1
00:00:00,000 --> 00:00:03,000
00 , 00:00:02:03 ,    ALEJANDRO CACERAS: Hello, everyone.

2
00:00:03,000 --> 00:00:06,000
06 , 00:00:06:26 , So this talk won't be quite like other talks you might have

3
00:00:06,000 --> 00:00:09,000
26 , 00:00:08:18 , seen around.

4
00:00:08,000 --> 00:00:11,000
18 , 00:00:16:25 , It's going to be very demo heavy, and it's on 3D web visualization.

5
00:00:17,000 --> 00:00:20,000
13 , 00:00:21:28 , So congratulations, those of you who made it.

6
00:00:21,000 --> 00:00:24,000
28 , 00:00:24:16 , This is one of DEF CON's unofficial scavenger

7
00:00:24,000 --> 00:00:27,000
16 , 00:00:28:24 , hunts, finding the talk that isn't listed.

8
00:00:29,000 --> 00:00:32,000
09 , 00:00:35:29 , So if you are in the audience, you are a winner.

9
00:00:36,000 --> 00:00:39,000
05 , 00:00:40:15 , And if you are not in the audience and you are watching it on video, well,

10
00:00:40,000 --> 00:00:43,000
15 , 00:00:42:29 , better luck next time.

11
00:00:47,000 --> 00:00:50,000
03 , 00:00:49:22 ,    ALEJANDRO CACERAS: So I'm Alejandro.

12
00:00:51,000 --> 00:00:54,000
00 , 00:00:53:20 , I'm the owner of Hyperion Gray.

13
00:00:59,000 --> 00:01:02,000
00 , 00:01:02:02 , I want to find vulnerability in things.

14
00:01:02,000 --> 00:01:05,000
02 , 00:01:04:15 , So you will see a lot of that throughout the talk.

15
00:01:04,000 --> 00:01:07,000
15 , 00:01:06:19 , It's kind of a theme of mine, if you will.

16
00:01:06,000 --> 00:01:09,000
19 , 00:01:08:20 , I'm originally a web app pen tester, and started focusing

17
00:01:08,000 --> 00:01:11,000
20 , 00:01:11:08 , on software development after that.

18
00:01:11,000 --> 00:01:14,000
08 , 00:01:12:14 , I hope you like the tool.

19
00:01:12,000 --> 00:01:15,000
14 , 00:01:16:23 ,    TEAL ROGERS: And my name is Teal Rogers, I'm a maker, and

20
00:01:16,000 --> 00:01:19,000
23 , 00:01:21:21 , an interface developer, specializing in 3D.

21
00:01:22,000 --> 00:01:25,000
02 , 00:01:24:18 , We're actually a little bit ahead of time.

22
00:01:24,000 --> 00:01:27,000
18 , 00:01:29:07 , So this is a it's a 3D visualization of the web, which

23
00:01:29,000 --> 00:01:32,000
07 , 00:01:35:05 , is so    AUDIENCE MEMBER: You might want to take a moment

24
00:01:35,000 --> 00:01:38,000
05 , 00:01:38:05 , to fix your slides.

25
00:01:38,000 --> 00:01:41,000
05 , 00:01:39:24 , They are not on the screen.

26
00:01:44,000 --> 00:01:47,000
05 , 00:01:52:02 ,    TEAL ROGERS: They are not on the screen.

27
00:01:52,000 --> 00:01:55,000
02 , 00:01:54:16 ,    You have a monitor down here that you can see it.

28
00:01:54,000 --> 00:01:57,000
16 , 00:01:54:16 ,    ALEJANDRO CACERAS: It's not really a big deal, but then we want

29
00:01:54,000 --> 00:01:57,000
16 , 00:01:55:17 , to get into the demo.

30
00:01:55,000 --> 00:01:58,000
17 , 00:01:57:27 ,    AUDIENCE MEMBER: It will do the same thing.

31
00:01:57,000 --> 00:02:00,000
27 , 00:02:00:04 ,    AUDIENCE MEMBER: It's your resolution.

32
00:02:00,000 --> 00:02:03,000
04 , 00:02:02:07 ,    ALEJANDRO CACERAS: It should be okay.

33
00:02:02,000 --> 00:02:05,000
07 , 00:02:03:16 ,    TEAL ROGERS: All right.

34
00:02:07,000 --> 00:02:10,000
02 , 00:02:11:26 , So once again, congratulations, those of you who made it.

35
00:02:13,000 --> 00:02:16,000
07 , 00:02:16:04 , And we're just going to jump right into it.

36
00:02:16,000 --> 00:02:19,000
04 , 00:02:22:05 , Show you the program, and take you around it a little bit.

37
00:02:22,000 --> 00:02:25,000
05 , 00:02:25:27 , So this environment is you know what I can do, if it cuts

38
00:02:25,000 --> 00:02:28,000
27 , 00:02:28:10 , off the edge a little bit    AUDIENCE

39
00:02:28,000 --> 00:02:31,000
10 , 00:02:30:17 , MEMBER: Resolution.

40
00:02:30,000 --> 00:02:33,000
17 , 00:02:43:02 ,    TEAL ROGERS: I can move this over.

41
00:02:43,000 --> 00:02:46,000
02 , 00:02:44:28 ,    ALEJANDRO CACERAS: There you go.

42
00:02:51,000 --> 00:02:54,000
22 , 00:02:53:19 , A little bit more.

43
00:02:53,000 --> 00:02:56,000
19 , 00:02:54:29 ,    TEAL ROGERS: All right.

44
00:02:54,000 --> 00:02:57,000
29 , 00:02:56:26 , So this is basically our application.

45
00:02:56,000 --> 00:02:59,000
26 , 00:03:02:02 , It is a 3D environment and what you see here is domains.

46
00:03:02,000 --> 00:03:05,000
12 , 00:03:08:07 , Domains are represented as globes with graphics and stuff

47
00:03:08,000 --> 00:03:11,000
07 , 00:03:16:28 , and when a domain spawns this is smaller balls which represent pages.

