Like a Boss: Attacking JBoss
Tyler Krpata details jBoss is an open source Java EE application server.
Summary
Architecture and Background
JBoss is an open source Java EE application server.
Vulnerability Analysis
Its default configuration provides several insecure defaults that an attacker can use to gather information, cause a denial of service, or even execute arbitrary code on the system.
Exploitation and Demonstrations
Tyler Krpata Tyler Krpata is a principal security engineer for a SaaS company.
Remediation and Defensive Strategies
He has previously worked in enterprise security in the retail and healthcare fields. When he was suspended from high school for "hacking," he had no idea he was starting a career Twitter:@tkrpata Email: krpatasec@gmail.com For copies of the slides and additional materials please see the DEF CON 18 Archive here:
Related talks
Main Stage·40 min
Nassim Asrir · Zackary Flack
Discloses a pre-authentication remote code execution chain against Synology DSM, demonstrating how attackers achieve root compromise via the S2S protocol.
Main Stage·42 min
Anch
Anch provides a candid career roadmap for prospective penetration testers, covering necessary technical proficiencies, soft skills, and industry expectations.
Main Stage·53 min
Anch
Anch details the Monkey in the Middle: A pentesters guide to playing in traffic.