Hacking Exposed - Hacking the Sec into DevOps
summary
Session performs live hacks on an OpenRefine instance discovered in the wild, using indexed public code via Grep.app and host search via Shodan, then loads the repo into Joern to trace dataflow from HTTP parameters to an evaluate() sink. A Python/Jython payload runs os.system to trigger a Netcat listener and yields a shell on the reachable instance. Also shows chaining like CVE‑2017‑5638 template injection plus credential theft and highlights CI/CD and open‑source supply chain as primary attack surfaces.
AI-written summary · about
chapters (14)
- 0:00Start
- 3:58The Root of the Root
- 6:08Evolving Threat Landscape
- 10:00Code is the new attack vector
- 12:29How Deep Is Your Open Source?
- 15:17Gaining context within the Application
- 16:47Recon your CI/CD pipeline to reach your code
- 19:38Supply Chain Tampering to weaponize your code
- 21:12Open Source Supply Chain tampering
- 25:30Demo : Weaponizing exposed OpenRefine
- 31:36OpenRefine utility status
- 31:59Why would OpenRefine need a Py interpreter?
- 45:59Countermeasures...
- 46:52More Alerts does not mean better security
