1 00:00:00,000 --> 00:00:07,640 The speaker is Abhijit, and he generally does pen testing and is interested in mobile infrastructure testing as well. 2 00:00:07,840 --> 00:00:11,600 So I'm passing on the stage to him. Hi, Abhijit. Let's welcome him. 3 00:00:12,040 --> 00:00:12,900 Thank you. 4 00:00:19,540 --> 00:00:26,180 Does this work? Mic testing, one, two, three. It doesn't. 5 00:00:28,200 --> 00:00:33,700 I can shout, mic testing, one, two, three, four, five, six, seven, eight, nine. 6 00:00:35,360 --> 00:00:37,260 It just, it works like this, but. 7 00:00:44,660 --> 00:00:47,200 Mic testing, one, two, three. Nope. 8 00:00:48,720 --> 00:00:53,400 Mic testing, one, two, three. Okay, guys, this is what I'm going to give my presentation today. 9 00:00:53,700 --> 00:00:55,040 Sorry. No, I'm just going to be. 10 00:00:55,600 --> 00:00:57,600 I'm just going to shout as much as I can. 11 00:00:58,020 --> 00:01:08,500 I was giving a virtual talk like two weeks ago, and someone told me my accent slash my voice slash my speech sounds like an IRS scammer. 12 00:01:08,620 --> 00:01:11,480 So I really can't help it if it sounds like an IRS scammer. 13 00:01:12,340 --> 00:01:14,460 You guys know what an IRS scammer is, right? 14 00:01:15,060 --> 00:01:18,280 If you don't, you should go to YouTube and type IRS scammer. 15 00:01:18,360 --> 00:01:22,640 There are a few conversations where normal people troll IRS scammers. 16 00:01:22,700 --> 00:01:24,960 When these guys try to play around. 17 00:01:25,040 --> 00:01:26,960 I'm with normal people, but it's like super funny. 18 00:01:29,360 --> 00:01:30,720 My mother's maiden name. 19 00:01:32,340 --> 00:01:33,820 It's it's recon village. 20 00:01:36,320 --> 00:01:36,920 Good try. 21 00:01:37,640 --> 00:01:38,040 Okay. 22 00:01:38,800 --> 00:01:39,620 Hello, everyone. 23 00:01:39,680 --> 00:01:40,440 Thanks for coming. 24 00:01:40,500 --> 00:01:42,640 I know 1 p.m. is like lunchtime. 25 00:01:42,880 --> 00:01:45,640 So I'm really happy that you guys are skipping lunch for me. 26 00:01:45,720 --> 00:01:47,240 I feel like I feel the love there. 27 00:01:47,360 --> 00:01:49,080 So that's why I'm going to talk about recon village. 28 00:01:49,280 --> 00:01:49,680 Sorry. 29 00:01:50,240 --> 00:01:52,180 Recon and bug bond is what a great love story. 30 00:01:52,380 --> 00:01:54,760 If you would have already attended Jason Haddock's talk. 31 00:01:55,040 --> 00:01:59,880 Jason has pretty much covered most of the stuff that I wanted to cover. 32 00:02:00,080 --> 00:02:04,280 I have absolutely no idea why this is on my screen. 33 00:02:07,220 --> 00:02:07,660 Yes. 34 00:02:07,700 --> 00:02:07,920 Okay. 35 00:02:09,080 --> 00:02:09,520 Oops. 36 00:02:12,340 --> 00:02:13,680 So what was I talking? 37 00:02:13,820 --> 00:02:14,540 Jason Haddock's. 38 00:02:14,540 --> 00:02:21,120 Yeah, so he pretty much got most of the stuff, but I'm probably here to tell you if those things work or not. 39 00:02:21,360 --> 00:02:23,900 That's why I have named this talk saying Recon and bug bonding. 40 00:02:23,960 --> 00:02:24,860 What a great love story. 41 00:02:25,040 --> 00:02:31,340 Because I'm going to share a few of my stories where a few of the techniques that Jason Haddock's has told you guys that have worked for me. 42 00:02:31,440 --> 00:02:33,180 And they might actually work for you, too. 43 00:02:33,600 --> 00:02:36,320 About me, I'm from Sydney, Australia. 44 00:02:36,680 --> 00:02:39,100 I work in application security. 45 00:02:39,240 --> 00:02:42,480 I may be a script kitty working in a large organization, blah, blah, blah. 46 00:02:42,740 --> 00:02:46,600 Got lucky with finding bugs in Google, Facebook, Microsoft, eBay, et cetera. 47 00:02:47,920 --> 00:02:50,180 One among top five bug hunters on Synac. 48 00:02:50,260 --> 00:02:53,180 Synac is like these guys who have sponsored Recon Village. 