Welcome to the 410 talk for the speaker workshops. And we're
going to get started and we're going to talk about Portia by
Michael Gennarakis and Keith Lee from Spider Lab. Thank you.
All right. There we go. Okay. So just to introduce ourselves. So
my name is Michael Gennarakis. I'm the director for Spider Labs
APAC. And Keith is the senior consultant in the Spider Labs
APAC group. So I'm from Australia. Keith's from
Singapore. So the motivation for the Portia tool is as pen
testers, we do a number of internal network pen tests as
part of our day to day. There are a bunch of awesome tools and
techniques for capturing and cracking credentials, for
example, Responder. And we really wanted to fill the gap
from, you know, once we've got a low privileged account, even
perhaps, you know, the client will give you a little bit of
a low privileged account to start with. We really wanted to
fill that gap between having a low privileged account and
getting to a high privileged account in terms of the tooling.
And we, and also help with a few common issues that we came
across as pen testers on our day to day. So we developed a tool
called Portia to help with this. We developed Portia because we
found similar tools had a number of issues. So apart from the
fact that, you know, they're all sort of disparate, you've got a
number of PowerShell scripts and different, different tools that
you use that don't really sort of sync together. And we're
finding that a lot of the tools have limited support and success
on more recent versions of Windows. They were not as
effective against systems that have implemented common
hardening techniques. So we had to sort of figure out ways to
bypass that and then run what we needed to run. And we wanted a
single but also modular tool to cover the techniques rather than
having multiple tools. So Portia aims to automate a number of the
techniques that we commonly perform on an internal test. And
it's really amazing how much of that help we get out there.
So we've designed our Portia after we've got a low privilege
account. So things like privilege escalation, lateral
movement, and also a bunch of convenience modules that that we
typically would like to use. Just as an aside on the name, so
Portia is actually a type of jumping spider that feeds on
other spiders. They're known for being very intelligent and have
good problem solving capabilities. So we thought that was a being
from Spider Lad. We thought that was a pretty cool name. So
that's where it is. So this is a basic workflow for for our for
our purposes. If we were to kind of start off with a quick
for demos. That's on the right, you can see a basic network that we've set up for demonstration
purposes. It's got a domain controller, a couple of hosts, and the hacker, right? So this is the
basic workflow of Portia. I'll dive into each of the individual items in more detail on how it
works. But just to give you a bit of an overview, we've got our credentials, right? It checks the
credentials, makes sure they're valid and they work. It enumerates a list of users in the domain
admin group. It checks if the account is part of the domain admin group, because, you know, you
might get lucky, you never know. It checks SysFall for stored credentials. It syncs the time with
the domain controller and attempts to exploit MS14068. If it's vulnerable, if not, it goes in and
checks MS08, 067, MS1710. It checks which host the account has admin access on. It checks for
impersonation tokens belonging to the domain admin group. If you don't get lucky with that,
find out what happens. If you do get lucky with that, it adds the impersonation token to the domain
admin group and you can run Mimikatz on the DC. If not, it runs Mimikatz locally and you get some
hashes and then if we get any new have has or passwords, we test those credentials and start
again. The whole idea is that it's iterative. We work through it, and then every time we get a new
pass over, we start the process again. Every time we get access to a new host, we start the process
digit again. And we will just continually work through it. às
through this sort of basic workflow until all the passwords
or hashes have been exhausted, or all of the hosts have been
compromised. And then we can continue with some of the post
exploitation modules we have. Another thing that we added
recently is, it's not just an automated sort of click and go
tool, you can run any of these individual modules directly, or
combine them. So we wanted to have that flexibility as well.
