NoLimitSecu #551 - Sécurité des ERP

Value of the Information & Strength of the Argument

The video provides substantial value by demystifying SAP security for a technical audience. It covers a broad range of topics including architecture, attack vectors, auditing practices, and available tools, all presented from a practitioner’s perspective. The argumentation is coherent, drawing analogies between SAP and Active Directory to make complex concepts accessible. The speaker supports his claims with references to specific CVEs and recent security incidents (e.g., the zero-day exploited in 2025), which strengthens the credibility of his arguments. However, the discussion is primarily conversational rather than rigorously systematized; some practical details (e.g., exact configuration parameters) are not fully elaborated, but the overall reasoning is sound and grounded in real-world experience.

Scientific Rigor, Source Quality, Title Accuracy

Scientific rigor is moderate; the information is largely experiential, and while the speaker mentions security events and tools, he does not provide formal citations beyond a few GitHub links in the description. The sources listed are relevant and credible (pysap, sncscan, and the SAP_GW_RCE_exploit), and they align closely with the content discussed. The title is accurate, as the episode directly addresses ERP security with a focus on SAP. The absence of chapters makes navigation harder, but the discussion flows logically. No public comments were provided for analysis, so audience reception cannot be assessed.

The title accurately reflects the content, which focuses on ERP security with a deep dive into SAP.

8/10

The discussion is led by a security expert with hands-on experience in SAP penetration testing, referencing real CVEs and providing detailed technical insight. The information is consistent with known SAP security challenges, though it relies primarily on personal experience rather than formal citations.

Markers derived by PSI from the transcript: the creator did not define chapters.

• 02:00Guest introduction: Wael Feguiri presents himself and his role in SAP security.
• 05:00Definition of SAP and ERP, and explanation of why SAP is a critical target.
• 08:00Evolution of SAP security: increase in CVEs and shift from research to in-the-wild exploitation.
• 12:00SAP architecture: ABAP platform, basis, proprietary protocols (RFC), and analogies to Active Directory.
• 18:00Auditing methodology: architecture review, penetration testing with assumed breach, and ABAP source code review.
• 24:00Open-source tools for SAP: pysap, sncscan, SAP_GW_RCE_exploit, and announcement of SAExec.
• 29:00The role of LLMs in reverse engineering SAP kernels and discovering CVEs.
• 33:00Cloud deployments (SAP RISE, BTP) and the shared responsibility model; advice for pentesters to specialize.

• OWASP/pysap — Library for interacting with SAP protocols, used in the episode for network-level attack automation.
• usdAG/sncscan — Tool for scanning SAP RFC interfaces without authentication, mentioned as an open-source utility.
• chipik/SAP_GW_RCE_exploit — Exploit for SAP Gateway remote code execution, based on pysap, illustrating practical exploitation.