OWASP SAP Pentest Playbook

The SAP Pentest Playbook is a community-driven, open-source resource that documents practical techniques, tools, and methodologies for conducting penetration tests on SAP systems and landscapes. It is part of the OWASP Core Business Application Security (CBAS) project and aims to serve as a single, reliable point of reference for SAP security professionals, pentesters, and researchers.

The Playbook consolidates distributed, often outdated or hard-to-find knowledge into a structured and up-to-date guide that covers:

• SAP-specific attack vectors
• Misconfigurations and “works as designed” behaviors that can be exploited
• Reconnaissance, exploitation, and post-exploitation techniques
• Detection and mitigation considerations

Warning

Disclaimer: Make sure you have the appropriate permissions to actively scan and test applications. Without doing so, you might face legal implications

How to contribute

The SAP Pentest Playbook is community-driven — contributions from SAP security practitioners, researchers, and ethical hackers are welcome.

Ways you can contribute:

• Submit new techniques, tools, or case studies
• Update outdated content with current SAP versions and security measures
• Add detection and mitigation tips for the techniques described
• Review and improve documentation structure for clarity and usability

Contribution Process:

1. Fork the repository and create a feature branch
2. Add your contribution in the relevant section of the Playbook (Markdown format)
3. Include references, screenshots, or code samples where applicable
4. Submit a pull request with a clear description of your changes

Note

More information about contributing can be found at https://playbook.securitysilverbacks.com/Getting_Started/contribute/

Contributors

• Markus Rest (@xamafe) (Leader)
• Julian Petersohn (@randomstring) (Leader)
• Waseem Ajrab (@default-eshu)
• Marc Eisenhardt (@etk39372)
• Frederik Weidemann ()
• DaCodah (@DaCodah)
• Joris van de Vis (@kloris)

Supporters & Sponsors

Thank you to all our supporters and sponsors for their help and support to allow us to continue our work on the project.

Contact Us

Anyone interested in supporting, contributing or giving feedback join us in our discord channel