So we start with the low hanging fruit. So credentials
may be stored in group policy preferences. So there are a
number of locations where you might find credentials. So drive
maps, local users and groups, schedule tasks, etc. So when you
create a new group policy preference, an XML file is
created in SysVol, which contains all the relevant
configuration information, and you may get passwords in there as
well. And any authenticated domain account can access that,
so you don't need elevated privileges for that. And
passwords are encrypted using a known 32 byte AES key. I say
known because Microsoft published it on MSDN. Presumably,
inadvertently, it had been there for years. So, yeah, we can
decrypt them. But, of course, you know, once this came out,
you know, it's a pretty big fail. So Microsoft patched it
in MS14.025. And so the result of that patch is you can't
create new group policy preferences that rely on saved
passwords. But it doesn't remove the old passwords, right? So
how many clients and organizations do you know that
just patching things, you know, sometimes wrote, you know, a new
patch where you apply it, but they're not really understanding
what's going on in the patch? They don't know what it's
fixing, and they don't know that they need to go back and
clear out those passwords. So we still see it all the time on
tests where they still have old, insecure passwords that we can
decrypt using that key. Then we check for MS14.068. So the,
basically, it's a privilege escalation vulnerability that
allows you to elevate your privileges to domain admin. And,
so, basically, you can create a fake pack claiming that your
regular user that you have access to is a member of the
domain administrator's group and then, you know, elevate your
privileges that way. If that's not successful, we do try, you
know, the classics, right? MS08.067. It's an old one. It's
mostly patched, but you never know your luck, right? So it's
easy one to do. And so we check for that. The more recent one,
you know, thanks to Shadow Brokers and the NSA, allegedly,
we have MS1710, and that's the SMB4 that can also allow for
remote code execution. So if we get remote code execution on
those boxes, well, then that's great, right? So assuming
there's no passwords in SysVol, and assuming those, those
vulnerabilities have been patched and they're not
exploitable, you know, what do we do next? And that's where we
get to the impersonation token. I'll hand it over to Keith.
Okay, thanks. Impersonation token is when a user logs into a
system and then, which button is it?
Okay. And then a delegation token is created, which is
converted to an impersonation token even after the user logs
out. So this impersonation token has exactly the same right as
the delegation token. It doesn't get deleted and it
remains on the system until it's rebooted. So what happens is if
a domain admin logs into a box and then the attackers gets to
the box, he can use that token to execute domain commands,
that run on the domain controller, yeah, using, having the same
privilege as the domain admin. So, yeah, this is just an example of
what it looks like when we, using the privilege escalation,
using the token. Sorry. Okay, so if there's no impersonation token,
what happens? For sure, we'll run the Mimikatz and as well,
down the local password hashes. So if there are new password
hashes or new password that gets, it gets added to a database
and then the process continues and it tries to use the new
password to attack hosts that have not been tested before. And
it repeats this again until there's, it runs out of password
to test or until all hosts have been compromised. So the thing
about shared local administrator password is, um, sometimes
IT administrators are lazy or they've tried to do it the easy
way out. Um, all the systems are using the same shared local
administrator password. So when you compromise one host, you can
compromise the other host in the network which having the same
shared local administrator password. So yeah, so with the, um, with the
shared, uh, local admin password, the idea is that, um, you know,
typically when we talk about privilege escalation, right, we're,
we're usually only looking to go up. But one, one of the things
that we want to do on a pen test is get a lot of coverage and, you
know, it's, it's a real sort of pain in the ass to check every sort of,
uh, host in the, you know, in the network that you may be, uh,
may be in scope, um, to see if the, uh, credentials that you
have could be useful. So, so the idea is that we can get, uh, a
lot of breadth and, um, we're looking to expand on that, uh,
and I'll get, I'll get to that at the end. Um, so yeah, uh, so the
other thing, you know, going back to the context, right, um,
there are a number of, uh, controls that have been
implemented, um, that, uh, you know, can stop us from doing
these things. So we need to figure out ways to bypass that
and Portia has support to automate some of these bypasses.
So, uh, Microsoft's created the app called, uh, Microsoft
Anti-Malware Scan Interface. Um, so it's designed to detect and
prevent script attacks, so things like all your, all your
PowerShell scripts, right, that you're running, it's designed
to, to detect those and, um, to, to shut them down, right?
So, uh, it implements a number of security checks, so it scans,
you know, file and memory and stream, um, content source, URL,
IP, you know, checks, um, and a whole bunch of other techniques.
Um, it also has some support for, um, breaking through obfuscated
scripts and, and identifying obfuscated scripts. Um, so,
um, and Portia currently implements two techniques to
automatically bypass, uh, AMSI. So, the, the first one is like a
real basic one. You might get lucky with it. Most times no,
but we still got it because it's pretty easy to implement.
Um, so basically if the host is running .NET, uh, version 2.0,
you know, you can see the whole string up there. It's a very
specific version. You can actually force the use of
PowerShell v2. So, um, AMSI is supported in, uh, PowerShell
version 3, but not, currently not PowerShell version 2. So,
um, so with that you can use the dash version option, so it's
dash version 2, and you can, uh, force the use of PowerShell 2,
which, you know, is bypasses AMSI. So, uh, works well. But,
you know, it's, it's reliant on that single version being
available. Um, the more robust technique, um, was created by a
guy called Matt Graber. I apologize if I ruined his name.
