Looting the Symfony profiler with EOS

Display subtitles automatically

None
In the preferred language only when the video is using another
Always in the preferred language
Always in the original language of the video

Preferred language:

Qualities

UbiCast player x

Keyboard shortcuts

Key

Action

K or space

Play / Pause

Mute / Unmute

Select next subtitles

Select next audio track

Show slide in full page or toggle automatic source change

left arrow

Seek 5s backward

right arrow

Seek 5s forward

shift + left arrow or J

Seek 10s backward

shift + right arrow or L

Seek 10s forward

control + left arrow

Seek 60s backward

control + right arrow

Seek 60s forward

shift + down arrow

Decrease volume

shift + up arrow

Increase volume

shift + comma

Decrease playback rate

shift + dot or shift + semicolon

Increase playback rate

end

Seek to end

beginning

Seek to beginning

Loading Click here to add:

Information on this media

Number of views:

134 (this month: 3)

Creation date:

June 30, 2020

Speakers:

Matthieu Barjole

License:

CC BY-SA v4

Description

Based on https://www.synacktiv.com/posts/pentest/looting-symfony-with-eos.html. Symfony is a popular open source PHP framework to create web applications. When configured with development parameters, Symfony exposes a sensitive component: the web profiler. This interface implements debug features to help developers identifying bugs while working on the application. However, as an attacker, multiple pieces of information are available to loot: configuration files, user credentials and even the application source code.

Exposing such features in a production environment is very dangerous and to gather all this intel, Synacktiv recently developed an open source tool named EOS (https://github.com/synacktiv/eos).

In this presentation, I would like to describe the different features provided by the profiler and how EOS exploits them to extract the valuable information.

Speaker

Matthieu Barjole (Synacktiv)