1. Team RISC

2. Our story of Jail break !

3. Aim
Find zero day in Joomla
( I'm-possible in 36 Hrs ;) )

4. Eating only this ...

5. Why Joomla/Gymla ?
● Challenge !
● Learn exploitation in complex
web applications
● IBM X-force paper on CMS
security.

6. Vulns in Drupal

7. Vulns in Wordpress

8. Vulns in Joomla

9. How its generally
done ?
0 day vulnerability
Source code Fuzzing
Auditing

10. What we did ?

11. Methodology

12. Know your enemy
If you know your enemies and know yourself, you will not be
imperiled in a hundred battles
-- Sun Tzu, the art of war

13. Set up the Attacking
environment

14. Study the Joomla
architecture

15. Components,
modules, plugins

16. Source code
Auditing
● Identify vulnerable Functions
● Analyze the entry points
● Analyze Input Validations.

17. The entry points

18. More ...

19. Few more ...

20. Exec call

21. RIPS output

22. Fuzzing
● Find the entry points
● SQL Injection
● XSS
● CSRF
● Command Injection
● Click Jacking with Drag and drop

23. JBroFuzz

24. Clickjacking

25. Tools used for Source
code auditing
● The mighty grep
● RIPS
● RATS

26. Tools used for Fuzzing
JBroFuzz
Burp Suite
WebScarab

27. References
● http://www.exploit-db.com/papers/15780/
● Burp Suite
● http://www.amazon.com/Fuzzing-Brute-Force-Vulnerability-Discovery/dp/0321

28. Thanks to ...
Omair, Amol Naik, Null team
and especially our Jailer

29. Questions ?
हैकर हैक्या ? हैकर