example, I never read documentation before research. 23:07.940 --> 23:11.920 It took more time, but I have some rules. 23:11.920 --> 23:15.980 Do not open documentation. 23:15.980 --> 23:20.330 Arvaro starts with documentation and can find something more quickly. 23:21.400 --> 23:23.280 Significantly quickly. 23:30.580 --> 23:34.780 So what did we not get to see during this presentation? 23:34.780 --> 23:39.740 I know you've already talked about when your presentations tend to jump around a little bit. 23:39.740 --> 23:47.300 So maybe you have the opportunity to hit more content or whatever you wanted to present during your go. 23:47.300 --> 24:00.600 But due to time or due to not having it fully formed in your head, what would you have liked to have put into this presentation where there was more time, more ability? 24:01.920 --> 24:07.440 So there is a lot of content that is not in the actual talk, in the actual video. 24:07.440 --> 24:12.000 But it's available in the white paper that we released as part of the talk. 24:12.000 --> 24:16.560 It's simply that we were not able to fit all the content in those 40 minutes. 24:16.560 --> 24:24.580 Apart from that, that's something that just didn't fit into the time allocated for the video. 24:24.640 --> 24:28.840 I think that I would also like to have looked into other languages. 24:28.840 --> 24:31.480 We just focused on .NET and Java. 24:31.660 --> 24:39.040 And maybe for .NET, I would also have looked into other content management systems that are different from ServePoint. 24:39.040 --> 24:39.940 Maybe, I don't know. 24:39.940 --> 24:43.660 I'm not really very familiar with .NET ecosystems. 24:43.660 --> 24:52.400 But, for example, .NET Nuke is a potential target that we just didn't have time to look into. 24:54.280 --> 24:55.320 I agree with Alvaro. 24:55.320 --> 24:57.400 Actually, we have more findings. 24:57.400 --> 25:01.440 And usually, when you start to search something, you have more findings. 25:01.440 --> 25:05.240 But you need to collect them in some topic, in some scope. 25:05.240 --> 25:07.780 Of course, a lot of things are out of scope. 25:07.780 --> 25:11.680 Maybe for the later research, maybe for some blog posts. 25:11.680 --> 25:12.420 Maybe not. 25:12.420 --> 25:14.120 Maybe it's not interesting. 25:14.400 --> 25:15.660 Something like that. 25:16.060 --> 25:17.360 It depends. 25:17.360 --> 25:23.040 If you have, like, a two-hour talk, maybe we will include some new stuff for SharePoint. 25:23.040 --> 25:28.780 There was some interesting stuff, because there was some playing with roles and other things. 25:29.900 --> 25:41.580 But I think our current white paper meets the scope of what we drew before this white paper and talks. 25:41.580 --> 25:42.780 And it's more interesting. 25:42.780 --> 25:49.520 When you have a lot of stuff, it's not good as well, because it's very difficult to focus on something. 25:49.540 --> 25:52.720 Even this stuff, we have two parts, .NET and Java. 25:52.720 --> 25:53.720 It's a bit different. 25:53.720 --> 25:57.080 Java has a lot of templates and giants. 25:58.300 --> 26:00.480 .NET has only SharePoint. 26:00.480 --> 26:05.820 It's a bit difficult to keep focus audience for these two parts. 26:05.820 --> 26:14.080 I think if you want to include something else, maybe it's better to have separate talk, not in this. 26:14.080 --> 26:15.300 To build a new talk. 26:15.300 --> 26:16.540 Makes sense. 26:16.540 --> 26:18.920 It's nice to be able to isolate down. 26:18.920 --> 26:22.760 We always keep some sprouts. 26:22.760 --> 26:24.180 How do you say that in English? 26:25.600 --> 26:29.180 Something like seed sprouts for the next talk. 26:29.180 --> 26:31.280 Something that looks promising. 26:31.700 --> 26:38.440 Maybe it's a new way into a new road that can lead to something. 26:39.720 --> 26:43.540 That's also something that we normally don't include in the talks. 26:44.920 --> 26:47.280 You're never going to retire from this, are you? 26:47.280 --> 26:51.220 There's always going to be something new and interesting to do a talk on. 26:51.740 --> 26:56.500 It's difficult because competition from year to year, it's more harder and harder. 26:56.500 --> 27:00.000 A lot of new guys and a lot of old guys. 27:01.240 --> 27:03.020 It's not easy. 27:03.540 --> 27:08.160 Let's hope that we will have motivation and time and resources for new researchers. 27:08.160 --> 27:09.380 We like this. 27:09.680 --> 27:11.380 Life will show. 27:13.380 --> 27:16.940 We have about five minutes left in our scheduled time here. 27:18.920 --> 27:20.920 What's your call to action? 