Talks and presentations at conferences on Martin Gallo

pysap: protocols, tools and offensive capabilities for SAP security - YOLO edition

Thu, 24 Sep 2026 00:00:00 +0000

Abstract (English)

pysap is an open-source offensive security framework for understanding, crafting, and interacting with proprietary SAP network protocols.

This talk looks at why the project was created, how it evolved from protocol research into a reusable offensive capability, and what that enables in practice. Through technical demos, we’ll explore how pysap can be used to inspect, manipulate, and experiment with SAP protocols.

We’ll also look at how AI changes the research workflow. By combining AI-assisted research with reusable offensive tooling, researchers can move faster from hypothesis to experimentation and validation.

The Enterprise Passkey: Security You Control, Simplicity Users Love

Mon, 13 Oct 2025 00:00:00 +0000

Abstract

Passwordless is here, but not all passkeys are created equal, especially within the enterprise. This presentation bridges the gap between consumer trends and corporate security needs, unveiling the Enterprise Passkey: your blueprint for deploying a truly secure, user-friendly, and scalable authentication future. See how phishing-resistant, non-syncable passkeys, when anchored by strong identity verification, become the cornerstone of trust for the entire employee lifecycle. We’ll show you how this powerful combination redefines critical processes like Day One onboarding, instant account recovery, and secure help desk access — enabling you to build lasting resilience, slash support costs, and finally eliminate user friction.

Recent Identity Threats and Trends: Lessons to Improve Identity Security

Fri, 25 Jun 2021 00:00:00 +0000

Abstract

As organizations modernize access architectures, attackers continue evolving their tactics to target identity infrastructure, session tokens, and authentication pipelines. This presentation examines recent real-world identity attack vectors mapped across modern threat frameworks (including MITRE ATT&CK techniques such as credential forging, token manipulation, input prompt capture, and session hijacking). The talk explores lessons learned from observed compromises and outlines actionable engineering strategies to strengthen enterprise identity posture and authentication resilience.

BIZEC Discussion Panel: Past, Present and Future of SAP Security

Wed, 20 Mar 2019 00:00:00 +0000

Abstract

Join us on this expert discussion panel where SAP Security experts from BIZEC organization will analyze how SAP Security has evolved over the last ten years, including not also the product security, but also the adoption and best practices of the companies side.

What are the biggest bugs in SAP? It is getting more difficult to find bugs in SAP products? How companies have adopted (or not) SAP Security measures? What’s the future of SAP and ERP Security? Those are some of the questions that would drive this discussion panel about past, present and future of SAP Security.

Hunting crypto secrets in SAP systems

Wed, 14 Mar 2018 00:00:00 +0000

Abstract

If you’re securing things in a proper way, cryptographic material should be all around your SAP systems: for protecting communications with HTTPS, TLS and SNC, Single-Sign-On, digital signatures and so on. Ever wondered how SAP systems stores that credentials and cryptographic keys in your system? Do you know if your private keys are properly protected? Succeed at a pentest and want to know how to extract and what to do with crypto secrets from a compromised host?

Intercepting SAP SNC-protected traffic

Wed, 22 Mar 2017 00:00:00 +0000

Abstract

SNC (Secure Network Connections) is SAP’s standard security mechanism for protecting communications from clients to servers and between SAP servers. This security layer works with SAP protocols like RFC or DIAG, and strengthen the security of them by using additional security functions. While not enabled by default, its use rate has increased since SAP started shipping it in all kernel versions. Now it can be observed implemented on large and small organizations for preventing active attackers or eavesdroppers.

Deep-dive into SAP archive file formats

Wed, 16 Mar 2016 00:00:00 +0000

Abstract

SAP systems make use of custom archive file formats in several different places, such as for distributing software components and in the code transport mechanism. While the compression algorithms used by SAP have been known for a few years, they were only targets of security analysis recently. Additionally, the file formats are proprietary and there is not much public information about how to properly interpret such files.

This talk will shed some light over the compression algorithms and the CAR and SAR file formats, while demonstrating some potential attack vectors involving this type of files. Moreover, we’ll discuss how to dissect and examine these files for both offensive and defensive purposes, using an open source Python library.

HoneySAP: Who really wants your money?

Wed, 18 Mar 2015 00:00:00 +0000

Abstract

Targeted attacks against ERP systems and enterprise software are not something new, however they only started appearing in the media in recent years. On the other hand, we also have new kinds of attacks by means of malware and malicious programs. Understanding the motivations and techniques adversaries use to target systems where company’s most valuable assets reside is crucial to understand the nature of the attacks and the defense strategies.

SAP’s Network Protocols Revisited

Wed, 19 Mar 2014 00:00:00 +0000

Abstract

What network protocols does my SAP system use? Are those services secure from a network perspective? Are old and well-known attacks still relevant? What’s the remote attack surface of my SAP environment? Do I really know my level of exposure? Are there tools available to assess the security of the services?

This talk is the result of my journey trying to answer these questions and understanding how the different SAP network protocols work, after spending some of my spare time during the last months working on expanding my knowledge about the network attack surface of SAP systems, reversing some of the protocols and implementing tools and libraries to work with them.

Uncovering SAP vulnerabilities - Reversing and breaking the Diag protocol

Wed, 26 Sep 2012 00:00:00 +0000

Abstract

Nowadays, SAP Netweaver has become the most extensive platform for building enterprise applications and running critical business processes. In recent years it has become a hot topic in information security, at a time when headlines about hacks against SAP systems increase every day. Although fixes and countermeasures are released monthly by SAP at an incredible rate, the available security knowledge is limited and some components are still not well covered.

Uncovering SAP vulnerabilities - Reversing and breaking the Diag protocol

Thu, 26 Jul 2012 00:00:00 +0000