Saumil Shah
Saumil is an internationally recognised speaker and instructor, having regularly presented at conferences for 26 years. He has authored two books and a number of papers, a few of which made it to the prestigious PoC||GTFO.
Saumil graduated with an M.S. in Computer Science from Purdue University. He spends his leisure time breaking software, designing tabletop games, taking pictures and searching for tigers in the forests of India.
Session
"A good exploit is one that is delivered in style". 10 years ago, I created and presented, at Hack.LU, a practical exploit delivery mechanism using steganography and polyglots involving JPEG images. With SVGosploit, I present a practical solution for embedding undetectable malicious content within SVG files. This talk explores the internals of SVG files, candidate locations for data hiding, density of data that can be hidden and tools to demonstrate in-browser extraction of steganographic content.
While the world is focussing on bug hunting at scale, techniques that fly below the radar and stay hidden in plain sight equally contribute to a larger impact in the whole offensive cybersecurity theatre.