49 00:02:55,040 --> 00:02:56,640 Yeah, I have another slide which I'll show you. 50 00:02:56,780 --> 00:02:56,980 But, yeah. 51 00:02:58,160 --> 00:03:00,980 So I do a lot of bug bounties with Synac. 52 00:03:01,100 --> 00:03:03,700 They have private slash crowdsourcing platforms. 53 00:03:04,080 --> 00:03:11,720 That's one reason you'll find a lot of redacted text on my screenshots because I cannot really reveal the name of the client slash organizations. 54 00:03:11,820 --> 00:03:13,260 I'm really sorry about that. 55 00:03:13,900 --> 00:03:14,760 This is the agenda. 56 00:03:14,920 --> 00:03:17,800 I'm sure you would have read the agenda before walking in. 57 00:03:17,900 --> 00:03:23,820 If you didn't, this talk is probably about a few techniques that have worked for me that might work for you. 58 00:03:23,900 --> 00:03:24,520 Again, I like it. 59 00:03:24,520 --> 00:03:30,860 I would love to use the word might throughout the presentation because things work sometimes and things don't work sometimes. 60 00:03:32,260 --> 00:03:34,480 Nobody is responsible for whatever I talk. 61 00:03:34,700 --> 00:03:38,460 If there's someone you have to blame, it's at the rate A, B, H, I, J, E, T, H. 62 00:03:38,580 --> 00:03:39,340 That's just me. 63 00:03:39,460 --> 00:03:40,820 You just have to blame me. 64 00:03:41,320 --> 00:03:42,440 Rants, suggestions, anything. 65 00:03:43,120 --> 00:03:44,680 You just have to tweet it to me. 66 00:03:45,560 --> 00:03:48,380 So just out of curiosity, how many of you do pen testing here? 67 00:03:50,040 --> 00:03:50,740 Good question. 68 00:03:50,820 --> 00:03:52,700 How many of you are devs here, like developers? 69 00:03:53,000 --> 00:03:54,300 Okay, dev slash DevOps. 70 00:03:55,040 --> 00:03:57,920 Devops slash infrastructure admin slash. 71 00:03:58,160 --> 00:03:58,520 Okay, cool. 72 00:03:58,700 --> 00:03:59,100 Great. 73 00:03:59,160 --> 00:04:00,700 I love the word DevOps, by the way. 74 00:04:00,740 --> 00:04:03,140 I don't want to rant about the word DevOps here, but yeah. 75 00:04:03,860 --> 00:04:07,660 This is how web application security is today, fortunately or unfortunately. 76 00:04:07,800 --> 00:04:15,580 Like when I was a kid in 2008, 2009, if I had to hack a web application, I would go to Google and type how to hack a web application. 77 00:04:15,820 --> 00:04:18,800 And probably one of the first few results would be SQL injection. 78 00:04:19,180 --> 00:04:24,040 And then there would be this random magic string which says single code 101 equal to one. 79 00:04:24,040 --> 00:04:28,740 And it would say, hey, just copy and paste this everywhere where you see a username and password. 80 00:04:29,020 --> 00:04:33,860 And there is a great probability that you might be able to do an authentication bypass. 81 00:04:34,140 --> 00:04:40,340 I see a few people nodding their heads, and I'm pretty sure a few people have started their pen testing career just like that, just like me. 82 00:04:40,940 --> 00:04:44,500 But today, if you do that, as we all understand, devs have become smarter. 83 00:04:44,640 --> 00:04:46,700 Frameworks and organizations have become smarter. 84 00:04:46,860 --> 00:04:52,380 So it's definitely not possible for us to do the same hacking that we used to do in the early 2000s. 85 00:04:54,580 --> 00:04:56,340 But shit is still vulnerable. 86 00:04:56,660 --> 00:05:06,960 Like people assume that, you know, they have stuff, they believe they have firewalls, they have network, they have honeypots and stuff like that. 87 00:05:07,040 --> 00:05:11,380 But there are a billion ways by which attackers could basically bypass them and still find vulnerabilities. 88 00:05:12,660 --> 00:05:17,220 If that's your beautiful castle, people always take care of their beautiful castle. 89 00:05:17,380 --> 00:05:19,380 That's like your website.com. 90 00:05:19,480 --> 00:05:24,020 So if you have an organization, I'm sure your www.website.com is super. 