27:20.940 --> 27:26.000 Where would you direct people to keep poking at this? 27:26.000 --> 27:38.140 Or what's something that, as you were hunting through all of this, that you were like, Oh, this would be something that I want somebody to look at, but maybe I don't have the background or the time. 27:39.220 --> 27:41.340 What's the gap? 27:45.370 --> 27:47.410 There's your question out of the blue. 27:48.150 --> 27:54.490 Yeah, so as I said, we didn't look at other languages. 27:54.690 --> 28:02.710 I know there is a lot of research around server-side template injection in JavaScript and Python. 28:03.630 --> 28:06.510 But yeah, so those are sandboxes as well. 28:06.510 --> 28:10.450 And probably those sandboxes need to be bypassed. 28:10.450 --> 28:24.850 A good direction for people wanting to look into this area of research is looking at how these other languages implement sandboxes and maybe try to find a way to break them. 28:25.770 --> 28:27.010 I agree with Edovara. 28:27.010 --> 28:30.930 Actually, we have two different .NET and Java languages. 28:30.930 --> 28:37.470 I think if we found something similar in these two languages, we can assume that many others are affected. 28:37.470 --> 28:40.430 It's not a problem in languages, it's a problem in design. 28:40.430 --> 28:45.650 Actually, it's very difficult to implement good sandboxes for these cases, I believe. 28:45.750 --> 28:47.490 It's very difficult. 28:47.490 --> 28:53.550 There are a lot of potential areas and we try to highlight the most obvious of them. 28:53.550 --> 29:06.450 And I think it's a good idea to look in any places, in any languages, in any system, in any other place. 29:06.450 --> 29:07.970 That makes sense. 29:07.970 --> 29:09.350 Well, thank you for that. 29:09.610 --> 29:16.910 If you would be so kind, you can toss us in probably the TrackOne channel would be a good place for this. 29:16.910 --> 29:20.250 Any place that folks can contact you later. 29:20.270 --> 29:29.630 Since this is a new format, we can actually put down if there's an email address or a Twitter profile or a GitHub. 29:29.650 --> 29:31.570 You could post that in that channel. 29:31.570 --> 29:32.870 I don't know if you can hear me. 29:33.450 --> 29:35.170 I can, as a matter of fact. 29:35.170 --> 29:36.450 Oh, maybe. 29:37.130 --> 29:38.530 I can hear you. 29:39.710 --> 29:42.190 We might have just lost him. 29:42.190 --> 29:43.230 You're back. 29:43.230 --> 29:44.990 Yeah, I'm back. 29:45.110 --> 29:46.910 I lost all of you. 29:47.630 --> 29:48.830 Well, welcome back. 29:48.830 --> 29:55.370 So we were just chatting about if there is a GitHub or a Twitter profile or an email or something that you... 29:55.370 --> 29:59.610 I believe you put something like that in your talk, but... 29:59.610 --> 30:01.410 Can everybody hear me? 30:02.150 --> 30:07.190 So my personal Twitter handle is Pontester, obviously. 30:07.190 --> 30:22.970 And also I work for the GitHub Security Lab, where all the advisories for the different content management systems with the details about how we were able to exploit them or break their sandboxes are being published. 30:22.970 --> 30:25.790 Some of them have been published already. 30:25.790 --> 30:27.670 Some of them are still to be published. 30:27.670 --> 30:30.450 So you may also want to follow that one. 30:30.450 --> 30:34.630 I think it's ghsecuritylab. 30:34.630 --> 30:35.630 Just let me... 30:35.630 --> 30:41.870 You can type that into the TrackOne channel at your leisure. 30:42.830 --> 30:45.410 And people can see that there. 30:46.310 --> 30:47.450 If there's... 30:47.970 --> 30:50.650 And that's pretty much the last of the questions I have. 30:50.650 --> 30:59.450 I want to thank you both very much for building this presentation and taking time out of your day to come and do this QA with us. 30:59.450 --> 31:04.250 This is what makes this community better than anything else I've ever been a part of. 31:04.250 --> 31:06.870 So thank you very much for your efforts. 31:06.870 --> 31:10.250 And I hope to see more from you folks in the near future. 31:11.590 --> 31:13.530 Thank you very much for having us. 31:13.530 --> 31:17.750 And hopefully, yeah, we can present again in DEF CON next year. 31:18.110 --> 31:19.670 And next time in person. 31:20.310 --> 31:21.190 Definitely. 31:21.370 --> 31:22.690 Next time in person. 31:22.690 --> 31:24.430 Well, I appreciate it. 31:24.430 --> 31:25.970 Have a great rest of your day. 31:25.970 --> 31:26.970 Enjoy the con. 31:26.970 --> 31:38.070 And to everyone watching, you should be able to see here in the next little while the contact information show up in the TrackOne channel. 31:38.070 --> 31:40.570 Otherwise, we will see you for the next one. 31:40.630 --> 31:41.610 Bye, everyone. 31:42.210 --> 31:43.350 Have a good one. 31:43.530 --> 31:44.470 Bye-bye.