No locked doors, no windows barred: hacking OpenAM infrastructure

No ratings

Presented at ZeroNights 2012 by

Andrey Petukhov

Georgy Noseyevich

One of the main functional components of enterprise applications and Internet portals is an authentication and access control system (AuthC/Z). In this presentation, we will describe a popular access control system called ForgeRock OpenAM from the external security point of view. I will show the scenarios of full enterprise application compromise through complex attacks which employ both LFI and SSRF.