91 00:05:24,020 --> 00:05:29,940 Super secure, super safe, because you would have paid thousands of dollars to hire external pen testers to do pen testing. 92 00:05:30,340 --> 00:05:31,560 But, hey, you know what? 93 00:05:31,720 --> 00:05:33,760 Hackers are no longer interested on website.com. 94 00:05:33,880 --> 00:05:40,960 They're interested in, say, your subdomains, or they're interested in other stuff, say, api.website.com or dev.website.com, 95 00:05:41,060 --> 00:05:45,640 or your third-party applications, or your GitHub repos. 96 00:05:45,700 --> 00:05:47,400 I'll talk about GitHub repos. 97 00:05:47,440 --> 00:05:48,460 I love GitHub repos. 98 00:05:49,740 --> 00:05:50,660 But why? 99 00:05:51,040 --> 00:05:51,520 Why? 100 00:05:51,520 --> 00:05:52,180 Like I said before. 101 00:05:52,460 --> 00:05:54,000 Because it's no longer... 102 00:05:54,020 --> 00:05:54,880 It's no longer the same concept. 103 00:05:55,040 --> 00:05:59,080 You don't want to do single code of one equal to one, and then you would not get SQL injection. 104 00:05:59,460 --> 00:06:05,240 So even if you have a shield, it doesn't really matter, because people are just going to come up with new techniques. 105 00:06:05,500 --> 00:06:08,540 The best part about this GIF is the longer you watch, the funnier it is. 106 00:06:08,700 --> 00:06:09,860 That's the reason I have it. 107 00:06:12,760 --> 00:06:14,240 Yeah, so, okay, cool. 108 00:06:14,520 --> 00:06:15,260 Recon is great. 109 00:06:15,420 --> 00:06:16,300 But how do you do it? 110 00:06:17,300 --> 00:06:20,280 How many of you here know about reverse IP? 111 00:06:21,940 --> 00:06:22,680 A lot of you? 112 00:06:24,020 --> 00:06:25,640 Okay, you have to be very honest here. 113 00:06:25,820 --> 00:06:29,020 Do you actually do reverse IP in every pen test that you do? 114 00:06:31,520 --> 00:06:32,240 Yes and no. 115 00:06:32,320 --> 00:06:38,540 I see a few people saying no, because, to be honest, even I don't do, like, a few of this stuff in every pen test that I do. 116 00:06:38,820 --> 00:06:43,040 But if we actually did it, you could find a lot of stuff. 117 00:06:43,560 --> 00:06:49,600 I'm going to run through the slides first, and then I'm going to do the demos, because I'm running on someone's mobile internet. 118 00:06:49,720 --> 00:06:50,780 I don't want to, like... 119 00:06:50,780 --> 00:06:51,760 I hope it works. 120 00:06:52,000 --> 00:06:53,200 I'm sure it will be pretty slow. 121 00:06:53,200 --> 00:06:54,300 And this is another site. 122 00:06:54,400 --> 00:06:55,320 It's called DNS Dumpster. 123 00:06:56,340 --> 00:07:01,200 I guess throughout the talk, you would want to take photos of my slides or something. 124 00:07:01,480 --> 00:07:02,860 I'm going to post them online, too. 125 00:07:03,000 --> 00:07:13,860 But, in fact, I was just asking one of the organizers if we could not record this talk so that I could show some live shit, but, unfortunately, I can't. 126 00:07:13,940 --> 00:07:15,880 So, DNS Dumpster is a really cool site. 127 00:07:15,980 --> 00:07:17,260 Again, I love DNS Dumpster. 128 00:07:18,240 --> 00:07:20,680 Jason has talked about a few other tools, like Sublister. 129 00:07:21,320 --> 00:07:23,180 There's another tool called C++. 130 00:07:23,200 --> 00:07:23,700 There's Subbrood. 131 00:07:23,740 --> 00:07:25,460 Jason has also talked about Mascan. 132 00:07:25,640 --> 00:07:28,180 But DNS Dumpster is something that works for me. 133 00:07:28,460 --> 00:07:29,640 It's a pretty easy thing. 134 00:07:29,760 --> 00:07:33,820 All you have to do is go to DNS Dumpster and then give a yahoo.com. 135 00:07:34,040 --> 00:07:34,560 I love Yahoo. 136 00:07:34,860 --> 00:07:37,440 Yahoo is one of my favorite targets. 137 00:07:37,680 --> 00:07:38,500 Anyone here from Yahoo? 138 00:07:39,640 --> 00:07:40,080 No? 139 00:07:40,220 --> 00:07:40,620 Thank you. 140 00:07:41,120 --> 00:07:41,560 Okay. 141 00:07:42,980 --> 00:07:47,560 The moment you do that, you see that there are so many subdomains on yahoo.com. 142 00:07:47,700 --> 00:07:53,080 And if you would have observed carefully, there would have been some subdomains which say Scott. 