Um, but, uh, uh, basically, um, it's a simple one-liner, um,
that unloads AMSI from the current process, and it doesn't
require elevated privileges, and it works with PowerShell v3.
Right? With AMSI. So, um, that's the robust one that
usually works most of the time. Um, there's a bunch of other sort
of bypass techniques that have been, um, presented, uh, over the
years. Um, and, you know, we'll probably add some more, uh, as we
continue to develop Portia. Um, the other, the other control
that we frequently run up against is AppLocker. Um, so,
Portia implements a number of AppLocker bypass techniques. Um,
so, one, the first one is, um, you know, exploiting weak path
rules. So, inappropriate folder permissions. So, by default,
Windows allows read and write, um, uh, under the Windows, uh,
directory, but Windows slash tasks, Windows slash temp, and
Windows slash tracing. Um, so, any binary that executes from
these folders won't be blocked by AppLocker. And so, you,
Portia just loads PowerShell into that, into the task
directory, and, and we're good to go. So, pretty
straightforward bypass. Um, the other one that it tries, uh, is
with MSBuild.exe. So, injecting code into a signed Microsoft
binary, um, you know, if you, if you manage to do that, it will
execute code without it being picked up by a device. Um, so,
MSBuild.exe, specifically, allows for, uh, inline tasks,
which is basically, uh, allows you to compile and execute code
and memory on the target, um, and, you know, can be used to
effectively execute arbitrary code on the target, and Portia
uses that as, as an AppLocker bypass, if, if necessary. And
the final AppLocker bypass, um, is, uh, a, a script that was
written, I don't, I'm not going to try and pronounce his GitHub
username, um, but it was, it was written by that guy, and it was
based on technique developed by, uh, by, uh, by, uh, by, uh,
by a sub-team, um, and it'll actually run .NET code inside
JScript or VBScript. Uh, so, PowerShell also, uh, Portia also
has, uh, support for the invoke obfuscation script. Um, so,
basically, it's a script developed by a guy called
Daniel Bohannon, um, and it'll, it allows for, uh, obfuscation
of your PowerShell scripts, uh, with the idea that you can
bypass AV and other protections that might be looking for, um,
PowerShell scripts. Um, so, I mean, it doesn't work 100%
of the time against every AV, but it, it works well enough most
of the time. Um, the other thing as well, again, going back to the
context at the start, where we sort of said, you know, a lot of
these, uh, scripts and tools that we use aren't well
maintained, and they don't really, uh, run well against
newer versions of Windows, um, the invoke Mimikatz script, uh,
script, which is the one that's commonly used, um, to, to run
Mimikatz, um, it's running an outdated version of Mimikatz,
and it can have issues with Windows 10. So, the way that
Portia does it, uh, it's, it's, it's, it's, it's, it's, it's
we use the invoke reflective PE injection script, which runs the
latest version of Mimikatz, so it can be any kind of code, it
doesn't have to be Mimikatz, uh, in the memory of the target
host, and it's a way more reliable version, uh, uh, way
more reliable against recent versions of, of Windows. Um, so
the other thing that Portia does automatically is, we've got this
list of passwords right, we've got this database, um, we check
it against any available, uh, SMB shares or folders just to
see what we can access, what we can't, and which passwords work
with which, with, with, with, with, with, with, with, with,
which resources. Um, cool. And Portia, uh, has a bunch of, uh,
other modules, so we, we mentioned a bunch of, like,
convenience modules, um, and, you know, other privilege
escalation related modules. Um, this is just a sampling, we're
adding more all the time, so obviously it's available on
GitHub, I'll throw up the link at the end, um, so if, if
people want to contribute, uh, they can. So, currently, you
know, it dumps wireless passwords, it looks for, um,
configuration files that are known to have, you know,
passwords in it, like VNC configurations. Um, and, and, and,
party configurations, things like that. Uh, it dumps browser
credentials as well, um, and, uh, you know, key pass
credentials, um, you know, config files, things like that.
