AS ABAP’s security behavior - password policy and lockout, SSO ticket acceptance, RFC Gateway ACL enforcement, RFC authority checks, SNC encryption, audit logging - is governed by kernel profile parameters. They are set per instance in DEFAULT.PFL and the <SID>_<INST>_<host> instance profiles, merged at startup (instance value overrides DEFAULT.PFL), and many are readable - some dynamically settable - at runtime.
Pulling these values is a high-yield recon step: one parameter sweep tells you how hard the target is before you spend effort on any specific attack path, and each parameter maps directly to a technique page. This page is the catalog of the parameters worth reading and what a secure vs. exposed value looks like; the attack pages linked per row carry the actual exploitation.
Warning
The profile value on disk is not necessarily the value the kernel is enforcing. Dynamically-switchable parameters can be flipped at runtime via RZ11 and revert on the next restart with no profile change. Always confirm the running value, and see Profile Parameter Drift & Runtime Config Tampering for why the disk value can lie.
Options
How to read the values, cheapest first:
RFC path (no special authorization) - PFL_GET_SINGLE_PARAMETER (function group SPFL) is remote-enabled and callable by any authenticated RFC user; returns the live runtime value (reflecting any RZ11 dynamic change since the last restart). A general-purpose, any-parameter read primitive - not limited to a single module’s scope.
OS-access path - read DEFAULT.PFL plus every discovered <SID>_<INST>_<host> instance profile via an existing OS-exec/sapxpg foothold (e.g. base64 <path>). Instance values override DEFAULT.PFL, matching SAP’s profile-merge order.
Running value from OS - sapcontrol -nr <NN> -function ParameterValue <parameter> returns what the kernel is actually enforcing, catching runtime drift from the profile.
Native SAP tcodes/reports - RZ11 (single parameter, shows “Resulting Source”), RZ10 (profile maintenance), report RSPFPAR / RSPARAM (dump the full merged parameter set).
Live ICM listener cross-check - ICM_GET_INFO (RFC, no input) returns the actually-running icm/server_port_* HTTP/HTTPS listeners, catching drift from RZ11-configured-but-unapplied ports.
Security-relevant parameter catalog
Secure values follow the SAP Security Baseline Template (SAP Note 2253549) where it specifies one; exact recommended integers vary by baseline version and NetWeaver release, so treat the “secure value” column as the hardening target to compare against, not a fixed constant. <!-- VERIFY: confirm the exact recommended value per the target's baseline version before reporting a parameter as mis-set. -->
login/* - authentication, password policy, SSO
Parameter
Secure value
Exposure if mis-set
Related
login/no_automatic_user_sapstar
1
0 re-enables the hardcoded SAP* fallback (password PASS) after the DB user row is deleted
Namespaces not enumerated above (icm/*, rdisp/gui_auto_logout, rec/client table logging, login/password_expiration_time, login/password_compliance_to_current_policy) are also worth pulling in a full sweep; this catalog covers the parameters that map to a documented attack path in this playbook, not the complete baseline. A three-parameter pull is not a hardening assessment - cross-check the full set against the SAP Security Baseline Template (SAP Note 2253549), where “Profile parameters” is one of six baseline pillars.
Detection and Monitoring
Note
A scripted sweep of many specific parameter names in quick succession from one RFC session is an unusual pattern - legitimate Basis administration reads parameters interactively via RZ11, not via automated sweep. Function-module call logging (ST05 / gateway logging / Security Audit Log RFC-call class) on SPFL-group RFCs (PFL_GET_SINGLE_PARAMETER) from non-Basis-admin users is the detection point. The same signature applies to rsau/* sweeps noted in Logging & Detection Surface.