143 00:07:53,200 --> 00:07:54,460 Corp.yahoo.com. 144 00:07:54,540 --> 00:07:56,240 Mail.corp.yahoo.com. 145 00:07:56,400 --> 00:08:00,960 Now, every time I see words like corp or stage or test, I'm like, that's my target. 146 00:08:01,260 --> 00:08:02,940 That's my dinner for today. 147 00:08:03,180 --> 00:08:08,020 Because the moment you see it, you know something is public that shouldn't have been public. 148 00:08:08,360 --> 00:08:13,540 So, there is a high likelihood that there might be another way to get into the application. 149 00:08:13,920 --> 00:08:22,400 Yes, they might have excellent LDAP protection and you might not be able to do an LDAP injection or a SQL injection. 150 00:08:22,560 --> 00:08:22,900 Fantastic. 151 00:08:23,200 --> 00:08:24,020 But who knows? 152 00:08:24,060 --> 00:08:31,720 Maybe you just run Der Buster and then you get access to some directory in which you get access to some other subdomain or some other API. 153 00:08:32,020 --> 00:08:35,800 And then you simply open the API and then you would basically see someone's credit card details. 154 00:08:37,080 --> 00:08:38,060 I've seen that sometimes. 155 00:08:38,220 --> 00:08:39,020 That's one reason. 156 00:08:39,180 --> 00:08:44,620 So, most of the things that I'll be talking in the next 15, 10, 15 minutes are based out of my own experiences. 157 00:08:45,300 --> 00:08:51,180 So, if I speak something, that must be something I must have found in the past. 158 00:08:52,240 --> 00:08:53,180 Again, this is centralized. 159 00:08:54,040 --> 00:08:56,120 There's another website called Shodan.io. 160 00:08:56,240 --> 00:09:00,400 At this point, I assume everyone should have known Shodan.io. 161 00:09:00,560 --> 00:09:05,140 If you don't, just open Shodan.io and then start searching for stuff. 162 00:09:05,360 --> 00:09:07,380 It's like really amazing. 163 00:09:07,780 --> 00:09:08,960 Census is really cool, too. 164 00:09:09,080 --> 00:09:11,000 I like Census because they keep updating. 165 00:09:11,860 --> 00:09:15,440 And then all you need to do is go to Census and then type for a domain name. 166 00:09:15,540 --> 00:09:16,140 Do I have a video? 167 00:09:16,240 --> 00:09:16,940 No, I don't have a video. 168 00:09:17,040 --> 00:09:17,600 It's just a screenshot. 169 00:09:17,820 --> 00:09:23,160 So, you just have to type for a domain name and then Census basically gives you a bunch of... 170 00:09:23,200 --> 00:09:25,320 So, does this work? 171 00:09:25,600 --> 00:09:26,140 I don't know. 172 00:09:26,260 --> 00:09:26,860 Let's check it out. 173 00:09:27,660 --> 00:09:30,420 I hope my demos are working. 174 00:09:31,040 --> 00:09:31,740 This is my Google. 175 00:09:32,340 --> 00:09:36,080 I am going to dnsdumpster.com. 176 00:09:39,400 --> 00:09:40,680 Just a heads up, guys. 177 00:09:40,760 --> 00:09:45,240 If you are giving corporate presentations, make sure you clear your browser history. 178 00:09:45,500 --> 00:09:51,360 Because the other day, I was giving a corporate presentation and I was opening something like P-O-R-T-A-L. 179 00:09:51,680 --> 00:09:53,080 I typed P-O... 180 00:09:53,200 --> 00:09:55,480 R and something else comes up in my history. 181 00:09:57,360 --> 00:10:02,300 Luckily, my colleague was like, hey, man, I know Pornhub has a bug bounty program. 182 00:10:02,620 --> 00:10:05,020 He's like, I'm sure you would have found some cross-site scripting. 183 00:10:05,080 --> 00:10:06,920 I'm like, no, I found a SQL injection on Pornhub. 184 00:10:07,040 --> 00:10:08,540 And then he was like, did you get some bounty? 185 00:10:08,640 --> 00:10:09,380 I'm like, no, I didn't. 186 00:10:09,560 --> 00:10:12,700 But, yeah, that was an awkward moment. 187 00:10:14,700 --> 00:10:15,560 Do you guys have... 188 00:10:15,560 --> 00:10:16,040 I'm sorry. 