Um, it also, it also has, uh, an, a, a recent module which is
automatic compromise of MS SQL databases, and I'll hand over
Keith to, to go through that. Okay, so what happens in this
module is, um, let's say if you don't have access to the SMB
ports, but there's a MS SQL service that's running. So, what
this module does is, um, look for weak passwords, whether you're
using, um, it has to go into the weak password that is, uh,
supplied by social engineering toolkit, and then if it's
successful, enable XP CMD shell, like, uh, as a local admin
account on the box, and it also enables the admin share so that
you can run SMB stuff. Uh, dump hashes and, well, I mean, dump
hashes from the same database, um, dumps clear text credentials
via Mimikas.
Um, it also looks for interesting information stored in
the database, like, uh, card information or password. Yeah.
Um, so this is just a screenshot of what it does. So, um, as you
see in this screenshot, it detects that, um, PowerShell is
blocked by ad blocker, so it attempts one of the technique to
bypass it so it can run invoke Mimikas, and then, um, it adds,
uh, it found, it dumps the clear text credentials from memory,
and then it dumps the same, the hashes from the same database.
And then, um, it dumps the, sorry, where is it, the MSSQL
credentials, and lastly, at the bottom, you can see that it
finds all the interesting data and display in a format that is
easy for you to see, so you don't have to look through all
the tables and stuff.
So currently, Portia looks for things like usernames,
passwords, credit card numbers, emails, anything that's
sensitive that may be useful on a, on a pen test, typically?
Yeah.
Um, so, um, so, um, so, um, so, um, so, um, so, um, so, um, so,
um, so, uh, Portia also looks for interesting files that could
be like KeeBuzz database, um, unused 10.XMR, that can
contains credentials or trav ng .ni that can also create
credentials and, um, documents that has the name password in
them, and so on and so forth.
And, yep, you can use other modules, like there's a
KeeBuzz module, or there's a Tue specific module that will
actually unlock them on you, they can dump this on, the
panel, or you can use, you can use Modules that, that are
password and the keys to decrypt it offline.
You can use any of these modules individually?
You don't need to let it run automatically?
If you just want to run, you know,
just want to use it to look for any files called, you know,
password.txt or that look like they contain passwords,
you can just do that.
So even if you've got access already,
you can just run the modules individually.
And you will automatically download them for you,
so you don't have to pull it down individually.
And you also display, like, the first few string of what it
looks like as a text document.
So the other thing that we do, another module that we have
that's pretty common, that's very useful,
is dumping browser creds.
So it uses various PowerShell scripts.
So first it checks if Firefox or Chrome is present on the system.
It checks if the current logged in user, you know,
what the current logged in user is and checks whether we have
that hash or password belonging to that user in our sort of
Portia database.
So to speak.
And then we have a PowerShell script that runs within that
user session and dumps the credentials to a file.
The other thing we do, so this is an example of, like,
a convenience module that we have in there that's not directly
related to privilege escalation or lateral movement or anything
like that, but it's a common activity that we would do on a
pen test.
So, you know, most pen testing we do or generally is for PCI or
we're looking for credit card information or something that's,
you know, something of value like that.
So we've got a module in here that searches for pen on disk and
in memory.
It uses a couple of scripts that are already written.
We didn't write anything new for it.
Basically, obviously the credit card found on the disk,
it works through the same way as the other modules that find
interesting files works.
But the way that the memory scraper works,
so Portia will enumerate a list of all applications on the host
that we have admin access on.
And then once we've got that list of processes running, you know,
we have produced a table.
That, you know, shows which programs are running on which hosts
and what processes are common.
And then we look for interesting processes to dump.
So we don't dump it all, obviously.
But this is what it looks like.
So you've got that table there.
So let's say you're, you know, doing a retail client or something
like that that's got POS systems.
It's likely their POS application potentially has credit card
information in memory.
So you would select that process if you've got access to that host
and dump the memory and see if you can print that out.
You can find anything good in the memory.
We've also got some basic support for analyzing hashes.
So currently we can analyze if there's a blank hash or if there
are accounts that are using the same hash.
But, you know, we want to build out this functionality a little
bit further.
So one of the things that we unfortunately commonly see on
pen tests is password reuse between low privileged accounts
and high privileged accounts.
So we sort of see that all the time where they use the same
password for both.
So if you're able to get the low privileged account, it's very
easy to get access to the higher privileged account.
So we've got a, well, Portia, currently this is what Portia
does.
