Placeholder for Dayzzz
summary
Finds placeholder injection flaws in support portals that let attackers extract other users’ data by sending crafted tickets to Zendesk-backed APIs. Tests use GitHub Enterprise code, Zendesk Liquid templates and GraphQL mutation calls to the tickets API vs request API and exploit {{ticket.requester.email}} and CCs array rendering and for‑loop expansion. GitHub is patient zero; admin‑level ticket endpoints autofill internal emails, comments and agent fields. A third‑party integration impacts roughly 100–250 companies (vendor has ~6,000 customers). Zendesk exploits work immediately; Salesforce requires an agent reply.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:06Understanding placeholders
- 4:33Zendesk architecture
- 12:39Zendesk exploit mechanics
- 16:23Case studies and real impact
- 26:02Salesforce exploitation
- 34:55Other systems and conclusion
- 37:40Q&A session
related talks
58mOpen Source Pentesting and Security Analysis Tools: the DevOps way
26mYou Too Can Do Threat Modeling
27mCommon Application Security Mistakes that Enable Automated Attacks
24mAn inconvenient Zeus: The rise of Saas targeted malware
40mHow I Hacked Your Website and You Didn’t Even Know
46mLive hacking: Breaking into your Java web app
44mHack Yourself: Intro to pentesting with ZAP
41mHow Scripting In ZAP Can Bridge The Gap Between Dev Teams And Security