189 00:10:17,580 --> 00:10:17,900 Yeah. 190 00:10:18,260 --> 00:10:18,580 Yes. 191 00:10:18,720 --> 00:10:19,320 Yes, I did. 192 00:10:19,420 --> 00:10:19,920 Yes, I did. 193 00:10:21,000 --> 00:10:21,940 Any target, guys? 194 00:10:23,200 --> 00:10:23,940 Any organization? 195 00:10:24,460 --> 00:10:24,980 Just... 196 00:10:24,980 --> 00:10:26,380 Whatever you misspelled yesterday. 197 00:10:27,220 --> 00:10:28,180 Whatever what? 198 00:10:28,520 --> 00:10:29,500 You misspelled yesterday. 199 00:10:31,100 --> 00:10:32,360 Okay, let's do that. 200 00:10:32,780 --> 00:10:33,800 Why not put it? 201 00:10:34,500 --> 00:10:35,180 I'm sorry? 202 00:10:36,560 --> 00:10:38,640 Okay, I'm actually doing that. 203 00:10:38,780 --> 00:10:39,080 Cool. 204 00:10:41,920 --> 00:10:46,560 Yeah, so I'm just trying to search for... 205 00:10:46,560 --> 00:10:47,840 So Pornhub has a bug bounty program. 206 00:10:48,060 --> 00:10:50,260 If you don't do bug bounty programs, you should definitely do it. 207 00:10:50,320 --> 00:10:51,840 Go to hack1.com slash Pornhub. 208 00:10:52,560 --> 00:10:53,180 It's really... 209 00:10:53,200 --> 00:10:55,780 It's really hard to find bugs on Pornhub.com, 210 00:10:55,860 --> 00:10:57,220 but, yeah, you should totally do it. 211 00:10:57,920 --> 00:10:59,860 As you can see, it's basically... 212 00:11:00,320 --> 00:11:02,380 It's basically giving us a few subdomains. 213 00:11:02,440 --> 00:11:04,380 So at this point, you have a subdomain, 214 00:11:04,400 --> 00:11:06,620 and you also have an associated IP address. 215 00:11:06,960 --> 00:11:08,320 I don't know how many of you do it, 216 00:11:08,380 --> 00:11:10,460 but I love this technique where I'm like, 217 00:11:10,520 --> 00:11:11,620 I just captured this IP address. 218 00:11:12,240 --> 00:11:13,300 This is not a big organization, 219 00:11:13,380 --> 00:11:14,800 but if I'm testing Yahoo or Google, 220 00:11:14,960 --> 00:11:16,880 I know that there is a high likelihood 221 00:11:16,880 --> 00:11:19,940 that the entire subnet of 0 to 255 222 00:11:20,940 --> 00:11:22,860 might be owned by Yahoo or Google, 223 00:11:23,200 --> 00:11:26,140 so all I do is nmap space the IP address 224 00:11:26,140 --> 00:11:29,180 0 to 255, port 80 and 443, 225 00:11:29,300 --> 00:11:31,120 because I guess that's the only port 226 00:11:31,120 --> 00:11:32,680 that you're legally allowed to look at 227 00:11:32,680 --> 00:11:34,120 if you're scanning some other ports. 228 00:11:35,260 --> 00:11:36,460 Using your own Internet, 229 00:11:36,620 --> 00:11:39,020 using your own Internet if you're looking at some other ports, 230 00:11:39,120 --> 00:11:40,480 I don't think it's a great idea. 231 00:11:40,720 --> 00:11:43,780 So, yeah, you get some subdomains here 232 00:11:43,780 --> 00:11:44,980 because this is a very small site. 233 00:11:45,040 --> 00:11:46,400 You have very less subdomains, 234 00:11:46,480 --> 00:11:47,640 but as you have seen previously, 235 00:11:47,840 --> 00:11:49,360 if you search for Yahoo.com, 236 00:11:49,480 --> 00:11:50,500 there are a bunch of subdomains. 237 00:11:50,620 --> 00:11:53,040 At this point, all you would want to do is copy the IP, 238 00:11:53,200 --> 00:11:57,600 and then go to nmap and then do a subnet scan. 239 00:11:57,880 --> 00:12:00,280 I'm sure you'll see some juicy information there. 240 00:12:00,540 --> 00:12:02,500 There's another site that I love the most. 241 00:12:02,620 --> 00:12:03,600 It's called YouGetSignal. 242 00:12:03,680 --> 00:12:04,640 Anyone heard of it? 243 00:12:05,940 --> 00:12:08,140 Yeah, YouGetSignal is a really cool site, too. 244 00:12:11,360 --> 00:12:13,280 Any questions before this gets loaded? 245 00:12:15,280 --> 00:12:16,540 No questions. That's great. 246 00:12:17,740 --> 00:12:19,080 Reverse IP domain lookup. 