SAPMAP Joins OWASP: Attack Path Mapping for SAP Landscapes

SAP runs the world’s payroll, ledgers, and supply chains. Until now, it was hard to see how an attacker moves through it.

After initially being restricted to defenders, SAPMAP — the SAP Landscape Attack Path Mapper — has now been released as an open-source project under the OWASP Core Business Application Security (CBAS) umbrella, licensed under GPL v3.

SAPMAP discovers SAP systems on a network, maps the RFC trust and other relationships between them, exercises known vulnerabilities, and renders the whole landscape as an interactive attack graph where possible.

SAPMAP does not start from scratch. The SAP security community has produced excellent open-source work for years — protocol libraries, scanners, exploit proofs of concept — and much of it is what makes SAPMAP possible.

What was missing was the connective tissue: those tools each answer one question well, and stitching their output into a single picture of a landscape was manual work that got redone on every engagement. SAPMAP is that stitching, done once and shared.

This is also why the project belongs in OWASP rather than in a personal namespace. A tool built on the community’s work should sit in a vendor-neutral home with a public issue tracker, a contribution process, and a license that keeps it open — next to the projects it draws on rather than off to one side of them.

Read more about the background behind SAPMAP.

The Visibility Gap

Ask a security team to draw their AD attack paths and most hopefully can, at least roughly. Ask the same team about SAP and the conversation usually stops at “the Basis team handles that.”

That gap is not negligence — it’s tooling. An SAP landscape is a mesh of production, QA, development, and Solution Manager systems bound together by RFC destinations, many carrying stored credentials, plenty of them pointing from low-trust systems into high-trust ones.

Each hop is documented somewhere. The composition of those hops — the path from a forgotten sandbox to the production ledger — is documented nowhere.

What It Does

Built to Be Defended Against

An offensive tool that only helps offense is a liability. SAPMAP’s Detection & Defense documentation maps each exploit primitive to the SAP Note that closes it, names the configuration changes with the highest return — including secinfo/reginfo deny-by-default, Message Server ACLs, and least-privilege RFC destinations — and lists network-, OS-, and application-level detection signatures with guidance on what to feed into a SIEM.

The evasion techniques are documented too — including where they succeed. Every stealth feature ships with a description of the detection gap it exploits, because a defender who knows the gap can close it, and an attacker with the tool already knows.

On Releasing It

SAPMAP circulated privately in the SAP defender community before its public release, which gave blue teams time to deploy detections and apply patches ahead of publication.

That window is now closed, and continued restriction would protect the tool’s obscurity more than it protects anyone’s landscape.

The techniques SAPMAP uses are already documented publicly, including through SAP Notes and existing security research. What SAPMAP adds is accessibility and context: defenders can run it against their own estate and see how weaknesses can connect across an SAP landscape.

Detection engineers get real chains to build signatures against. Researchers get a shared platform instead of another private fork.

Getting Started

Getting started with SAPMAP is straightforward:

git clone https://github.com/SecuritySilverbacks/SAPMAP.git
cd sapmap
pip3 install -r requirements.txt
python3 sapmap.py

It launches a self-contained web GUI — no build step, no external JavaScript dependencies. The optional SAP NW RFC SDK enables authenticated operations.

Part of OWASP CBAS

OWASP CBAS brings together deception and adversary simulation, attack surface management, security posture validation, and SAP security research.

SAPMAP joins tools including HoneySAP, pysap, SAPKiln, sncscan, SAP Attack Surface Discovery, the SAP Pentest Playbook, the SAP Security Verification Standard, and the NO MONKEY Security Matrix — a stack that now runs from baseline controls all the way through to adversary emulation.