It has a list of the valid hashes and analyzes it for
patterns, obviously blank ones, you know, reuse passwords across
different, you know, different accounts and things like that.
So, yeah, and as I said, we're looking to expand it and it can
be useful on a pen test.
So where are we looking to take Portia?
So it's something that we're continuing to actively develop.
The biggest area that we want to progress in is attacking targets
in adjacent networks via proxying through trusted hosts, right?
So if we're in a particular network segment and we don't have
access to other hosts on another network segment, but we have a
host that we have access to on our segment that's trusted into the
other segment, we can proxy through that to run Portia then on those
hosts that it can see.
So that's something that we're working on right now.
That we want to really improve on.
And I think it's sort of the missing feature right now that
will make Portia really more, a lot more robust.
So that's what we're working on now.
We're looking to add a bunch of data exfiltration modules as well
because that's a common activity that we do on pen tests.
We would like to add support for more database modules as well.
So not just MS SQL, you know, Postgres, whatever.
And there are a few dependencies as you may have been able to
understand.
But we want to make sure that we have a lot of support for those
So that's something that we're trying to allude to.
And they're not, it's not difficult to set up.
It's not like trying to set up Metasploit from scratch.
But, you know, we want to create a doc image just to make it, you
know, easier to set up and deploy.
So this is where it's located.
It's on our GitHub page.
Feel free to, oh, yeah, we'll just switch over because we're
going to do a demo now.
But hopefully it works.
We'll see.
But, yeah, so check it out.
It's on our GitHub page.
And if you have an idea or if you want to develop a module of
your own, yeah, I think we're good.
Yeah.
No?
Nothing?
Yeah, there we go.
All right.
So, yeah, if you have ideas for modules or you have issues or
bugs, submit an issue in GitHub or submit a pull request if you
want to.
And we'll go from there.
So now we have a demo.
Yep.
So you can see that it's just through the normal mode where
you find the boxes and try to compromise and get the hashes
and password and from compromising one box to compromising the
domain controller.
I'll let you run first because it's going to take a while.
But let me explain.
I'll come back to it.
So what happens is you get a password that you capture or
crack from some other place.
So you've managed to find that it has an admin access on one of
the boxes.
You just go to the domain.
And this is what you see.
So firstly it dumps MimiCats followed by dumping the hashes.
So something interesting is one of the administrator has locked
into the same box.
So you do see a domain admin account here.
Can everybody see that?
It's a bit small, right?
Can you?
You go ahead.
Sorry.
View?
Yeah.
Zoom in?
Yeah.
Is it better?
Is that better?
Yeah.
Cool.
Okay.
Let's move back to the start.
Where is it?
Okay.
So, yeah.
Sorry.
Maybe just to take a step back just to remind everybody.
This is just a really simple network.
We've got a domain controller.
We've got a host that's connected to the domain
controller.
It's a pretty simple network.
It's just because it can take a while if you've got a large
network.
Yeah.
So on this machine that's joined to a domain,
there is a domain admin account.
I mean, the domain administrator has locked in.
So after it dumps the credentials by MimiCats,
it dumps the same database.
It analyzes that.
It also tries to pick up the impersonation token.
So that's an administrator impersonation token.
So we can basically make use of either the
clear text credential or the token.
Since you have the past clear text credential,
the script will just, for sure,
will just use the clear text credential
to compromise the domain controller.
Yup.
It just tests MS14068.
Since the first account we used
was a local user account,
it doesn't have access to the domain,
so it will skip this part.
If it has a valid user account,
it will test whether it is vulnerable to MS14068.
So now it has moved the lateral movement
to compromise the domain controller.
Using the credentials that you have
captured from memory.
So it does the same thing.
MimiCats, same database,
and then tokens.
And then it collects all these credentials
and hashes and compromise
the third box, which is
host in the work group mode.
But coincidentally,
just as what we've spoken earlier
about the shared local administrator password,
so these two machines, even though one is in domain,
one is the work group,
both are using the same shared local administrator password.
Using the,
as you see here,
it uses the hash,
NTIA hash to compromise the third box.
So in the end,
it will tell you like,
it will stop when
it runs out of hashes or passwords to try,
or when all hosts have been compromised.
So what you see here is all the hashes
that it has seen and collected so far.
Password first,
followed by hashes,
and then it does an analysis of
what accounts use what password, what hash.
You can see that these two accounts use the same
password hash and so on.
And then it also
lists down what hash and what password
it used to get into the box.
