Conferences - leHACK

leHACK TRACKS

conferences TRACK View track >

27/06/2025

10:30

From HTML Injection to Full AWS Account Takeover: Discovering Critical Risks in PDF Generation

Modern web applications often provide features like PDF generation to enhance user experience, but these functionalities can inadvertently introduce critical vulnerabilities when improperly secured. During a recent penetration test, we identified a severe HTML injection vulnerability in the PDF file generation feature of two separate applications. Exploiting this weakness, we demonstrated the potential to perform Server-Side Request Forgery (SSRF) attacks, enabling access to internal files and sensitive application source code. This session provides a detailed, real-world example of how a seemingly minor vulnerability can have catastrophic consequences. It emphasizes the importance of secure development practices, robust cloud configurations, and proactive vulnerability mitigation. Attendees will walk away with practical strategies to strengthen their security posture, making this talk both educational and actionable.

Raunak Parmar

11:15

Up and Down Technique: Exposing Hidden Data from RAG Systems

Retrieval-Augmented Generation (RAG) systems have revolutionized how LLMs (Large Language Models) access "additional" knowledge, powering everything from enterprise chatbots to cutting-edge research tools. However, their architecture, designed to integrate text chunks to give additional context to prompts, also opens the door to innovative data exfiltration techniques. In this talk, titled "Up and Down Technique: Exposing Hidden Data from RAG Systems", Pedro presents a technique he discovered that enables adversaries to systematically extract sensitive information from RAG applications via prompt injection. During this talk, we’ll deep dive into the internals of RAG systems by analyzing their architecture, embeddings, vector databases, and prompt anatomy. Pedro will demonstrate, using real-world examples, how attackers can exfiltrate data from documents via carefully crafted prompt injections. More importantly, the presentation will provide a set of comprehensive mitigation strategies. Designed for red teamers, bug bounty hunters, developers, CISOs, and cybersecurity enthusiasts, this talk bridges the gap between theoretical vulnerabilities and practical, actionable defense strategies, equipping security professionals with the knowledge they need to protect modern, AI-powered applications against emerging threats.

Pedro Paniago

14:00

Cache me if you can, smuggling payloads via browsers caching systems

Malware deployment is a critical stage during a red team exercise, as it allows redteam operators, if performed successfully, to gain access to a target’s internal network. For a while, the easiest way of delivering malwares was to send an email with an attachment, the malware itself. Although this technique still sometimes works, blue teams are monitoring it more and more, and numerous security tools were created to block such attachments. As such, it was necessary to find others ways of delivering malwares. This presentation introduces one, cache smuggling, which leverages browser caching mechanisms to bypass traditional security defenses and deliver malwares. Additionally, we will see that such mechanisms can be used to facilitate silent reconnaissance of internal networks as well as information gathering and, finally, how you can protect your company and yourself against it.

Aurélien Chalot

14:45

Quantum computing demystified: A beginner’s guide and cybersecurity implications

This talk will give an understanding of basic quantum computing principles, the importance of PQC, the role of QKD in secure communications, and the transformative impact of quantum technologies on the cybersecurity landscape. We will overview the concepts of quantum computing, by providing a foundational understanding for beginners and explore the implications for cybersecurity. 1. Basics of quantum computing: explanation of key concepts: qubits, superposition, entanglement, quantum gates. 2. Introduction to quantum programming (Q#) with simple examples 3. Quantum computing and cybersecurity: - Post-Quantum Cryptography (PQC): - Quantum Key Distribution (QKD): 4. Quantum Attacks and Cybersecurity Implications: What is possible today an in the (near) future with the threat posed by quantum computers to current encryption standards?

Robin Descamps

Robin is a consultant and ethical hacker leading and executing penetration testing, red & purple teaming, and security research projects for various clients, aiming to identify their cyber vulnerabilities and mitigate their risks. He contributed to improving the security of several companies, such as Deutsche Telekom, BMC Software, and Pydio, by uncovering and reporting multiple 0-day vulnerabilities. He recently got interest in quantum computing security, being involved in several related events. His classic background allows him to demistify quantum computing from a “classic hacker” point of view rather than a specialised researcher.