Research On Defect Detection Techniques Of SAP Netweaver

SAP is one of the biggest vendors for enterprise management products and collaborative e-commerce solutions.It provides a full range of softwares and applications for enterprise management,covering all sectors of the business needs.Due to its important information values and complicated architectures,SAP systems have gradually become the targets of APT attacks and large-scale vulnerability exploiting attacks.NetWeaver is the most important technical application platform of SAP systems,as well as the base of Service-Oriented Architecture.Although its security policies are rich and powerful,NetWeaver servers still have some flaws,such like misconfigurations,lack of authentication,information disclosure and so on.Once preparing well,hackers will be able to get full privileges,execute remote commands and dump sensitive data.Based on knowledge of SAP architecture and communication formula,as well as deeply understanding of how critical components work,an experiment environment for NetWeaver defect detection is established.Based on analysis of source codes and experiments,flaws of NetWeaver are described and detection techniques are introduced,which proved to be utilized by hackers to get full privileges,execute remote commands and dump sensitive data.For existed solutions for SAP security are neither open-source nor easy to extend,also open-source frameworks like Metasploit with separated detection modules can not be applied for practical requirements,an automatic detection platform is designed and implemented.This platform is described with the design of architectures,process flows,functional modules and databae tables.It can integrate separated detection techniques into automatic detection processes,which will provide complete security evaluation of SAP systems with visual user interfaces.