Owning SAML

Owning SAML

Exploiting a SAML Implementation During a recent web application test, I discovered a bug in a Security Assertion Markup Language (SAML) implementation. This bug involved an insecure implementation of a SAML feature combined with a custom authentication mechanism our...
Ulterius Zero Day Disclosure

Ulterius Zero Day Disclosure

Every now and then, an regular penetration test project can take a decidedly irregular detour into the land of zero-day exploits.  In October 2017, I discovered a zero-day vulnerability in Ulterius, a widely used, open-source remote access software. Come along. I have...
Ulterius Zero Day Disclosure

Ulterius Zero Day Disclosure

Every now and then, an regular penetration test project can take a decidedly irregular detour into the land of zero-day exploits.  In October 2017, I discovered a zero-day vulnerability in Ulterius, a widely used, open-source remote access software. Come along. I have...