Blended Web and Database Attacks on Real-Time, In-Memory Platforms
summary
Covers concrete attacks and demos against SAP HANA: a novel SQL injection path abusing TIME TRAVEL history tables to recover deleted rows; code injection and privilege escalation via Server-Side Javascript stored in the database and editable through the default XS IDE; remote exploitation of the R server (pyRserve demo shows shutdown and OS-level commands) and post‑compromise OS shells via uploaded C libraries (XS C/XSC). Provides a pentest cheat sheet, working recorded demos, and specific mitigations: prepared statements, strict user permissions, lock down IDE/packages, secure R integration and enable CSRF/HTTP protections.
AI-written summary · about
chapters (24)
- 0:00Intro
- 0:27Company Introduction
- 1:54Agenda
- 2:36InMemory Databases
- 4:11Innovation
- 6:08Vendors
- 12:36CP Systems
- 14:24SAP HANA
- 15:34Blended Architecture
- 18:15SQL Injection
- 22:05Programming Languages
- 23:33Creating New Applications
- 27:17SQL Injection Demo
- 28:20Time Travel
- 28:39History Tables
- 32:38SQL Injections
- 36:29Concern Measures
- 37:23Crosssite Scripting
- 38:29Recommendations
- 40:40Our Server Integration
- 49:49Control Measures
- 53:07Cheat Sheet
- 53:38Conclusions
- 55:09Thanks
related talks
49mBlended Web and Database Attacks on Real-time, In-Memory Platforms
35mInside a hacker’s mind
43mLive hacking: Breaking into your Java web app
58mModern web application bugs
53mHow hacking works - Web edition
47mLive Hacking: Breaking into Your Web App
42mModern web application bugs
36mChained to Hit: Discovering New Vectors to Gain Remote and Root Access in SAP Enterprise Software