#NahamCon2022 - @infosec_au: Finding 0days in Enterprise Web Applications

Researcher and Target

Assetnote co-founder Shubham Shah explains finding zero-days in enterprise software, starting with HCL Digital Experience (IBM WebSphere Portal)—a widely deployed Java CMS often reachable via Docker Hub images for local auditing.

Mapping Attack Surface

After decompiling JARs, he maps WebSphere servlet routes before deep code review. A proxy.config.xml whitelist of IBM domains suggests an outbound proxy feature worth testing for SSRF.

Lotus Domino Redirect Chain

Although only IBM hosts are allowed, redbooks.ibm.com runs Lotus Domino with a documented logout redirect parameter. Chaining /wps/proxy/ requests through that redirect turns a restricted proxy into full-read SSRF to arbitrary internal URLs.

Variant Hunting

Searching for other proxy.config files reveals additional policies, including one permitting any HTTP method, body, and destination—effectively a "super SSRF." Multiple alternate proxy endpoints and document-picker proxies bypass naive WAF path rules, multiplying pre-auth impact across the codebase.