247 00:12:19,280 --> 00:12:21,620 So I'm just going to click that. 248 00:12:21,620 --> 00:12:23,820 By the time this gets loaded, 249 00:12:23,980 --> 00:12:27,500 I'm sure you guys must have heard about VirusTotal, too. 250 00:12:29,100 --> 00:12:30,840 Did you ever think that VirusTotal 251 00:12:30,840 --> 00:12:33,340 can also give you with a list of subdomains? 252 00:12:34,420 --> 00:12:36,180 No? Okay, cool. I'm going to show you. 253 00:12:36,800 --> 00:12:37,780 Thanks for saying no. 254 00:12:38,560 --> 00:12:40,060 Just going to search for Uber.com. 255 00:12:40,760 --> 00:12:42,960 This is just a simple reverse IP domain check. 256 00:12:43,520 --> 00:12:44,580 I do it sometimes. 257 00:12:45,140 --> 00:12:46,720 I just capture the IP address 258 00:12:46,720 --> 00:12:49,240 because this also shows me a few other subdomains 259 00:12:49,240 --> 00:12:51,600 which are hosted on the same IP. 260 00:12:51,620 --> 00:12:51,960 This is the IP address. 261 00:12:52,600 --> 00:12:54,520 VirusTotal, there is an option which says search. 262 00:12:54,740 --> 00:12:57,860 So you can just say Twilio.com. 263 00:12:59,480 --> 00:13:01,640 So most of the demos I'm showing you, 264 00:13:01,680 --> 00:13:02,820 they have a bug bounty program. 265 00:13:03,220 --> 00:13:06,000 So I'm just trying to make sure that I'm legally safe. 266 00:13:06,460 --> 00:13:07,940 I'm not going to get into trouble, 267 00:13:08,100 --> 00:13:09,480 but because they have bug bounty programs, 268 00:13:09,700 --> 00:13:12,820 and I'm sure I'm not finding any vulnerabilities live, 269 00:13:13,000 --> 00:13:14,680 so I think that should be okay. 270 00:13:15,220 --> 00:13:17,940 Twilio.com, it says observed subdomains. 271 00:13:18,000 --> 00:13:19,000 You can just click on more, 272 00:13:19,120 --> 00:13:21,420 and you can see there are a bunch of subdomains. 273 00:13:21,620 --> 00:13:25,020 I mean, there is no way a person like you, 274 00:13:25,080 --> 00:13:26,240 a human like me, 275 00:13:26,320 --> 00:13:28,220 could guess a subdomain like this. 276 00:13:29,960 --> 00:13:33,080 It's like A, C, D, whatever. 277 00:13:34,180 --> 00:13:35,180 You know what I mean? 278 00:13:35,260 --> 00:13:39,500 So it's really hard for humans to guess such subdomains, 279 00:13:39,580 --> 00:13:42,080 and that's where you would use websites like this 280 00:13:42,080 --> 00:13:43,000 or scripts like this. 281 00:13:43,080 --> 00:13:44,260 And because most of these websites 282 00:13:44,260 --> 00:13:47,100 are updated on a day-to-day basis, 283 00:13:47,140 --> 00:13:48,940 if not day-to-day basis, regularly, 284 00:13:49,240 --> 00:13:51,480 I personally love to rely, 285 00:13:51,620 --> 00:13:51,920 rely on them. 286 00:13:53,020 --> 00:13:55,540 Those are some very basic techniques. 287 00:13:55,700 --> 00:13:57,880 I would call them Vrecon 101 techniques, 288 00:13:58,060 --> 00:13:59,320 and if you are doing a pen test, 289 00:13:59,460 --> 00:14:02,260 I would definitely recommend you to start with this. 290 00:14:02,940 --> 00:14:03,880 Does this work? 291 00:14:04,060 --> 00:14:04,920 The answer is yes. 292 00:14:05,120 --> 00:14:08,160 This is PHP, my admins, 293 00:14:09,220 --> 00:14:14,280 of a large community contribution organization. 294 00:14:14,900 --> 00:14:17,140 Like, if you want to have a forums page 295 00:14:17,140 --> 00:14:18,480 for your own organization, 296 00:14:18,820 --> 00:14:20,900 this would be one of the top three vendors 297 00:14:20,900 --> 00:14:21,600 that you would go to. 298 00:14:21,600 --> 00:14:22,720 I don't want to talk about the vendor, 299 00:14:22,900 --> 00:14:24,580 but then, yeah, I was just doing this, 300 00:14:24,760 --> 00:14:27,280 and on virus total, I got a subdomain, 301 00:14:27,340 --> 00:14:29,120 I did a reverse IP, found an IP address, 302 00:14:29,360 --> 00:14:31,760 I opened the IP address, and this is the default page, 303 00:14:31,800 --> 00:14:35,000 and I don't think I have to explain anything more, 304 00:14:35,060 --> 00:14:36,520 and the screenshot is self-explanatory. 