48
00:03:16,000 --> 00:03:19,000
28 , 00:03:19:21 , So this is not attempting to reproduce a web browser

49
00:03:19,000 --> 00:03:22,000
21 , 00:03:22:02 , or anything like that.

50
00:03:22,000 --> 00:03:25,000
02 , 00:03:24:26 , It is giving metadata for the Internet, a sort

51
00:03:24,000 --> 00:03:27,000
26 , 00:03:28:14 , of a view that no one else is doing.

52
00:03:29,000 --> 00:03:32,000
03 , 00:03:35:21 , There's there's things that you can see from this this organization that you

53
00:03:35,000 --> 00:03:38,000
21 , 00:03:41:25 , can't see anywhere else except by, like, really digging into your HTML,

54
00:03:41,000 --> 00:03:44,000
25 , 00:03:46:26 , digging into what your code is doing, vulnerability scans,

55
00:03:46,000 --> 00:03:49,000
26 , 00:03:53:04 , using scanning software, which frankly, most people don't do.

56
00:03:53,000 --> 00:03:56,000
14 , 00:03:58:04 , So, we wanted to make it easy to do that.

57
00:03:58,000 --> 00:04:01,000
08 , 00:04:01:16 , And this is what this is designed to do.

58
00:04:01,000 --> 00:04:04,000
16 , 00:04:03:16 ,    ALEJANDRO CACERAS: Right now, what you are seeing this is running

59
00:04:03,000 --> 00:04:06,000
16 , 00:04:05:12 , in a test environment.

60
00:04:05,000 --> 00:04:08,000
12 , 00:04:07:24 , We have 15 to 20 websites.

61
00:04:07,000 --> 00:04:10,000
29 , 00:04:11:23 , Some of the websites have various vulnerabilities and some

62
00:04:11,000 --> 00:04:14,000
23 , 00:04:15:25 , of them have missed configures and odd things that make

63
00:04:15,000 --> 00:04:18,000
25 , 00:04:18:05 , a problem website.

64
00:04:22,000 --> 00:04:25,000
19 , 00:04:25:02 , If you are checking it out on your smartphone,

65
00:04:25,000 --> 00:04:28,000
02 , 00:04:28:19 , you can see those, things like Hyperiongray.com.

66
00:04:28,000 --> 00:04:31,000
27 , 00:04:33:18 , Some are Internet facing some after them are not.

67
00:04:33,000 --> 00:04:36,000
29 , 00:04:37:15 , So the first site we wanted to show you was DC graphics.

68
00:04:37,000 --> 00:04:40,000
15 , 00:04:41:29 , I will just show you real quick in the in the web browser, it's

69
00:04:41,000 --> 00:04:44,000
29 , 00:04:44:15 , a very small site.

70
00:04:44,000 --> 00:04:47,000
15 , 00:04:46:16 , It's basically a joke site, really.

71
00:04:46,000 --> 00:04:49,000
16 , 00:04:50:10 , It's two posts on Word Press, and I will just give it

72
00:04:50,000 --> 00:04:53,000
10 , 00:04:53:18 , a second here to reconnect.

73
00:04:53,000 --> 00:04:56,000
18 , 00:04:56:05 , You see, the connection is right there.

74
00:04:56,000 --> 00:04:59,000
05 , 00:05:00:25 , So it's a very small site in our environment, we do a crawl

75
00:05:00,000 --> 00:05:03,000
25 , 00:05:07:13 , in advance, and it maps all the links, so you can see a line from one page

76
00:05:07,000 --> 00:05:10,000
13 , 00:05:10:22 , to another page is a link.

77
00:05:10,000 --> 00:05:13,000
23 , 00:05:13:26 , And they are all directional because links are directional.

78
00:05:14,000 --> 00:05:17,000
05 , 00:05:16:24 , So the skinny end is where it's pointing to, the fat end,

79
00:05:16,000 --> 00:05:19,000
24 , 00:05:19:08 , it's kind of like an arrow.

80
00:05:19,000 --> 00:05:22,000
21 , 00:05:26:17 , So this is a this is a typical sort of Word Press side, if it's very small.

81
00:05:26,000 --> 00:05:29,000
23 , 00:05:30:22 , Larger Word Press sites have a core and then an outer core.

82
00:05:30,000 --> 00:05:33,000
22 , 00:05:34:10 , This one just has an inner core because it's too small

83
00:05:34,000 --> 00:05:37,000
10 , 00:05:36:24 , to have two cores.

84
00:05:36,000 --> 00:05:39,000
25 , 00:05:41:13 , So you see the cores is these sites here, and on the outside,

85
00:05:41,000 --> 00:05:44,000
13 , 00:05:45:26 , you see some feed sites, which that's what Word Press does,

86
00:05:45,000 --> 00:05:48,000
26 , 00:05:48:15 , it creates feed sites.

87
00:05:48,000 --> 00:05:51,000
22 , 00:05:53:04 ,    ALEJANDRO CACERAS: So back the end, the feeder is running,

88
00:05:53,000 --> 00:05:56,000
04 , 00:05:58:02 , to keep everything going and you have an updated view.

89
00:05:58,000 --> 00:06:01,000
24 , 00:06:01:20 , Right now you are seeing a snapshot in time.

90
00:06:02,000 --> 00:06:05,000
02 , 00:06:03:26 , The way that it's built on the back end, its

91
00:06:03,000 --> 00:06:06,000
26 , 00:06:07:18 , a hadoop based web controller/vulnerability scanner.

92
00:06:07,000 --> 00:06:10,000
23 , 00:06:11:06 , We can keep track of a number of websites.

93
00:06:12,000 --> 00:06:15,000
02 , 00:06:15:14 , The more websites we keep track of, all we basically have to do is scale

94
00:06:15,000 --> 00:06:18,000
14 , 00:06:17:27 , up a cluster which is really, really easy and that

95
00:06:17,000 --> 00:06:20,000
27 , 00:06:20:26 , will shorten our crawling time and collection of metadata and

96
00:06:20,000 --> 00:06:23,000
26 , 00:06:22:23 , all of that stuff.

97
00:06:23,000 --> 00:06:26,000
07 , 00:06:24:23 , You might recognize that as somewhat similar

98
00:06:24,000 --> 00:06:27,000
23 , 00:06:27:07 , to the Google model, how they are collecting metadata

99
00:06:27,000 --> 00:06:30,000
07 , 00:06:29:10 , and collecting websites.

100
00:06:29,000 --> 00:06:32,000
15 , 00:06:31:07 , Actually, the back end, it's an open source implementation

101
00:06:31,000 --> 00:06:34,000
07 , 00:06:33:17 , of exactly how Google is doing it.

102
00:06:33,000 --> 00:06:36,000
25 , 00:06:39:25 ,    TEAL ROGERS: Here's another site, it's Boonville lib, it's another joke site.

103
00:06:43,000 --> 00:06:46,000
13 , 00:06:45:24 , It's also written in Word Press.

104
00:06:45,000 --> 00:06:48,000
24 , 00:06:49:24 , It's a little bit bigger and has a few more posts and in a little bit here,

105
00:06:49,000 --> 00:06:52,000
24 , 00:06:53:28 , you will notice something strange, which is why we're focusing

106
00:06:53,000 --> 00:06:56,000
28 , 00:06:56:20 , on this one at the moment.

107
00:06:56,000 --> 00:06:59,000
27 , 00:07:04:19 , It has this link that will appear to a domain called 1.gravitar.com

108
00:07:04,000 --> 00:07:07,000
19 , 00:07:08:06 , and I made this site.

109
00:07:08,000 --> 00:07:11,000
29 , 00:07:12:26 , And I don't know what 1.gravitar.com is.

110
00:07:12,000 --> 00:07:15,000
26 , 00:07:15:15 , I haven't dug through the source code.

111
00:07:16,000 --> 00:07:19,000
04 , 00:07:21:20 , The only way I know that it's there, is through this API.

112
00:07:21,000 --> 00:07:24,000
20 , 00:07:22:20 , See, there it is.

113
00:07:22,000 --> 00:07:25,000
20 , 00:07:25:24 , See, we don't actually crawl 1.gravitar.com, that's why it looks look

114
00:07:25,000 --> 00:07:28,000
24 , 00:07:27:15 , a distortion.

115
00:07:28,000 --> 00:07:31,000
21 , 00:07:32:11 , One of the things about seeing the metadata

116
00:07:32,000 --> 00:07:35,000
11 , 00:07:39:02 , of the Internet's underbelly, you get to see that there are these weird links,

117
00:07:39,000 --> 00:07:42,000
02 , 00:07:45:15 , even if you made the site, you didn't know that they were there.

118
00:07:45,000 --> 00:07:48,000
24 , 00:07:47:02 ,    ALEJANDRO CACERAS: By the way, does anyone know what

119
00:07:47,000 --> 00:07:50,000
02 , 00:07:48:17 , 1.gravitar.com is.

120
00:07:48,000 --> 00:07:51,000
17 , 00:07:54:19 ,    AUDIENCE MEMBER: It's your picture, the email that you use

121
00:07:54,000 --> 00:07:57,000
19 , 00:08:02:18 , for your email name, it's a gravitar, it pulls up a picture.

122
00:08:02,000 --> 00:08:05,000
18 , 00:08:05:15 ,    ALEJANDRO CACERAS: So we needed a 3D map and a dude

123
00:08:05,000 --> 00:08:08,000
15 , 00:08:09:13 , in the audience to tell us what that was.

124
00:08:11,000 --> 00:08:14,000
02 , 00:08:11:24 , So next up, Teal will show

125
00:08:11,000 --> 00:08:14,000
24 , 00:08:13:24 , us punkspider.hyperiongray.com.

126
00:08:18,000 --> 00:08:21,000
02 , 00:08:20:09 , Has anyone heard of PunkSPIDER project?

127
00:08:21,000 --> 00:08:24,000
05 , 00:08:22:15 , That guy?

128
00:08:22,000 --> 00:08:25,000
29 , 00:08:24:10 , No, he was fidgeting.

129
00:08:24,000 --> 00:08:27,000
10 , 00:08:25:12 , Yeah, my girlfriend.

130
00:08:26,000 --> 00:08:29,000
07 , 00:08:28:15 , So this is PunkSPIDER.

131
00:08:28,000 --> 00:08:31,000
15 , 00:08:31:20 , It is a distributed vulnerability search engines which was a precursor

132
00:08:31,000 --> 00:08:34,000
20 , 00:08:33:09 , to web 3.0.

133
00:08:33,000 --> 00:08:36,000
18 , 00:08:37:17 , It's not in 3D, it's not quite that fancy, but it does use

134
00:08:37,000 --> 00:08:40,000
17 , 00:08:42:06 , a distributed vulnerability scanner that I wrote that gives you back

135
00:08:42,000 --> 00:08:45,000
06 , 00:08:48:23 , vulnerabilities much like web 3.0 does, which we will get into a little bit later.

136
00:08:49,000 --> 00:08:52,000
26 , 00:08:56:17 , On the whack end    TEAL ROGERS: It kind of froze up here a little bit,

137
00:08:56,000 --> 00:08:59,000
17 , 00:09:00:23 , but this is a production platform.

138
00:09:00,000 --> 00:09:03,000
26 , 00:09:03:18 , Oops, not that one.

139
00:09:03,000 --> 00:09:06,000
18 , 00:09:08:02 , And we're still tracking down all the stuff.

140
00:09:08,000 --> 00:09:11,000
02 , 00:09:09:29 , It's real easy to restart it.

141
00:09:09,000 --> 00:09:12,000
29 , 00:09:11:17 ,    ALEJANDRO CACERAS: Yeah.

142
00:09:11,000 --> 00:09:14,000
17 , 00:09:12:17 , It's a prototype.

143
00:09:12,000 --> 00:09:15,000
17 , 00:09:14:18 ,    TEAL ROGERS: Sorry to interrupt you.

144
00:09:14,000 --> 00:09:17,000
18 , 00:09:16:23 ,    ALEJANDRO CACERAS: What I was saying about PunkSPIDER no,

145
00:09:16,000 --> 00:09:19,000
23 , 00:09:19:09 , I was saying about web 3.0, we are using

146
00:09:19,000 --> 00:09:22,000
09 , 00:09:22:07 , a distributed H based back end.

147
00:09:23,000 --> 00:09:26,000
03 , 00:09:25:06 , You might notice a theme here, right?

148
00:09:25,000 --> 00:09:28,000
06 , 00:09:26:10 , Everything that I write on the back send

149
00:09:26,000 --> 00:09:29,000
10 , 00:09:28:14 , completely distributed.

150
00:09:28,000 --> 00:09:31,000
14 , 00:09:31:21 , So what that means if you are not familiar with H base

151
00:09:31,000 --> 00:09:34,000
21 , 00:09:37:02 , is it's a huge key value storer that runs on a hadoop cluster.

152
00:09:37,000 --> 00:09:40,000
03 , 00:09:40:23 , So the more keys and values you have, the more you can just scale

153
00:09:40,000 --> 00:09:43,000
23 , 00:09:43:27 , up your cluster by adding a machine which, again,

154
00:09:43,000 --> 00:09:46,000
27 , 00:09:47:14 , is really easy and takes about a minute to add a machine

155
00:09:47,000 --> 00:09:50,000
14 , 00:09:50:18 , and makes it infinitely scalable.

156
00:09:50,000 --> 00:09:53,000
22 , 00:09:54:12 , We just have to scale up our cluster, since most of the stuff is in the cloud,

157
00:09:54,000 --> 00:09:57,000
12 , 00:09:57:15 , it really takes 30 seconds to a minute.

158
00:09:57,000 --> 00:10:00,000
15 , 00:09:59:14 ,    TEAL ROGERS: So if you notice sometimes

159
00:09:59,000 --> 00:10:02,000
14 , 00:10:01:22 , domains disappear.

160
00:10:01,000 --> 00:10:04,000
22 , 00:10:03:03 , Sometimes they reappear.

161
00:10:04,000 --> 00:10:07,000
01 , 00:10:07:00 , That this is controlled by interests.

162
00:10:07,000 --> 00:10:10,000
00 , 00:10:09:16 , Whatever domain you have focused in the center of the view

163
00:10:09,000 --> 00:10:12,000
16 , 00:10:12:20 , is the domain you're interested in.

164
00:10:12,000 --> 00:10:15,000
22 , 00:10:16:29 , And it's a value that the interface keeps track of, just

165
00:10:16,000 --> 00:10:19,000
29 , 00:10:21:27 , to keep the screen less cluttered as domains lose interest,

166
00:10:21,000 --> 00:10:24,000
27 , 00:10:28:06 , and you are not focused, they disappear and then they reappear.

167
00:10:28,000 --> 00:10:31,000
07 , 00:10:32:14 , So here we have a vulnerable domain.

168
00:10:32,000 --> 00:10:35,000
22 , 00:10:35:24 , That's why it's spewing stuff.

169
00:10:36,000 --> 00:10:39,000
06 , 00:10:39:05 , It's vulnerable to SQL injection.

170
00:10:39,000 --> 00:10:42,000
05 , 00:10:43:00 , This particular domain, we made on purpose to be vulnerable.

171
00:10:43,000 --> 00:10:46,000
08 , 00:10:46:15 , It's that's why it's called SQL I 1.

172
00:10:49,000 --> 00:10:52,000
15 , 00:10:54:10 , This is another thing that you can't really see from just looking at HTML.

173
00:10:54,000 --> 00:10:57,000
13 , 00:10:59:25 , You can't see if it's vulnerable to hacks.

174
00:11:01,000 --> 00:11:04,000
04 , 00:11:06:22 , With our web 3.0 visualizer, you can see whether you are linked

175
00:11:06,000 --> 00:11:09,000
22 , 00:11:12:26 , to sites that happen to be vulnerable or whether you just find sites,

176
00:11:12,000 --> 00:11:15,000
26 , 00:11:17:02 , you know, randomly on the Internet.

177
00:11:17,000 --> 00:11:20,000
02 , 00:11:18:20 , You want to know whether they are vulnerable or not

178
00:11:18,000 --> 00:11:21,000
20 , 00:11:20:17 , for various reasons.

179
00:11:21,000 --> 00:11:24,000
21 , 00:11:30:25 , And so here we have Hyperiongray.com, which is Alex's site.

180
00:11:30,000 --> 00:11:33,000
25 , 00:11:31:26 , It is    ALEJANDRO CACERAS: Actually,

181
00:11:31,000 --> 00:11:34,000
26 , 00:11:35:03 , one quick note about the vulnerability scanner.

182
00:11:35,000 --> 00:11:38,000
12 , 00:11:37:05 , Every site that goes through the system gets scanned

183
00:11:37,000 --> 00:11:40,000
05 , 00:11:39:02 , for vulnerabilities.

184
00:11:39,000 --> 00:11:42,000
03 , 00:11:42:12 , The base of the vulnerability scanner is done.

185
00:11:42,000 --> 00:11:45,000
12 , 00:11:43:20 , It's still pretty basic.

186
00:11:43,000 --> 00:11:46,000
25 , 00:11:45:27 , It's essentially just a little fuzzer that goes

187
00:11:45,000 --> 00:11:48,000
27 , 00:11:49:24 , through get parameters but, of course, we are expanding it and making it

188
00:11:49,000 --> 00:11:52,000
24 , 00:11:52:24 , a much fancier vulnerability scanner.

189
00:11:53,000 --> 00:11:56,000
05 , 00:11:55:14 , The way it works is a little bit unique.

190
00:11:58,000 --> 00:12:01,000
25 , 00:12:02:20 , Web crawler, you are collecting a ton of metadata on those sites.

191
00:12:03,000 --> 00:12:06,000
17 , 00:12:08:28 , It makes vulnerabilities completely integral part of that metadata.

192
00:12:09,000 --> 00:12:12,000
02 , 00:12:10:29 , So you essentially don't crawl, unless you are looking

193
00:12:10,000 --> 00:12:13,000
29 , 00:12:14:08 , for vulnerabilities in a site which is pretty cool.

194
00:12:14,000 --> 00:12:17,000
18 , 00:12:16:20 , And, again, going along with my theme, this

195
00:12:16,000 --> 00:12:19,000
20 , 00:12:20:10 , is a fully distributed vulnerability scanner.

196
00:12:20,000 --> 00:12:23,000
10 , 00:12:25:26 , So the more nodes we have on our cluster, the faster we can scan.

197
00:12:26,000 --> 00:12:29,000
03 , 00:12:29:21 , Essentially we can scale this up and scene track of not only a map

198
00:12:29,000 --> 00:12:32,000
21 , 00:12:32:27 , of the entire Internet, but we can scan the entire Internet

199
00:12:32,000 --> 00:12:35,000
27 , 00:12:36:04 , for vulnerabilities which is pretty cool.

200
00:12:36,000 --> 00:12:39,000
04 , 00:12:40:04 ,    TEAL ROGERS: As so you can tell, Alex is all about the scanner and

201
00:12:40,000 --> 00:12:43,000
04 , 00:12:44:17 , the vulnerability, and I'm focused on the 3D engine.

202
00:12:44,000 --> 00:12:47,000
28 , 00:12:51:02 , So here we have the Alex's site which is built in Drupal and this is one

203
00:12:51,000 --> 00:12:54,000
02 , 00:12:56:20 , of the peculiarities you can find with Drupal sites sometimes

204
00:12:56,000 --> 00:12:59,000
20 , 00:13:01:24 , is that you will find like this area here, which is kind

205
00:13:01,000 --> 00:13:04,000
24 , 00:13:07:07 , of weird URLs that don't really say much, node 26, node 29,

206
00:13:07,000 --> 00:13:10,000
07 , 00:13:14:09 , and then you will find longer URLs, human readable URLs over here.

207
00:13:14,000 --> 00:13:17,000
11 , 00:13:19:27 , So Drupal is creating these weird little URLs and just forwarding them

208
00:13:19,000 --> 00:13:22,000
27 , 00:13:22:16 , to the longer ones.

209
00:13:22,000 --> 00:13:25,000
16 , 00:13:27:10 , And this kind of creates a kite, a sort of main page over here, and then

210
00:13:27,000 --> 00:13:30,000
10 , 00:13:32:21 , a kite in the background, which is really funny, actually.

211
00:13:33,000 --> 00:13:36,000
10 , 00:13:36:29 , But this isn't the view you would see.

212
00:13:42,000 --> 00:13:45,000
05 , 00:13:46:02 , As a crawler, though, as Google, as or as, you know,

213
00:13:46,000 --> 00:13:49,000
02 , 00:13:51:04 , even somebody collecting information for whatever purposes you might

214
00:13:51,000 --> 00:13:54,000
04 , 00:13:55:19 , collect information for a site, you would see you would want

215
00:13:55,000 --> 00:13:58,000
19 , 00:14:01:23 , to know that there's this kind of little odd structure going on here.

216
00:14:02,000 --> 00:14:05,000
08 , 00:14:04:12 , Because, you know, information is power.

217
00:14:06,000 --> 00:14:09,000
24 , 00:14:10:09 ,    ALEJANDRO CACERAS: So now Teal will take us to Bush Official.com.

218
00:14:10,000 --> 00:14:13,000
18 , 00:14:14:26 , It's a site that we do not own.

219
00:14:18,000 --> 00:14:21,000
11 , 00:14:21:06 , It's the official site of the band Bush.

220
00:14:21,000 --> 00:14:24,000
06 , 00:14:23:13 , Do we have any Bush fabs out there?

221
00:14:23,000 --> 00:14:26,000
14 , 00:14:27:11 ,    TEAL ROGERS: I never actually heard Bush but I'm sure they are

222
00:14:27,000 --> 00:14:30,000
11 , 00:14:29:04 , a great band.

223
00:14:29,000 --> 00:14:32,000
04 , 00:14:32:18 ,    ALEJANDRO CACERAS: And lovely people.

224
00:14:33,000 --> 00:14:36,000
06 , 00:14:37:06 , The system, as I mentioned, in a very noninvasive way, check

225
00:14:37,000 --> 00:14:40,000
06 , 00:14:40:15 , for vulnerabilities in these sites.

226
00:14:40,000 --> 00:14:43,000
26 , 00:14:44:17 , We are doing respectful stuff from a network standpoint.

227
00:14:47,000 --> 00:14:50,000
09 , 00:14:51:11 , We are respecting robots.attacks and we never flood the site with traffic.

228
00:14:51,000 --> 00:14:54,000
25 , 00:14:54:26 , You will see a few vulnerable links.

229
00:14:54,000 --> 00:14:57,000
28 , 00:14:57:03 , These are domains with SQL.

230
00:14:58,000 --> 00:15:01,000
25 , 00:15:02:22 , Don't misuse this don't be a dick is I guess what I'm trying to say.

231
00:15:03,000 --> 00:15:06,000
12 , 00:15:04:27 , So, yeah.

232
00:15:05,000 --> 00:15:08,000
02 , 00:15:10:18 ,    TEAL ROGERS: So you can see Bush is kind of a typical site.

233
00:15:10,000 --> 00:15:13,000
18 , 00:15:14:23 , They love MySpace and they love Facebook here,

234
00:15:14,000 --> 00:15:17,000
23 , 00:15:17:22 , and here's Twitter.

235
00:15:17,000 --> 00:15:20,000
22 , 00:15:19:28 , They love Twitter and so they are showing a lot of love

236
00:15:19,000 --> 00:15:22,000
28 , 00:15:24:25 , for social networks, which will well, that's pretty typical of a band.

237
00:15:25,000 --> 00:15:28,000
22 , 00:15:29:02 , Twitter is, of course, a massive site and we don't control it,

238
00:15:29,000 --> 00:15:32,000
02 , 00:15:32:06 , even though it kind of looks like we do.

239
00:15:32,000 --> 00:15:35,000
18 , 00:15:37:24 , We just crawl if they happen to link to it, and over here we find someone else

240
00:15:37,000 --> 00:15:40,000
24 , 00:15:40:21 , who happens to link to it.

241
00:15:40,000 --> 00:15:43,000
21 , 00:15:43:02 ,    AUDIENCE MEMBER: What's the meaning of the distance

242
00:15:43,000 --> 00:15:46,000
02 , 00:15:47:17 , between    TEAL ROGERS: Well, the distance is pretty random.

243
00:15:47,000 --> 00:15:50,000
17 , 00:15:50:20 , You can actually take you can take domains and just drag them

244
00:15:50,000 --> 00:15:53,000
20 , 00:15:53:03 , around with the mouse.

245
00:15:53,000 --> 00:15:56,000
03 , 00:15:55:25 , So you can grab Twitter and drag it over here.

246
00:15:56,000 --> 00:15:59,000
15 , 00:16:01:13 , It's all it's all organized dynamically, based on whether it's connected

247
00:16:01,000 --> 00:16:04,000
13 , 00:16:06:24 , to anything that happens to be shown on the screen at that time.

248
00:16:08,000 --> 00:16:11,000
17 , 00:16:11:16 , So here we have the DEF CON website which

249
00:16:11,000 --> 00:16:14,000
16 , 00:16:15:13 , is really quite interestingly organized.

250
00:16:15,000 --> 00:16:18,000
13 , 00:16:19:07 , It is there's a core of pages here, which is the main site,

251
00:16:19,000 --> 00:16:22,000
07 , 00:16:22:25 , and then here's a satellite page.

252
00:16:22,000 --> 00:16:25,000
25 , 00:16:24:15 , So this isn't a full crawl of the DEF CON website

253
00:16:24,000 --> 00:16:27,000
15 , 00:16:28:22 , or you would see a bunch of different satellite pages also.

254
00:16:29,000 --> 00:16:32,000
05 , 00:16:33:07 , But DEF CON is one of the few sites that actually does this

255
00:16:33,000 --> 00:16:36,000
07 , 00:16:35:02 , on purpose.

256
00:16:35,000 --> 00:16:38,000
12 , 00:16:37:19 , Many sites do this by accident.

257
00:16:37,000 --> 00:16:40,000
22 , 00:16:40:22 , So you can see DEF CON shows a lot of love to Facebook.

258
00:16:40,000 --> 00:16:43,000
22 , 00:16:43:25 , It shows a lot of love to Twitter.

259
00:16:44,000 --> 00:16:47,000
07 , 00:16:47:13 , And it shows a little bit of love to Amazon, just

260
00:16:47,000 --> 00:16:50,000
13 , 00:16:51:10 , in this one little URL, links/booklinks.HTML.

261
00:16:53,000 --> 00:16:56,000
27 , 00:16:57:02 , So you can see where their priorities are.

262
00:16:57,000 --> 00:17:00,000
11 , 00:17:00:28 ,    ALEJANDRO CACERAS: We have plenty of time.

263
00:17:01,000 --> 00:17:04,000
24 , 00:17:03:25 , We have questions until the end.

264
00:17:03,000 --> 00:17:06,000
25 , 00:17:06:10 , I think Teal will show you another site real quick,

265
00:17:06,000 --> 00:17:09,000
10 , 00:17:10:06 , and tell you a little bit about how you can get involved

266
00:17:10,000 --> 00:17:13,000
06 , 00:17:12:12 , with the project.

267
00:17:12,000 --> 00:17:15,000
12 , 00:17:13:27 , We definitely need your help.

268
00:17:13,000 --> 00:17:16,000
27 , 00:17:16:18 , So Teal, you want to tell them a little bit about that.

269
00:17:16,000 --> 00:17:19,000
18 , 00:17:17:27 ,    TEAL ROGERS: All right.

270
00:17:17,000 --> 00:17:20,000
27 , 00:17:22:28 , So this is my website that I made in, like, the last week.

271
00:17:22,000 --> 00:17:25,000
29 , 00:17:28:08 , And if you look at the structure in our web 3.0 viewer,

272
00:17:28,000 --> 00:17:31,000
08 , 00:17:34:23 , you see some really interesting things is, actually.

273
00:17:35,000 --> 00:17:38,000
03 , 00:17:40:02 , And you will see that there's there's the structure here which is which

274
00:17:40,000 --> 00:17:43,000
02 , 00:17:43:02 , is pretty normal, but then there's this

275
00:17:43,000 --> 00:17:46,000
02 , 00:17:47:02 , like weird little structure off to the side and this

276
00:17:47,000 --> 00:17:50,000
02 , 00:17:51:07 , is actually none www.trinarysoftware.com.

277
00:17:57,000 --> 00:18:00,000
28 , 00:18:01:09 , This is purely organic mistake here.

278
00:18:01,000 --> 00:18:04,000
13 , 00:18:05:25 , I linked some of my pages to a different domain,

279
00:18:05,000 --> 00:18:08,000
25 , 00:18:13:10 , a non www domain, and as far as, like, Google is concerned, this is, like,

280
00:18:13,000 --> 00:18:16,000
10 , 00:18:15:17 , a big no no.

281
00:18:15,000 --> 00:18:18,000
17 , 00:18:19:18 , And I Google is kind of like the government of the Internet,

282
00:18:19,000 --> 00:18:22,000
18 , 00:18:23:02 , so to speak, and so this sort of this sort

283
00:18:23,000 --> 00:18:26,000
02 , 00:18:27:15 , of mistake you can make will often get you Google fined

284
00:18:27,000 --> 00:18:30,000
15 , 00:18:30:13 , and I made up that term.

285
00:18:30,000 --> 00:18:33,000
13 , 00:18:35:13 , I'm hoping it sticks, but that isn't an actual term.

286
00:18:37,000 --> 00:18:40,000
26 , 00:18:42:29 , So, it's a good example of why you would want to get a map

287
00:18:42,000 --> 00:18:45,000
29 , 00:18:47:15 , of your website, because if you just crawl manually

288
00:18:47,000 --> 00:18:50,000
15 , 00:18:51:03 , through your own through the web browser,

289
00:18:51,000 --> 00:18:54,000
03 , 00:18:55:05 , examine your HTML, you are very likely to miss

290
00:18:55,000 --> 00:18:58,000
05 , 00:19:01:14 , the fact that you stuck some of the pages in non www format.

291
00:19:01,000 --> 00:19:04,000
29 , 00:19:04:21 , Now, fortunately, my site doesn't have any SQL injection

292
00:19:04,000 --> 00:19:07,000
21 , 00:19:09:12 , vulnerabilities on it, or you would be able to see that as well.

293
00:19:09,000 --> 00:19:12,000
25 , 00:19:15:22 , So what we have here, what this software is, it's a prototype.

294
00:19:16,000 --> 00:19:19,000
02 , 00:19:19:25 , It's it's under active development and there's a lot

295
00:19:19,000 --> 00:19:22,000
25 , 00:19:23:28 , of directions that we could take this.

296
00:19:24,000 --> 00:19:27,000
02 , 00:19:28:11 , We want our friends to get involved.

297
00:19:28,000 --> 00:19:31,000
11 , 00:19:32:05 , And by our friends, I mean all of you guys.

298
00:19:32,000 --> 00:19:35,000
12 , 00:19:36:22 , We want so what we have done, what I have done

299
00:19:36,000 --> 00:19:39,000
22 , 00:19:42:29 , is we have made this we made a mailing list for now, so if you are

300
00:19:42,000 --> 00:19:45,000
29 , 00:19:49:20 , on the side, on Trinarysoftware.com, you can sign up for a mailing list

301
00:19:49,000 --> 00:19:52,000
20 , 00:19:55:21 , and we will offer everyone who is on the mailing list in a month

302
00:19:55,000 --> 00:19:58,000
21 , 00:20:01:24 , or probably two months free access to the closed beta.

303
00:20:01,000 --> 00:20:04,000
29 , 00:20:05:26 , So we really want you to be involved and

304
00:20:05,000 --> 00:20:08,000
26 , 00:20:12:14 , for contractual reasons, we can't really offer an open beta,

305
00:20:12,000 --> 00:20:15,000
14 , 00:20:17:00 , but we want to offer everyone free access

306
00:20:17,000 --> 00:20:20,000
00 , 00:20:20:02 , to the closed beta.

307
00:20:20,000 --> 00:20:23,000
02 , 00:20:22:13 ,    ALEJANDRO CACERAS: Yeah, and for the back end engine,

308
00:20:22,000 --> 00:20:25,000
13 , 00:20:25:26 , I'm releasing this free and open source under the Apache license,

309
00:20:25,000 --> 00:20:28,000
26 , 00:20:29:00 , so you can do whatever you want with it.

310
00:20:29,000 --> 00:20:32,000
03 , 00:20:33:03 , I know Teal is going to offer a free version of this when

311
00:20:33,000 --> 00:20:36,000
03 , 00:20:35:27 , if does actually come out.

312
00:20:37,000 --> 00:20:40,000
11 , 00:20:39:09 , Yeah, and thanks for coming.

313
00:20:39,000 --> 00:20:42,000
09 , 00:20:41:27 , One last note, if you are interested in offensive techniques

314
00:20:41,000 --> 00:20:44,000
27 , 00:20:45:14 , in distributed computing, I have another talk here that's coming

315
00:20:45,000 --> 00:20:48,000
14 , 00:20:47:04 , up at 3 p.m.

316
00:20:47,000 --> 00:20:50,000
04 , 00:20:48:04 , at Track 1.

317
00:20:48,000 --> 00:20:51,000
04 , 00:20:49:20 , So definitely catch that if that sounds like that

318
00:20:49,000 --> 00:20:52,000
20 , 00:20:52:27 , if that's something that's interesting to you.

319
00:20:52,000 --> 00:20:55,000
27 , 00:20:53:27 , Thanks for coming.

320
00:20:53,000 --> 00:20:56,000
27 , 00:20:54:27 , Thanks a lot, guys.

321
00:20:54,000 --> 00:20:57,000
27 , 00:21:02:28 , (Applause) We have five minutes where we can take some questions.

322
00:21:02,000 --> 00:21:05,000
28 , 00:21:06:06 ,    AUDIENCE MEMBER: (Inaudible question)    TEAL ROGERS: Where do

323
00:21:06,000 --> 00:21:09,000
06 , 00:21:08:18 , you opt in for the beta?

324
00:21:09,000 --> 00:21:12,000
17 , 00:21:12:02 , It's www.trinarysoftware.com.

325
00:21:12,000 --> 00:21:15,000
02 , 00:21:17:08 ,    ALEJANDRO CACERAS:    TEAL ROGERS: Well, here it is, right

326
00:21:17,000 --> 00:21:20,000
08 , 00:21:20:02 , on the top there.

327
00:21:26,000 --> 00:21:29,000
24 , 00:21:29:13 ,    AUDIENCE MEMBER: I can't read that!

328
00:21:29,000 --> 00:21:32,000
13 , 00:21:33:14 ,    ALEJANDRO CACERAS: So it's it's actually very simple.

329
00:21:33,000 --> 00:21:36,000
14 , 00:21:36:21 , It's trinary, trinary, like three naries.

330
00:21:36,000 --> 00:21:39,000
21 , 00:21:41:14 ,    TEAL ROGERS: Trinary software is almost a meaningless term

331
00:21:41,000 --> 00:21:44,000
14 , 00:21:48:10 , in any functional sense, unless you think of it in terms of 3D.

332
00:21:48,000 --> 00:21:51,000
11 , 00:21:52:24 , So that's really the only way that you could take what

333
00:21:52,000 --> 00:21:55,000
24 , 00:21:57:02 , is you know, what is a trinary software.

334
00:21:57,000 --> 00:22:00,000
20 , 00:21:59:12 , It's a 3d software.

335
00:21:59,000 --> 00:22:02,000
12 , 00:22:01:15 ,    ALEJANDRO CACERAS: Other questions?

336
00:22:01,000 --> 00:22:04,000
15 , 00:22:04:12 , (Inaudible question)    ALEJANDRO CACERAS: So actually it's

337
00:22:04,000 --> 00:22:07,000
12 , 00:22:08:07 , a customized version of Apache Nach.

338
00:22:08,000 --> 00:22:11,000
17 , 00:22:11:18 , That's where the Apache hadoop, we specialized and added a bunch

339
00:22:11,000 --> 00:22:14,000
18 , 00:22:15:23 , of plug ins and releasing all of that stuff open source afterwards.

340
00:22:15,000 --> 00:22:18,000
23 , 00:22:18:27 ,    AUDIENCE MEMBER: When will you be showing off the crawler?

341
00:22:19,000 --> 00:22:22,000
03 , 00:22:22:21 ,    ALEJANDRO CACERAS: I will be showing

342
00:22:22,000 --> 00:22:25,000
21 , 00:22:27:06 , off a little bit more about the crawler and

343
00:22:27,000 --> 00:22:30,000
06 , 00:22:31:27 , the vulnerability scanner at 3 p.m.

344
00:22:31,000 --> 00:22:34,000
27 , 00:22:32:27 , in Track 1.

345
00:22:32,000 --> 00:22:35,000
27 , 00:22:33:27 , Thanks, John.

346
00:22:35,000 --> 00:22:38,000
28 , 00:22:40:29 ,    AUDIENCE MEMBER: Have you thought about rendering it in 3 D.

347
00:22:40,000 --> 00:22:43,000
29 , 00:22:44:28 , and using elite motion to control it?

348
00:22:44,000 --> 00:22:47,000
28 , 00:22:47:10 ,    ALEJANDRO CACERAS: Use what type of motion?

349
00:22:48,000 --> 00:22:51,000
29 , 00:22:50:24 ,    AUDIENCE MEMBER: (Inaudible).

350
00:22:50,000 --> 00:22:53,000
24 , 00:22:53:26 ,    TEAL ROGERS: Yeah, it could we can use, like,

351
00:22:53,000 --> 00:22:56,000
26 , 00:22:58:28 , biofeedback and leap motion, and that actually is really easy

352
00:22:58,000 --> 00:23:01,000
28 , 00:23:04:05 , to plug in and that's a direction we can take this.

353
00:23:04,000 --> 00:23:07,000
05 , 00:23:07:06 , We are trying to figure out what directions.

354
00:23:07,000 --> 00:23:10,000
06 , 00:23:10:12 , We want all of the good suggestions like that,

355
00:23:10,000 --> 00:23:13,000
12 , 00:23:12:23 , that we can get.

356
00:23:13,000 --> 00:23:16,000
02 , 00:23:17:10 , And any kind of, you know, contributions, any kind

357
00:23:17,000 --> 00:23:20,000
10 , 00:23:24:04 , of input that anybody can get, feel free to email us or our emails are

358
00:23:24,000 --> 00:23:27,000
04 , 00:23:30:05 , listed on our website, or, you know, if you have any any ideas

359
00:23:30,000 --> 00:23:33,000
05 , 00:23:34:13 , or you have a project that this would really

360
00:23:34,000 --> 00:23:37,000
13 , 00:23:40:05 , interrelate with, would it would be very helpful.

361
00:23:40,000 --> 00:23:43,000
05 , 00:23:41:21 ,    ALEJANDRO CACERAS: Yes, we are definitely hoping to get

362
00:23:41,000 --> 00:23:44,000
21 , 00:23:44:13 , a little back and forth with the community.

363
00:23:44,000 --> 00:23:47,000
13 , 00:23:45:29 , We really want to make the community an integral part

364
00:23:45,000 --> 00:23:48,000
29 , 00:23:48:15 , of where we take this entire thing.

365
00:23:49,000 --> 00:23:52,000
02 , 00:23:52:12 , Definitely if you have ideas or want to talk

366
00:23:52,000 --> 00:23:55,000
12 , 00:23:57:15 , with us or have additional questions, shoot us an email, follow us

367
00:23:57,000 --> 00:24:00,000
15 , 00:24:02:02 , on Twitter on come to my talk again at 3 p.m.

368
00:24:02,000 --> 00:24:05,000
02 , 00:24:03:02 , on Track 1.

369
00:24:03,000 --> 00:24:06,000
02 , 00:24:05:07 ,    TEAL ROGERS: All right.

370
00:24:05,000 --> 00:24:08,000
07 , 00:24:06:09 , Thank you for coming.

371
00:24:06,000 --> 00:24:09,000
09 , 00:24:07:09 , (Applause).

372
00:24:07,000 --> 00:24:10,000
09 , 00:24:09:16 ,    ALEJANDRO CACERAS: Thanks, everybody.