Other nomination

Internal Port Scanning via Crystal Reports

Joshua Abraham · Joshua "Jabra" Abraham · 2 December 2010

SAP BusinessObjects Crystal Reports exposes the backend host and port through user-controlled viewrpt.cwr parameters, defaulting to port 6400. Because open and closed ports return distinguishable errors - FWM 01005 for a reachable socket, FWM 01003 for none - the apstoken parameter becomes a server-side port scanner that maps internal networks without any client interaction.

Record

Researcher

Joshua Abraham

Published by

Joshua "Jabra" Abraham

Date

2 December 2010

In the archive

• Nominated for the 2010 Top 10 Web Hacking Techniques

Tags

• ssrf
• info-leak
• large-scale-scan
• detection
• case-study
• vendor-advisory
• owasp-a09-2021
• owasp-a10-2021

This page is the archive's own catalogue record. The research is the work of Joshua Abraham, first published at the original source. Preserved copies are kept so the citation survives its host.