305 00:14:36,900 --> 00:14:39,820 And I reported this one, 306 00:14:39,880 --> 00:14:43,840 and they basically fixed it in, like, 24 to 48 hours, 307 00:14:44,000 --> 00:14:45,860 because Synac is, like, really quick 308 00:14:45,860 --> 00:14:46,760 in triaging vulnerabilities. 309 00:14:47,200 --> 00:14:49,260 They triaged the vulnerability in, like, eight hours. 310 00:14:49,340 --> 00:14:50,340 I got paid in eight hours, 311 00:14:50,420 --> 00:14:51,500 and they sent it to the client, 312 00:14:51,600 --> 00:14:53,680 and the client basically fixed it in 24 to 48 hours, 313 00:14:53,780 --> 00:14:54,900 and this was his reply. 314 00:14:55,560 --> 00:14:56,480 I was like, thanks. 315 00:14:56,940 --> 00:14:58,720 The database used for testing, 316 00:14:58,900 --> 00:15:01,260 that was the database used for testing, 317 00:15:01,340 --> 00:15:03,320 and it was terminated the instance, 318 00:15:03,480 --> 00:15:06,200 which means it was a test server 319 00:15:06,200 --> 00:15:08,140 that they were using for something else, 320 00:15:08,240 --> 00:15:09,920 and it was made public by mistake. 321 00:15:10,320 --> 00:15:13,240 So stuff like this is fortunately 322 00:15:13,240 --> 00:15:14,800 or unfortunately on the Internet, 323 00:15:14,980 --> 00:15:16,960 and if you have a large organization, 324 00:15:17,300 --> 00:15:21,160 I would definitely recommend you to ask your red team, 325 00:15:21,600 --> 00:15:23,120 or you, yourself, do a perimeter scan. 326 00:15:24,620 --> 00:15:27,180 Yeah, because sometimes you would be surprised 327 00:15:27,180 --> 00:15:29,300 to see the stuff that is online 328 00:15:29,300 --> 00:15:31,740 for your organization on the Internet. 329 00:15:31,900 --> 00:15:34,600 Like, I used to work with this company, 330 00:15:34,720 --> 00:15:36,460 and then I did a subdomain scan, 331 00:15:36,660 --> 00:15:38,900 and then I went to my DevOps engineer, 332 00:15:39,100 --> 00:15:39,820 and I told him, hey, man, 333 00:15:39,860 --> 00:15:41,120 do you know where the subdomain is? 334 00:15:41,180 --> 00:15:45,960 And he's like, no, I never knew that this existed, 335 00:15:46,180 --> 00:15:47,860 and it was a Jenkins dashboard, 336 00:15:48,160 --> 00:15:50,320 so you know what Jenkins does, right? 337 00:15:50,420 --> 00:15:51,580 And it had no authentication. 338 00:15:51,580 --> 00:15:53,100 And it was lying on the Internet. 339 00:15:53,260 --> 00:15:54,780 That was one of the first things I did 340 00:15:55,420 --> 00:15:57,420 in that organization in the first one week, 341 00:15:57,500 --> 00:15:58,360 so I got a good bonus. 342 00:15:58,460 --> 00:15:59,220 That's a different story. 343 00:15:59,540 --> 00:16:01,240 Yeah, and this thing works well, too. 344 00:16:01,360 --> 00:16:03,140 Like, oh, shit. 345 00:16:03,520 --> 00:16:05,460 There should be another screenshot on this slide. 346 00:16:05,580 --> 00:16:09,380 Okay, I found several JBoss EJB invokers 347 00:16:09,380 --> 00:16:11,380 of remote code executions on Yahoo. 348 00:16:11,680 --> 00:16:12,600 They pay well, too. 349 00:16:12,700 --> 00:16:13,560 I got, like, $2,000. 350 00:16:13,760 --> 00:16:14,540 I should have got more, 351 00:16:14,660 --> 00:16:18,000 but I've got few, few, few, few such vulnerabilities. 352 00:16:19,880 --> 00:16:21,120 Again, this is something 353 00:16:21,120 --> 00:16:22,820 Jason has talked about, eyewitness. 354 00:16:23,040 --> 00:16:24,280 If you don't know about eyewitness, 355 00:16:24,380 --> 00:16:25,620 I would definitely recommend you 356 00:16:25,620 --> 00:16:26,920 to go and play around with it. 357 00:16:27,680 --> 00:16:29,240 If you have a bunch of subdomains, 358 00:16:29,360 --> 00:16:31,400 you just send it to eyewitness and ask it to scan, 359 00:16:31,540 --> 00:16:33,100 and it's going to do something like this. 360 00:16:33,140 --> 00:16:34,960 This is a screenshot of another tool called Snapple. 