How One File Upload Got Me the Entire Customer Database
How One File Upload Got Me the Entire Customer Database.
Summary
## Overview A NahamSec walkthrough of a real engagement where a single malicious file upload through an image-to-PDF conversion pipeline led to full customer database access.
## Recon and Target Selection Hired to reach crown-jewel data—not checkbox scanning—the tester mapped inputs and focused on upload features that pipe files through Ghostscript or similar converters, a recurring weak point.
## AI-Assisted Exploitation ChatGPT helped enumerate recent Ghostscript CVEs with public POCs from the past three years. The presenter automated uploading crafted PDFs across entry points until one payload yielded a shell.
## Takeaways File-conversion microservices are high-value targets. Combine manual app mapping with AI-assisted CVE research, but validate exploits hands-on—many payloads fail before one grants initial access.
Related talks
Black Hat·39 min
Security researchers examine technical aspects of ChaosDB: How We Hacked Databases of Thousands of Azure Customers (rev).
Black Hat·35 min
Analysts investigate attack surfaces and defenses concerning ChaosDB: How We Hacked Databases of Thousands of Azure Customers.
NahamSec·13 min
Hacking Websites With A Zip File (Zip Slip).