SAP Security Training
SAP Through the Eyes of an Attacker
A four-hour, hands-on offensive training on the SAP stack for penetration testers and red-team operators - covering reconnaissance, credential recovery, privilege escalation and pivoting across SAP ABAP, Java, HANA and BTP.
Request training See the agendaWhat is the RedRays SAP security training?
The RedRays SAP security training is a four-hour, hands-on offensive course that shows penetration testers and red-team operators how to attack SAP systems - and how SAP can be used to move into and out of the Windows domain. The whole session follows one end-to-end scenario, from unauthenticated network access to domain compromise, so every technique builds on the previous one.
Course overview
Because it assumes existing offensive skills - reconnaissance, exploitation, privilege escalation, lateral movement and OPSEC - the SAP security training focuses on SAP-specific knowledge: the architecture of SIDs and instances, RFC destinations, ICF services, transactions, and where SAP stores and encrypts credentials. Each module follows a complete attack path rather than a list of CVEs.
The session runs on a RedRays lab against real S/4HANA, NetWeaver AS Java and Cloud Connector systems, with live demonstrations at each stage, and recorded demos as a fallback. Participants also take home a toolkit of scripts and decryptors for their own engagements. Finally, the depth of each block is adjusted to the group's level.
Agenda
The SAP security training runs four hours: eight modules that follow one continuous attack scenario, from an unauthenticated port scan to the Windows domain.
Part 1 Foundations & ABAP
01 · Introduction 00:00 · 10 min
RedRays and its SAP security research, and why SAP is so often out of scope for red-team engagements, even though it holds an organisation's financial, HR and business data.
02 · SAP for penetration testers 00:10 · 30 min
The three stacks (AS ABAP, AS Java, BTP), how SID and instance number define the ports, and the protocols that matter - DIAG, RFC, P4/RMI, Message Server, Enqueue, ICM/ICF. It also covers where SAP keeps credentials: USR02, RSECTAB, SECSTORE, SSFS, saplogon.ini, SAPUILandscape.xml. Live demo: mapping an S/4HANA landscape from an nmap scan.
03 · SAP defensive controls 00:40 · 18 min
Before the attacks: the authorization model (authorization objects, PFCG roles, profiles), SAP_ALL and cloned SAP_ALL-like roles that SUIM does not flag by name, gateway ACLs (reginfo/secinfo), UCON, SNC, and the Security Audit Log - often disabled by default - and where each control is weak.
04 · S/4HANA & ABAP - core module 00:58 · 72 min
Then, a full chain from an unauthenticated port to an OS shell as <sid>adm and the domain credentials on the host: unauthenticated recon, default accounts (SAP*, DDIC), USR02 password hashes and hashcat recovery, the RFC credential trove (SM59, RSECTAB, SECSTORE, SSFS) and trusted-RFC hops, SAP_ALL and debug-mode privilege escalation, OS command execution, the HANA database, and the Enqueue / Message Server "phantom attacker". Live demo: from a port scan to an OS shell as <sid>adm.
Part 2 Java, Cloud & BTP
05 · NetWeaver AS Java 02:20 · 45 min
Java engine recon (irj/portal, 5NN00), the RECON authentication bypass (CVE-2020-6286), path traversal and unauthenticated file read, file upload to a JSP webshell, P4/RMI exploitation (CVE-2021-37535), and Java credential-store recovery (CVE-2016-1910, SecStore decryption). The secure-store tooling from the ABAP module also applies here.
06 · SAP Cloud Connector 03:05 · 20 min
Because the connector is an authorized tunnel from BTP into the on-premise network, it is a high-value target: cleartext passwords in logs, NTLM hijacking to capture domain hashes, command execution on the connector host, and SSFS decryption of the configured backend credentials. As a result, it is the primary path from SAP back into the Windows domain. Live demo: decrypting the connector's SSFS store and enumerating the mapped on-premise systems.
07 · BTP: Integration Suite (CPI) & CAP 03:25 · 25 min
CPI: iFlow script code execution, exposed keystores and credentials, secrets leaked in Message Processing Logs, and the CPI → Cloud Connector → on-premise path. CAP: broken access control, OData IDOR and XSUAA misconfiguration.
08 · Detection & OPSEC 03:50 · 10 min
Finally, five detection techniques (malicious JSP shells, unsigned files, auto-start persistence, request-frequency anomalies, 401 patterns), what is and is not logged (SM20, SM21, gateway log, ICM httpaccess, DBTABLOG, CPI MPL), and which techniques from the session are detectable. The SAP security training then closes with the toolkit handover and Q&A.
Total 240 minutes · 10-minute break at 02:10 · six live demonstrations · Q&A at the end
Learning outcomes
By the end of the SAP security training, each participant can:
Map an SAP landscape
Fingerprint stacks, instances and services from the outside, then identify services by port.
Recover SAP credentials
Locate and decrypt SSFS, SecStore, RFC and USR02 secrets across ABAP, Java and cloud.
Pivot between SAP and the domain
Go from network access to <sid>adm to the Windows domain, while knowing the logging each step generates.
Toolkit included. Every tool is demonstrated during the session and handed over to participants: decryptors for SAP secure stores and RFC passwords, password-hash export and cracking recipes, SAP port-scanning and service-mapping helpers, enumeration checklists and testing profiles for SAP HTTP interfaces, and Integration Suite and CAP/BTP scan checks.
Instructor
Vahagn Vardanian
15+ years in SAP security research, author of the SAP Security Benchmark for CIS, and credited with 150+ zero-day vulnerabilities in enterprise business applications. Vahagn has also presented at Black Hat, DEF CON, Troopers, Hack in Paris, NorthSec and OWASP.
Put your skills to work
Pair the SAP security training with hands-on services from the same team.
SAP security training FAQ
What is the RedRays SAP security training?
A four-hour, hands-on offensive SAP security training for penetration testers and red-team operators. It follows one end-to-end attack scenario - from unauthenticated network access to domain compromise - across SAP ABAP, S/4HANA, HANA, AS Java, Cloud Connector and BTP, with live demonstrations on a RedRays lab.
Who should attend the SAP security training?
In particular, penetration testers and red-team operators who want to bring SAP into scope. The detection and OPSEC block is also relevant for incident-response and blue teams.
Is the training online or on-site?
It is a four-hour live online session with hands-on labs as well as live demonstrations. RedRays provides the full lab (S/4HANA, AS Java, Cloud Connector, BTP) and recorded demonstrations as a fallback, so the session does not depend on network access.
Do I need prior SAP security experience?
No SAP experience is required, but the training is advanced: it assumes existing offensive skills - reconnaissance, exploitation, privilege escalation, lateral movement and OPSEC - and focuses on SAP-specific knowledge. Still, the depth of each block is adjusted to the group's level.
What topics does the agenda cover?
Eight modules: an introduction, then SAP for penetration testers, SAP defensive controls, S/4HANA and ABAP (including the HANA database), NetWeaver AS Java, SAP Cloud Connector, BTP Integration Suite (CPI) and CAP, and finally detection and OPSEC.
What do participants take away?
A toolkit of scripts and decryptors for SAP credential recovery, enumeration checklists and BTP scan checks - each demonstrated during the session - to use in their own engagements.
Request the SAP security training
Tell us your team size, current SAP experience, preferred time zone and focus area (for example BTP/cloud or on-premise ABAP) - we'll send a tailored outline.