So, and then it ends by saying
that you can either run post-expert module
or it stops this way.
So let's look at another
thing, which is the
MSSQL module.
Okay, like just now I was explaining
scenario where there's only MSSQL
port that's open,
SMB ports are not open.
So how do you compromise it?
So in this case,
it found a default account.
It tried to test against a weak password.
And then,
so it got in and then it enabled
the XPCMD shell.
It adds a local admin account.
And then when it's trying to run
other scripts, it realized that
PowerShell is blocked by AdBlocker.
So it attempt one of the techniques.
And then successfully run
on the machine.
Done the clear text credentials.
Done the same database.
And then followed by things like
the password
and look for interesting data.
I mean, it also enabled
the admin folder so that you can
access it remotely, even though
it's blocked initially.
In future version, I plan to do
like, every sub-version
that's compromised, you return shells.
So that's more fun than just
getting past it.
Another thing that we're also developing
is a tool
one of our colleagues in Singapore
wrote as well,
called 2M Assassin.
So we're adding in support where we can
to, well, the purpose of
that tool is to automatically attack
some 2FA implementations.
So we feel like it's a good fit for
PowerShell as well.
So we're going to probably integrate the two.
That's not on our Spiral Labs GitHub just yet.
But it will be soon.
So this is another module about
scanning for vulnerability.
So it scans for MS08067
or MS17010.
It doesn't exploit at this point,
but as time goes on,
we plan to add in,
because we want to add in other
common techniques to get from
zero to domain admin.
Or as easy as possible.
So let's go on to the next module.
It's about files.
Finding interesting files.
So same as usual,
it checks whether
PowerShell is blocked or not.
Because it's easier to run
with PowerShell.
And after that, it finds all the interesting files
that could contain passwords
or other sensitive data.
Because previously,
might be storing password using text document.
Then it migrated to Excel.
Then now they upgraded to KeePass.
So might as well download the KeePass file.
It downloads all the interesting files
for you as well as the location.
This one is
to show that
it's the same as just show
Give me a second.
Okay.
If the administrator
or the user has the KeePass
open on his computer,
it's able to
dump the clear text credentials.
So it's just using a common script,
but it detects which user
is logged on
and using the KeePass software.
And it has to run it in a context
so that it can dump the credentials.
If not, it doesn't work at all.
This is just
another screenshot
to show that it dumps the
TrueCrypt keys
so that you can decrypt it offline.
There's also
module that we are working on.
Just now we've been speaking about
finding alternative route to attack adjacent network.
So if you provide
it with a list of IP address
and it can't access those IP address
initially by ping or
whatever, but it found a route
in an alternate
host, it will highlight
it doesn't show here because I don't have an example
but it will highlight here that it says that
this host has an alternative route to
what you might be interested in.
So this is just a small step to
where we are going next.
Last, second last.
It finds clear text
I mean documents that
contains credit cards.
And as well, this is same as what we see just now
but it displays the card number.
Not my card number.
And then
this is just what we run just now
but as it takes some time
now it has finished running
to show that it works.
Just a comment.
I should check out Cloakify
done by Joe Gervais last year.
Python 2.7
I made, I upgraded to 3.5
and did the PowerShell version.
But it takes any exe file, image file,
binary file and turns it into a list
set of lists that you define.
A list of Pokemon with latitude
and longitude in front of it.
Clear text, whatever. It's pretty powerful.
It's awesome.
Yeah, thanks man. We'll check it out.
You had a question there?
So in talking about sensitive data
you mentioned credit cards.
How about PII
and PHI which is a little more
complicated.
Yeah, so at the moment
it's relatively limited
in terms of what it looks for.
But that said, we are expanding that.
And that's on the list to do.
We're trying to get the routing
stuff in first.
But expanding
our searches for
broader categories of sensitive information is definitely
on the radar.
And obviously if anybody wants to contribute
then feel free.
No, you can define
the limits of the scope.
Or you can just let it run.
It depends.
We tried to make it as
modular and as progressive as possible.
So you can have it run as much as possible
against whatever it can do.
Or you can either run
individual modules
or you can limit
certain modules have certain
options to limit
what gets run.
Yep, another question.
.
.
.
It's now on screen.
But that's a good idea.
We should probably be able to add an option
to dump it to a file.
Cool.
Any other questions?
I think we're out of time.
.
.
.
.