Red Teaming from outside: Identifying and exploiting SaaS systems... (Rojan Rijal)
summary
Shows concrete attack chains: abuse of Amazon SES mail-from subdomain to deliver phishing that bypasses SPF/DKIM checks; exploiting unauthenticated GETs used by email-security URL analysis; chaining domain-capture in SaaS (Atlassian) to auto-verify accounts; and using Google Groups’ +subscribe/+subconfirm commands plus vulnerable ATS outbound/inbound mail IDs to join internal mailing lists. Demonstrations include a Netflix chain that yields access to Atlassian workspaces (reported/fixed where applicable) and a live demo that succeeds on a test ATS, proving the methods work end to end.
AI-written summary · about
chapters (13)
- 0:00Introduction and setup
- 1:04Focus of the talk
- 3:07Email security vendor basics
- 8:25Exploiting Amazon SES
- 13:22Google Groups overview
- 16:32Identifying Google Groups
- 19:40Joining private Google Groups
- 23:06Google Groups permission flaws
- 27:41Recruiting platform attack
- 30:07Live demo attempt
- 34:13Live demo with backup video
- 36:44Prevention and mitigation
- 37:49Q&A session
related talks
30mTales of Red Teaming
46mNext Generation Red Teaming
33mOffensive Javascript Techniques for Red Teamers
29mMapping the SaaS Attack Surface
29mRed Teaming AWS: Practice What You Preach
35mRed Teaming AWS: Practice What You Preach/
37mAutomation Tactics for Modern Threat Emulation
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures