00:00:00.000-->00:00:05.583 >>Uh. Alright, ya. I’m, uh, Jason- Jason Haddix. And this is JP Swagnetow. And today we’re 00:00:05.583-->00:00:11.542 going to talk about, uh, a tool that we created, uh, an extension for Burp Suite- really 00:00:11.542-->00:00:16.667 two tools, uh- called HUNT. Um. So we weren’t the only ones who did this. Uh. Our security 00:00:16.667-->00:00:22.708 operations group, uh, Fatih and Ryan and Vishal also helped us with, uh, with some of the data 00:00:22.708-->00:00:26.458 pulling and everything like that. Mostly we work for Bugcrowd that runs crowdsourced 00:00:26.458-->00:00:30.958 pentests and assessments and responsible disclosure. Uh. But all of us are bughunters and 00:00:30.958-->00:00:36.458 pentesters and code analysis people. We’re also really big fans of Burp Suite. So, um, we 00:00:36.458-->00:00:40.792 spend most of our time hacking web apps inside of Burp Suite all day. Um. And so we wanted to 00:00:40.792-->00:00:45.875 create these two tools to kind of extend us and, uh, kind of the knowledge to people who are 00:00:45.875-->00:00:48.667 either new in application security assessment or are looking for a different kind of 00:00:48.667-->00:00:53.792 coverage in application security assessment. So the three problems that we’re trying to 00:00:53.792-->00:00:58.958 identify with the two tools that we made. So, uh, so applications are getting completely large. 00:00:58.958-->00:01:04.000 Lots of parameters. Um. And you don’t know really where to start. If you don’t have a large 00:01:04.000-->00:01:07.958 domain, uh, that maybe has like, you know, 150 dynamic parameters where you’re supposed to fuzz 00:01:07.958-->00:01:11.958 with, uh, you know, different fuzz strings, it can get unwieldy. Um. And you don’t want 00:01:11.958-->00:01:16.500 to rely all the way on something like a scanner. Right? Uh. They don’t have full coverage. 00:01:16.500-->00:01:20.208 They’re just fuzzing things until they crap over or something like that. So we 00:01:20.208-->00:01:24.417 wanted something to alert us when, uh, there are potential issues. Specifically, uh, 00:01:24.417-->00:01:28.208 parameters that might be vulnerable to certain classes of vulnerabilities. But it’s for 00:01:28.208-->00:01:33.333 manual testing. It’s not for automated testing. Uh. We also noticed that there is this lack 00:01:33.333-->00:01:38.542 of tribal knowledge, um, for younger testers. Right? So, you know, JP may have been doing 00:01:38.542-->00:01:42.917 this for ten years and knows that, uh, just by the name of a parameter it probably interacts 00:01:42.917-->00:01:46.750 with the database or a templating engine or something like that. Uh. But he knows to 00:01:46.750-->00:01:51.750 fuzz for certain vulnerabilities in that place. Uh. But me, if I were a new tester, um, I 00:01:51.750-->00:01:56.208 wouldn’t know to look there unless I had his expertise. Um. So we wanted to kind of level 00:01:56.208-->00:02:00.750 up, uh, the testers, you know, who were at that skill level and transfer that tribal knowledge. 00:02:00.750-->00:02:05.375 And then we also noticed that there’s no intel workflow for web hacking methodologies inside 00:02:05.375-->00:02:09.583 of Burp. Right? If you do web hacking and you want to record a large amount of data, you have 00:02:09.583-->00:02:14.375 to do it in a third party tool. Uh. You can do it in Burp notes, but, uh, it’s kind of unwieldy. 00:02:14.375-->00:02:18.292 Um. There just wasn’t something that fit kind of what we were looking for inside of, uh, 00:02:18.292-->00:02:23.292 inside of Burp. So the current kind of solutions for, uh, to effectively find security bugs 00:02:25.500-->00:02:30.750 in web locations is, you know, you have a bada** hacker who can kind of eyeball parameters that- 00:02:30.750-->00:02:35.625 or input places that, you know, where are vulnerable. So, um, they can find security bugs. 00:02:35.625-->00:02:39.250 They may or may not use a methodology. Uh. They definitely have accrued some tribal 00:02:39.250-->00:02:43.708 knowledge of vulnerabilities. Um. And you can do this as a bug hunter or consultant or 00:02:43.708-->00:02:47.417 something like that. There’s also the solution of a dynamic scanner which just throws 00:02:47.417-->00:02:53.542 limited test cases at parameters hoping that either an error occurs or a response occurs that 00:02:53.542-->00:02:57.250 it parses there and then that there’s a vulnerability there. Um. But those are cost 00:02:57.250-->00:03:01.167 prohibited because a lot of those good scanners cost a lot of money. Uh. They’re limited in 00:03:01.167-->00:03:06.125 their detection cases. Um. They don’t handle dynamic pages very well. They don’t handle non 00:03:06.125-->00:03:11.917 generic errors very well. And they don’t handle authentication very well in most cases. So, um, 00:03:11.917-->00:03:17.583 we wanted to be able to give people a way to manually test, but know where to manually test, 00:03:17.583-->00:03:22.583 uh, a-and have some data behind it. So we built this into, uh, HUNT. So it’s, uh, tribal 00:03:25.667-->00:03:29.167 knowledge passive alerts. You get alerts when it sees parameters that are most often 00:03:29.167-->00:03:33.708 vulnerable to certain things. Uh. You get methodology inside of Burp. And you also get a 00:03:33.708-->00:03:38.083 whole bunch of references that we added. So, uh, the Burp, uh, advisory is our- really their 00:03:38.083-->00:03:42.792 writes up on the vulnerabilities. Um. But the best methods and the best stuff 00:03:42.792-->00:03:46.917 usually come from blogs. Like the cheat sheets that Pentus Monkey has, you know, for sql 00:03:46.917-->00:03:51.750 injection and stuff like that, um, or just, you know, members of the community. Uh. We found 00:03:51.750-->00:03:55.208 that we weren’t using, you know, uh, certain references inside the tool. We wanted to bring 00:03:55.208-->00:03:58.417 them inside the tool so that when you’re training up a new application assessment person, 00:03:58.417-->00:04:02.167 they have all those links and resources right inside the tool and they can get -s, you know, 00:04:02.167-->00:04:08.667 started as fast as they can, you know, manually testing some of these vulnerability classes. Ok. 00:04:08.667-->00:04:13.667 So the first tool is Scanner- HUNT Scanner. So before we launch into what it looks like, 00:04:16.208-->00:04:21.708 you have to know kind of how we gathered the data to make these alerts. Um. So we we are 00:04:21.708-->00:04:26.708 Bugcrowd. We do a lot of, um, bug bounties. Over 600 run right now. Um. And so basically this 00:04:28.708-->00:04:34.458 is just some fuzzing math. But, uh, programs that we have, if you times those by two targets, 00:04:34.458-->00:04:38.750 we average two targets per application. Um. And these are usually targets or either 00:04:38.750-->00:04:43.083 subdomains or fully qualified top level domains so like dubdubdub dot Def Con dot org or 00:04:43.083-->00:04:47.750 forms dot def-def con dot org. Anything that really, uh, gives you different application 00:04:47.750-->00:04:52.167 functionality is going to be a target. And then we averaged about every one of those things 00:04:52.167-->00:04:57.542 had about fifteen dynamic parameters- unique dynamic parameters per application. Um. 00:04:57.542-->00:05:03.792 So that 18-->000 parameter scene over the kind of data set that we were looking at. Um. So what 00:05:03.792-->00:05:09.083 we did with the over 18-->000 parameters is reduce them to parameters with vulns on them. 00:05:09.083-->00:05:15.333 Um. Which was mostly all of them. And then we reduced it again to things that had P1 and 00:05:15.333-->00:05:19.958 P2 vulnerabilities on them which are high and, um, critical level vulnerabilities. These are 00:05:19.958-->00:05:25.083 things that let you read the file system. They let you, um, execute arbitrary code. They are 00:05:25.083-->00:05:28.667 a configuration vulnerability that allows you to see credit card information of other 00:05:28.667-->00:05:32.583 people. These are those types of bugs. Uh. So we reduced it to those bugs. Uh. Then we started 00:05:32.583-->00:05:36.917 sorting it for recurring instances. So really, you know, fuzzy data science. Uh. But it- 00:05:36.917-->00:05:43.542 it works. Um. So then we include the top five to ten recurring instances of parameters to start 00:05:43.542-->00:05:48.542 alerting you when they fall through your Burp traffic. Um. And then we actually reviewed 00:05:48.542-->00:05:54.000 the top 100 possible cummercations with some of these. Um. And then we manually 00:05:54.000-->00:05:59.125 added some of these ancillary C data so the fuzzdb project, seclists, and just some 00:05:59.125-->00:06:02.500 parameters that our buddies that work as pen test consultants were like we see this all the 00:06:02.500-->00:06:08.500 time with this vuln. Um. So we added some stuff to this data set as well. So just, you know, 00:06:08.500-->00:06:12.667 a quick refresher for, you know, what we’re talking about here. Uh. This is an example of a 00:06:12.667-->00:06:17.083 parameter in orange here, right? So this is where, uh, after the equals sign you’re going to fuzz 00:06:17.083-->00:06:22.292 for, in this case, probably sql injection. The ID parameter, uh, most often, is associated with 00:06:22.292-->00:06:28.208 the database. So, um, this is kind of what this talk is about- is- is getting to this. Right? 00:06:28.208-->00:06:35.042 When you see ID equals one, you put tips. Right? So, um. This is the essence of Scanner. Alright. 00:06:35.042-->00:06:41.792 So this is what, uh, Scanner looks like. This is a- a totally separate tab. We didn’t want to 00:06:41.792-->00:06:48.250 pollute your already made, uh, Burp instance. We didn’t want to pollute the, uh, advisories of 00:06:48.250-->00:06:52.125 Burb Scanner or anything like that. So we made a clearly different tab. Um. And we 00:06:52.125-->00:06:57.167 started with, uh, I think seven or eight classes of vulnerabilities that were P1 00:06:57.167-->00:07:01.917 worthy. Um. So here you can see on the left hand side, uh, we’ve funneled some traffic through 00:07:01.917-->00:07:06.417 Burp. And it’s already starting to alert us on common parameters that are vulnerable to service 00:07:06.417-->00:07:10.917 site requests forgery on the left. Um. So here you can see the requests end up inside of a 00:07:10.917-->00:07:15.833 sub tree on the left. Um. You can see the kind of parameters we are talking about here: 00:07:15.833-->00:07:20.500 destination, dir, uri, path, continue, etcetera, etcetera. Right? These are all things 00:07:20.500-->00:07:25.583 you’re going to want to fuzz for service-side. Request forgery, uh, probably URL redirection, 00:07:25.583-->00:07:29.167 things like that. Um. So you’ll have the requests and the response and you’ll also have an 00:07:29.167-->00:07:34.542 advisory that we’ll go over in a second. So here’s the advisory. Um. You can see here that, uh, 00:07:34.542-->00:07:39.000 we added just some general stuff. But this is all customizable. You’ll be able to 00:07:39.000-->00:07:43.167 customize it yourself with your own built in methodologies inside of Burp. It’s very 00:07:43.167-->00:07:47.500 editable. So if you have a team and you have a resource list or a cheat sheet of some sort to do 00:07:47.500-->00:07:51.250 these things, you can add them now inside of Burp in your own advisories. So you have the 00:07:51.250-->00:07:55.417 location. And then for this one obviously the SSRF are viable for this class of vulnerability 00:07:55.417-->00:07:59.708 is probably one of the best resources you can look at for SSRF. And there’s a couple of 00:07:59.708-->00:08:04.792 other resources that we think are worthy, um, to manually test vulnerabilities against a class 00:08:04.792-->00:08:11.333 of vulnerability like this. Alright. So we’re going to talk a little bit about the data that 00:08:11.333-->00:08:16.708 showed up when we parsed all that stuff. So this is a sampling of the sql injection 00:08:16.708-->00:08:20.500 data that- that we pulled out. Right? And so if you look at this table, these are all the 00:08:20.500-->00:08:24.500 parameters that normally had critical sql injection on them. So if you take nothing else from 00:08:24.500-->00:08:28.167 this talk, if you hate the extension, you probably use the data in some way in your 00:08:28.167-->00:08:32.917 testing. Um. So id, update, sort, process which you’ll notice when you start reading 00:08:32.917-->00:08:37.250 these things is- they’re all related to database stuff. A new tester might not know that some 00:08:37.250-->00:08:42.042 of these things are related to databases. And they might not test there. Um. Custom headers 00:08:42.042-->00:08:47.375 showed up time and time again. Um. JSON and XML web services we can alert on types. Uh. But 00:08:47.375-->00:08:52.083 really we’re tr- we’re mostly alerting on regexes of- of certain parameters means here. 00:08:52.083-->00:08:57.292 So column, code, field, etcetera. So this is the data for, uh, file traversal and 00:08:57.292-->00:09:02.292 directory traversal. So, um, things like file, folder, roots, style, load, location. Um. This 00:09:04.667-->00:09:09.833 is where you’re going to try to, uh, change paths or include files that aren’t yours or, uh, 00:09:09.833-->00:09:15.417 cost dependent error in that area of vulnerability. Uh. This was actually out of the Bugcrowd 00:09:15.417-->00:09:20.583 data this year. This was the highest, uh, critical vulnerability that we found, uh, 00:09:20.583-->00:09:25.750 over and over again. So service side request forgery that allowed local file reads. Um. So 00:09:25.750-->00:09:30.667 this is This parameter set and we also found that it crossed over a lot of the filing 00:09:30.667-->00:09:34.958 includes in the directory traversal parameters so we actually alert on both data sets 00:09:34.958-->00:09:41.375 for- for this bug. A lot of money has been made off of SRF this year. Uh. OS Command 00:09:41.375-->00:09:47.167 Injection- a smaller list. Things like daemon, execute, upload, download, dir, uh, log, 00:09:47.167-->00:09:52.542 things that are related to Commandline, uh, and stuff on linux usually. Insecure direct 00:09:52.542-->00:09:58.292 object reference, things that are usually related to kind of, um, the, uh, the state of a user 00:09:58.292-->00:10:04.667 traversing the state of an application. ID, account, order, dot, emails. And then this is 00:10:04.667-->00:10:09.917 server side template injection and, uh, debug parameters. Uh. I didn’t make a nice table for the 00:10:09.917-->00:10:15.458 right hand one. So, uh, service side template injection, uh, obviously template, preview, id, 00:10:15.458-->00:10:19.917 view, name. Uh. I would verify with this bug that you’re actually targeting a template 00:10:19.917-->00:10:24.167 inject- or, uh, template engine before you fuzz for these. But still useful to have. Uh. And 00:10:24.167-->00:10:27.625 then on the righthand side there, the JSON Schema is actually what this looks like 00:10:27.625-->00:10:32.708 and I’ll show it in a sec-second how you go ahead and edit your own parameters. Um. But, uh, 00:10:32.708-->00:10:37.208 that’s the list for debug parameters that indicate, um, things like logic 00:10:37.208-->00:10:41.208 vulnerabilities or special admin parameters that let you do fu- special functions and things- 00:10:41.208-->00:10:47.125 things like that. So access admin, debug, edit grant test, altera clone, etcetera. So these 00:10:47.125-->00:10:52.250 are all language things that relate to vulnerabilities. So the implementation of the Burp 00:10:52.250-->00:10:58.125 Suite kind of, um, APi we used is iScanner check and iScanner Issue that makes a new tab. Um. 00:10:58.125-->00:11:01.958 If you want to edit or make a second tab to have for alerts or for anything like this, it’s 00:11:01.958-->00:11:06.042 really just, like, one block of code. We’ve provided that. Uh. Pretty easily editable here if 00:11:06.042-->00:11:11.417 you’ve ever made a Burp extension. It’s in Python so easily extendable. And then 00:11:11.417-->00:11:16.417 we’ll do a quick demo. Alright. So... Uh. Here we have tesla dot com which is a Bugcrowd customer 00:11:22.542-->00:11:27.542 and they have a bounty. Um. And so I’ve hooked them up to Burp. And on the left hand side, 00:11:31.000-->00:11:36.042 traffic has started flowing from tesla dot com through Burp. Um. So the first thing that you want 00:11:36.042-->00:11:39.292 to do with this is make sure to set your scope. But I’ve already done that. As you can see on the 00:11:39.292-->00:11:43.167 left hand side, traffic is already starting to go through tesla dot com which is what it’s 00:11:43.167-->00:11:49.708 going through right now. Um. Now if I go to HUNT Scanner up here on the right and I collapse 00:11:49.708-->00:11:54.167 these, you can see that it’s already started to tell me that there’s some places that I 00:11:54.167-->00:11:59.667 should look manually for these vulnerabilities. Um. So here I can see, um, things associated 00:11:59.667-->00:12:05.458 with sql injection, things associated to Debug and Logic, service side requests forgery, 00:12:05.458-->00:12:10.458 etcetera. So we’ll go here. Um. And if we click here, now you get, uh, this instance. So, uh, 00:12:12.792-->00:12:18.000 this domain had, uh, the page parameter on it. You can see the advisory for service side 00:12:18.000-->00:12:23.000 template injection, the request here, the response here. And then let’s say you check this 00:12:26.292-->00:12:30.417 manually and it’s not vulnerable to anything You can actually remove it from the list by just 00:12:30.417-->00:12:35.500 checking it off and clicking up here. Um. So, uh, it allows you to remove the stuff that, you 00:12:35.500-->00:12:39.917 know, you’ve already tested. So that’s just a quick overview of- of HUNT Scanner and how HUNT 00:12:39.917-->00:12:44.917 Scanner works. Let me get back to slides. Alright. So the next tool is the GUI and the 00:12:57.333-->00:13:04.042 methodology part of it. >>Alright. So we’re talking about the GUI methodology. So 00:13:04.042-->00:13:10.292 I’m sure a lot of you guys are, you know, pentesters, vulnerability assessors, and, 00:13:10.292-->00:13:14.542 you know, when you’re doing your testing you’re actually going to be doing, you know I’m going by 00:13:14.542-->00:13:19.542 a methodology. Unless you’re some kind of, you know, yellow swag-god hacker, you’re going to 00:13:19.542-->00:13:26.333 be going by a methodology. And you’ll be using things like, you know, the OWASP Testing Guide, 00:13:26.333-->00:13:32.750 the Web Application Hacker’s Handbook, or you might even go by, uh, standards like HIPPA or 00:13:32.750-->00:13:37.333 PCi. So, um, that’s what I’m talking about when I’m talking about methodologies. Uh. For 00:13:37.333-->00:13:41.917 those of you who aren’t, uh, professional pentesters or vulnerability assessors, uh, 00:13:41.917-->00:13:47.000 why- why would you want to use a methodology? Because this is what you need to prove that you 00:13:47.000-->00:13:52.292 did the work. So kind of like, you know, in second grade math, they want you to show the work. 00:13:52.292-->00:13:58.125 This is how you would do it and we actually put that into, uh, Burp Suite so that it’s easy to 00:13:58.125-->00:14:02.167 get, you know, your request and response pairs, uh, within there. And then when you’re 00:14:02.167-->00:14:05.292 going to generate your report, it’s already in there so you don’t have to go through the 00:14:05.292-->00:14:10.292 hassle of copying and pasting and all that nonsense. Right? So the first thing, uh, that we’re 00:14:10.292-->00:14:15.875 going to talk about here i-in terms of the GUI is that you can have a there’s a right click 00:14:15.875-->00:14:21.042 centa methodology section. So from anywhere in Burp where you have a req- request and response 00:14:21.042-->00:14:27.500 pair, you can actually just do a right click and you can see, uh, there’s, uh- there’s a line 00:14:27.500-->00:14:32.292 there that says “send to, uh, HUNT methodology”. And then it has the subfolders and folders 00:14:32.292-->00:14:36.792 where you can actually put, uh, that particular res-, uh, request and response pair after 00:14:36.792-->00:14:41.458 you’ve a-actually done your testing to show that you’ve, um, done the work and proved that, 00:14:41.458-->00:14:45.417 you know, there is a vulnerability there. Or, you know, if you have your POC in 00:14:45.417-->00:14:50.417 there, that’s where’d you’d put it. So this is what it looks like in Burp as far as the, uh, 00:14:52.833-->00:14:58.625 methodology window. So you’ll notice a few things here. On the left hand bars, you’ll see that 00:14:58.625-->00:15:03.542 there’s a- there’s a file tree there. So essentially it’s the methodology that you’re going to 00:15:03.542-->00:15:10.250 be using. And then we break it down by functionality. And, um, for this one- this is the actual 00:15:10.250-->00:15:16.958 default, um, kind of JSON file that we have included within HUNT- and it breaks it down by, 00:15:16.958-->00:15:22.917 um, areas of the application that you generally are testing for vulnerabilities. Things like 00:15:22.917-->00:15:28.458 the account- the account registration, money transactions, authentications, 00:15:28.458-->00:15:32.583 search, contacts us. Those are usually the places we’re going to be testing for 00:15:32.583-->00:15:37.542 vulnerabilities and where you’ll definitely find vulnerabilities of certain types. So for 00:15:37.542-->00:15:43.292 example, uh, on the account page, you’re going to be testing things like iDoor. Or a pro site 00:15:43.292-->00:15:47.292 request forgery, auth-authentication bypass, and stuff like that. So this is how 00:15:47.292-->00:15:53.500 I have it layed out. But if you have your own methodology, you can also just, um, do it 00:15:53.500-->00:15:59.250 yourself and it’s a simple JSON file, uh, and we’ll get to that in a second. And you can, you 00:15:59.250-->00:16:02.500 know, put in your own methodology. Everyone has a different methodology that they 00:16:02.500-->00:16:07.750 follow. But the important thing here is that we wanted to make it easy for the pen tester to be 00:16:07.750-->00:16:13.000 able to actually put that methodology in, uh- in Burp so that they’re, um, going through 00:16:13.000-->00:16:19.000 it and they’re efficient at doing their work. Um. So here you see that there’s a 00:16:19.000-->00:16:25.417 description. So, um, not just for the season pen tester, but again we want to address that 00:16:25.417-->00:16:30.625 tri- tribal knowledge, um, aspect. So if you have newer members on your team who aren’t, 00:16:30.625-->00:16:36.500 um, seasoned or, you know, aren’t, uh, used to doing web hacking, um, for a particular 00:16:36.500-->00:16:40.958 testing here. So let- let’s say, you know, for authentication bypass, I don’t know- I don’t 00:16:40.958-->00:16:45.875 know what the hell that means, um, I would see here on description that, ok, I would do 00:16:45.875-->00:16:52.458 this- this check for this particular type of vulnerability. The next tab here 00:16:52.458-->00:16:57.458 is called Bugs. So, um, we do multiple request and response tracking so you might have, uh, 00:16:59.792-->00:17:03.667 multiple, uh, requests and responses for a particular vu- vulnerability, and they might 00:17:03.667-->00:17:09.750 be, um, different, uh, attack vectors so you keep track of all of that here. And then, uh, when 00:17:09.750-->00:17:14.500 you go generate your report, boom. You already have, um, all of your work there. No copying 00:17:14.500-->00:17:19.500 and pasting; that’s disgusting. Um. Next thing here, uh, the resources. So again, just like 00:17:21.750-->00:17:27.375 in the Scanner window, uh, we’re going to have the resources for you. So, again, you can put all 00:17:27.375-->00:17:30.458 the resources here. Sql injection for example you’re going to do- you’re going to 00:17:30.458-->00:17:35.292 use, like, Pen Test monkey, stuff like that, or you might even put in, um, you know, how 00:17:35.292-->00:17:40.292 to use Sqlmap on there. Stuff like that. And then the notes section. So we also have a notes 00:17:42.958-->00:17:47.125 section here so, you know, whe- when you’re doing your work you might- you might go off and 00:17:47.125-->00:17:51.708 start doing sql injection. You’re not- you’re not finding it or, you know You have the 00:17:51.708-->00:17:57.333 error, but you can’t get, uh, a proper POC for it. Um. And you want to- you want to work on it 00:17:57.333-->00:18:00.833 later. So. Uh. You can leave notes for yourself. You know, try to break it manually. Uh. If 00:18:00.833-->00:18:06.375 I can’t do that, then use Sqlmap. And then if all else fails, I’ll send it to Bob or 00:18:06.375-->00:18:11.750 I’ll send it to Jason because I suck at sql- sql injection. So the next thing here is that, uh, 00:18:11.750-->00:18:18.625 with the notes, um, you can send your actual, uh, JSON file to other people and they can load 00:18:18.625-->00:18:24.542 it up in their- in their Burp for instance. Or you could even, uh, you know, you can save it 00:18:24.542-->00:18:28.375 and then have it for your reports. So, um, just like in that instance with notes, if, 00:18:28.375-->00:18:33.583 you know, I want Jason, for example, to check my work for my methodology- it’s, like, my 00:18:33.583-->00:18:37.000 first week on the job and I wanted to make sure that I’m doing it right, he could go 00:18:37.000-->00:18:40.833 ahead and look at it in his own instance in Burp and it’ll- it’ll have all the requests and 00:18:40.833-->00:18:45.250 responses. Uh. And he could do- he could check that. If, you know, I need help with sql 00:18:45.250-->00:18:50.833 injection from someone on my team who, uh, is much better at- at sql injection than I am, they 00:18:50.833-->00:18:55.000 can go ahead and do that, get the POC, and then send it back to me, and then I can k-keep 00:18:55.000-->00:19:00.000 doing my work. And this is the, um, implementation, uh, within- within Burp itself. Uh. So we 00:19:03.917-->00:19:10.208 used ExtensionStateListener, IContext, um, MenuFactory, in iTab and then that makes the 00:19:10.208-->00:19:16.417 Burp tab, uh, HUNT methodology. So, um, if you were to edit this and then, um, you know, add your 00:19:16.417-->00:19:22.583 own stuff here all you need to do is open up the code and then, uh, go into the create menus 00:19:22.583-->00:19:27.583 function and then mess around there. And then we’ll do a live demo. Let’s see So let’s say, 00:19:31.625-->00:19:36.625 you know So we’re using, uh, the HUNT Scanner and the HUNT Methodology contraption. Right? 00:19:40.042-->00:19:45.042 So, uh, let’s say I send one of these to Repeater. So you can actually, um, you know, send all 00:19:49.708-->00:19:53.958 these requests and responses from Scanner to things like Repeater and Intruder. And then 00:19:53.958-->00:19:59.042 you can continue your work there. So let’s say I send it to Repeater, and I have one set up 00:19:59.042-->00:20:05.875 here So I do- I do my hacking on here. I do my manual, uh, tests. And then I find that it 00:20:05.875-->00:20:12.708 is, uh, vulnerable. Let’s see this one. Um. And, you know, it’s there. I want to send it to 00:20:12.708-->00:20:19.625 my methodology now because I’m done. And I want to prove my work. So, um, right click here. 00:20:19.625-->00:20:24.625 Send to HUNT Methodology. Let’s say I’m testing for iDoor. I’ll put it right here. When I go 00:20:26.667-->00:20:33.292 into methodology, I’ll go into functionality and account. And then it’s in- it’s within the 00:20:33.292-->00:20:37.833 bug so I- I can also, you know, just close it if, um, I don’t want- I don’t want it in there. 00:20:37.833-->00:20:44.333 So that’s the, uh, typical workflow for, um, getting stuff in Scanner and then doing the 00:20:44.333-->00:20:49.333 testing in Repeater and Intruder, sending that all into, uh, the HUNT Methodology. Now 00:21:04.750-->00:21:09.000 let’s talk about the actual plugin installation. So, um, as we were talking about before, 00:21:09.000-->00:21:15.250 this is- this plugin lives within Burp Suite so kind of the installation is that, uh, you 00:21:15.250-->00:21:21.417 know, we’re using Jython so the actual, uh, code is written in Python and then we use Jython to 00:21:21.417-->00:21:26.083 be able to use it within Burp because it’s- it’s using the JDN. So what you would do is 00:21:26.083-->00:21:31.500 here in this, uh, Python environment, uh, you would go on the Jython website, uh, get the 00:21:31.500-->00:21:37.708 latest standalone jar and you would actually put it in here so that when, uh, Burp loads up 00:21:37.708-->00:21:42.708 the, uh, plugin, it’ll- it’ll go in there. Next is the actual installation of the plugin 00:21:44.792-->00:21:51.042 itself. So you would go into the extender tab and you would add it as a Burp extension. Uh. 00:21:51.042-->00:21:55.625 You’ll notice here that there is an extension type. I set it to Python and then I set it to the 00:21:55.625-->00:22:00.958 actual extension itself. So then, uh, wherever that’s living, select it and then 00:22:00.958-->00:22:05.958 you’re off and ready to go. But more of the setup of actually using, um, HUNT So, uh, those 00:22:09.208-->00:22:14.208 of you who have used, uh, Burp a lot know that, um, the passive scanner can be, uh, pretty 00:22:16.875-->00:22:21.792 noisy. So depending on how you have your scope set up, you definitely want to do that. So 00:22:21.792-->00:22:27.375 you can see here, um, like with the example Jason gave earlier with tesla, you would add the 00:22:27.375-->00:22:32.375 in the target window, add Scope, add tesla here, and it will only get tesla, um, hostnames, uh, 00:22:35.500-->00:22:40.500 that match. After that, you would go into Scanner. And then you would, uh, select a use 00:22:43.167-->00:22:47.833 suite scope on the live passive scanner. So the- the scanner actually uses the passive 00:22:47.833-->00:22:52.417 scanner, but none of that information will show up on- on the actual passive scanner 00:22:52.417-->00:22:57.417 window. It’ll be in- it’ll be within HUNT. And, uh, kind of the effective way that we-we’ve 00:23:00.042-->00:23:05.750 seen, uh, this used and how we use it ourselves is that within the target window itself, you 00:23:05.750-->00:23:12.125 would go in there. Um. Click, uh actually spider all of those items so you can get a lot of 00:23:12.125-->00:23:17.417 coverage for all the things you need to test. And once that’s all done, click passively scan 00:23:17.417-->00:23:22.417 selected items, and all of that will end up in the, um, scanner window. >>Cool. So another thing 00:23:25.500-->00:23:30.792 that we wanted to make sure, uh, was that it was easily extensible. So, um. So both, uh, 00:23:30.792-->00:23:35.792 Methodology and, uh, Scanner, uh, can easily be extended to accommodate something like a new 00:23:38.333-->00:23:42.917 CDE that comes out tomorrow. Maybe Burp doesn’t have to check for or a specific vulnerability, 00:23:42.917-->00:23:47.625 that maybe you guys see in your environment but wasn’t in our data set. Um. So the scanner 00:23:47.625-->00:23:52.792 sensibility is just a JSON file. It’s called Issues dot JSON. Um. And so you, uh, define, uh, 00:23:52.792-->00:23:57.375 something in this kind of schema With, uh... Here you can see IOS injection is the one that’s 00:23:57.375-->00:24:01.750 listed. Uh. And then all you have to do to add, um, a new parameter alert is just add 00:24:01.750-->00:24:06.708 something at the bottom here. Here you can see under, uh, download I’ve got sexyparam. Um. 00:24:06.708-->00:24:14.042 So this will now alert in the HUNT window. Methodology is very much the same. JSON file. Um. 00:24:14.042-->00:24:21.042 You can set the top level pieces of the methodology, um, in the schema. Um. There’s a ray and, 00:24:21.042-->00:24:25.875 uh, you can set, uh, texts about it. Uh. You can set notes with it that automatically pop up 00:24:25.875-->00:24:37.125 with it. Resources bugs you can load them automatically, um, by filling out this JSON schema 00:24:37.125-->00:24:40.625 as well. So we’ll go ahead and add something really quick. So here we have the issues JSON 00:24:40.625-->00:24:46.167 file open, um, for my loaded, um, HUNT scanner. Um. At the top, the first one is insecure 00:24:46.167-->00:24:53.333 direct object reference and I’m just going to add a custom parameter here. So, uh, I’ll add 00:24:53.333-->00:25:04.750 beefcake. Alright. So I’ve added beefcake to, uh, the list. And I will just save that. And now we 00:25:04.750-->00:25:19.875 will reload, um, HUNT Scanner. So you do that through Extender. Uncheck Scanner. Recheck 00:25:19.875-->00:25:35.375 Scanner. Cool. Now we’ll go to our site and we’re proxy8 still and here we will change this 00:25:35.375-->00:25:42.875 too. Hopefully this works. So this obviously doesn’t exist, uh, but it’s still going to 00:25:42.875-->00:25:51.500 trigger the Scanner. Hopefully. Alright. Uh. So let’s go to Scanner. I think that was in 00:25:51.500-->00:26:00.333 iDoor, right? Yeah. There’s beefcake and there’s our request and response. And then we could 00:26:00.333-->00:26:08.417 send this to either Methodology or Repeater to continue testing. So real easy to extend. Um. Both 00:26:08.417-->00:26:19.875 the, uh, the methodology and the, uh, issues in this. There’s also the checklist and, um, we 00:26:19.875-->00:26:25.083 included two methodologies with this so, uh, if you go into the default it’s checklist dot JSON. 00:26:25.083-->00:26:29.333 And here you can see this is kind of the schema. I’m not going to type up a whole new 00:26:29.333-->00:26:33.292 one. But, uh, pretty easy to just copy and paste one of these blocks here, uh, and create new 00:26:33.292-->00:26:36.750 methodology steps for your testers if, should it apply to your work if you do something 00:26:36.750-->00:26:58.375 different or, uh, you don’t like the methodologies that are included. So Cool. Um. So stuff 00:26:58.375-->00:27:03.750 we want to do that we haven’t done yet. Um. So, uh, we want more methodologies. So we 00:27:03.750-->00:27:08.208 included in this one- we included, um, the application functionality map, uh, that we 00:27:08.208-->00:27:13.875 tested. And then we also included the web application hacker’s handbook methodology in 00:27:13.875-->00:27:18.750 the back of the book. Um. So these are things that we want to kind of improve on. This is all 00:27:18.750-->00:27:22.417 on Github. We’re looking for people to help with this stuff. Um. So PCI, HIPPA, CREST, OWASP, 00:27:22.417-->00:27:26.708 PTES all have, uh, methodologies or reference each other for methodologies and are kind of 00:27:26.708-->00:27:31.917 modified. Um. So we would like to port these into that JSON schema so we could support, uh, 00:27:31.917-->00:27:37.500 using methodology for those. Um. We like Burp but a lot of people like Zap so we’ll probably port 00:27:37.500-->00:27:42.292 this to Zap at some point in the future. Um. More scanner vulnerability checks and classes 00:27:42.292-->00:27:49.583 with data sets from not just us, uh, from other people. Um. More resources, uh- more testing 00:27:49.583-->00:27:53.708 resources from new people getting into application assessment so cheat sheets, uh, 00:27:53.708-->00:27:57.667 guides on exploitations- good ones, um, internal methodologies for testing certain, uh, 00:27:57.667-->00:28:03.250 vulnerability classes, etcetera. Um. Dynamic JSON structure source. So we’re now in the, um, 00:28:03.250-->00:28:07.333 methodology, you can only have two nested methodology pieces. Um. And you have to sport the 00:28:07.333-->00:28:11.833 rest to be in notes and tabs. Um. It’s just something that we haven’t been able to get around 00:28:11.833-->00:28:16.167 right now so we want to figure out that problem. The GUI is, uh, not up to par. We would like 00:28:16.167-->00:28:22.167 to make that better. Right now it only supports, um, uh, param equals value scanning. So we 00:28:22.167-->00:28:26.625 would like to support rest scanning at some point as well. Um. So rest URL support. Um. And 00:28:26.625-->00:28:31.833 then there was you noticed we did the right click, you only saw Intruder and Repeater. We’d 00:28:31.833-->00:28:36.667 like to include, um, some of the other full Burp helpers like, uh, the rest of click menu that 00:28:36.667-->00:28:41.000 you get in Targets, uh, searching and highlighting, etcetera. But those API’s are a 00:28:41.000-->00:28:46.208 little bit harder to bake into a custom tab window. Um. We’d like to be able to, um, do some, um, 00:28:46.208-->00:28:50.083 file name analysis instead of just parameters, but we don’t have data on that yet. We can 00:28:50.083-->00:28:54.542 parse it soon. Um. So instead of parameters like, uh, resource name or script name or something 00:28:54.542-->00:28:59.250 like that, uh, most vulnerable classes there. And then alert on content types, etcetera. So 00:28:59.250-->00:29:04.667 there’s still a lot of work to be done here. Um. But, uh, but yeah, it’s pretty good. And 00:29:04.667-->00:00:00.000 then, uh, responses on errors. So, yeah. So that’s, uh, that’s the jist of the tool. [applause]