361 00:16:35,120 --> 00:16:37,460 So what these tools basically do is 362 00:16:37,460 --> 00:16:40,260 they hit the URL, try to capture a screenshot 363 00:16:40,260 --> 00:16:42,740 from the index.html page or welcome page, 364 00:16:42,860 --> 00:16:43,820 and they just show you. 365 00:16:43,940 --> 00:16:45,120 If I have something like this, 366 00:16:45,180 --> 00:16:46,480 the first thing I would try to do is 367 00:16:46,920 --> 00:16:48,140 if there's a login screen 368 00:16:48,140 --> 00:16:50,800 or if there's something which says it works, 369 00:16:51,480 --> 00:16:53,020 you know what it works means. 370 00:16:53,140 --> 00:16:55,520 If it works, then it should work for you, too. 371 00:16:55,840 --> 00:16:59,720 And if I see something like IIS 6 and not IIS 8, 372 00:16:59,800 --> 00:17:01,420 I'm like, yeah, sure, I'll take that. 373 00:17:01,520 --> 00:17:02,600 I would love to play around with that. 374 00:17:02,940 --> 00:17:05,640 So, and things like this, 375 00:17:06,880 --> 00:17:09,600 I don't find them when I do normal pen testing, 376 00:17:09,760 --> 00:17:12,540 but then when I'm just about to go to sleep 377 00:17:12,540 --> 00:17:14,420 and I'm like, I just run a scan, 378 00:17:14,660 --> 00:17:17,300 I find this thing, and I basically spoil my sleep. 379 00:17:19,000 --> 00:17:19,740 I'm sure everybody, 380 00:17:19,740 --> 00:17:23,000 everyone here knows how to use Google and Google Docs. 381 00:17:23,020 --> 00:17:24,640 I really don't want to talk about it, 382 00:17:24,760 --> 00:17:27,260 but I just want to show you a small, 383 00:17:27,500 --> 00:17:29,180 very small thingy here. 384 00:17:30,560 --> 00:17:31,900 This is where it is. 385 00:17:32,120 --> 00:17:34,080 So if you go to google.com, 386 00:17:35,540 --> 00:17:37,460 oh, here's google.com, 387 00:17:37,540 --> 00:17:39,660 and say site colon yahoo.com, 388 00:17:39,800 --> 00:17:40,880 that's absolutely fine. 389 00:17:41,040 --> 00:17:42,340 So when you do that, 390 00:17:42,380 --> 00:17:44,880 it's going to basically give you all the websites 391 00:17:44,880 --> 00:17:46,920 which have their domain name yahoo.com. 392 00:17:47,000 --> 00:17:48,020 No rocket science in this, 393 00:17:48,100 --> 00:17:49,560 but one really, 394 00:17:49,740 --> 00:17:50,960 really cool feature about google.com 395 00:17:50,960 --> 00:17:51,920 is this advanced search. 396 00:17:52,100 --> 00:17:52,900 There's something called tools, 397 00:17:53,060 --> 00:17:56,500 and you can have a date range here, 398 00:17:57,000 --> 00:17:59,080 and for organizations like yahoo.com, 399 00:17:59,280 --> 00:18:01,420 which have been started in early 19, 400 00:18:01,800 --> 00:18:03,300 sorry, sorry, early 1990s, 401 00:18:04,040 --> 00:18:04,700 if I'm not wrong. 402 00:18:05,760 --> 00:18:11,040 Just modify the dates to 1991 to 2000, 403 00:18:13,620 --> 00:18:15,300 and just click on go, 404 00:18:15,840 --> 00:18:17,900 and basically what Google is trying to do 405 00:18:17,900 --> 00:18:19,080 is it's trying to give you 406 00:18:19,080 --> 00:18:21,120 all the list of URLs which were live 407 00:18:21,120 --> 00:18:22,860 in between 1991 and 2000, 408 00:18:23,180 --> 00:18:25,400 and I guess this is self-explanatory for you. 409 00:18:25,700 --> 00:18:28,740 Few of these pages must be even running basic HTML 410 00:18:28,740 --> 00:18:30,640 and then older versions of JavaScript. 411 00:18:31,320 --> 00:18:33,840 This is a huge playground for you now. 412 00:18:33,960 --> 00:18:35,980 All you need to do is go there 413 00:18:35,980 --> 00:18:37,980 and then start looking at what the different 414 00:18:37,980 --> 00:18:39,600 JavaScript versions, and then play around, 415 00:18:39,820 --> 00:18:41,100 and then that's it. 416 00:18:41,620 --> 00:18:42,520 It's self-explanatory. 417 00:18:42,720 --> 00:18:45,220 And I also used to use this technique for bug bounties, 418 00:18:45,280 --> 00:18:48,220 like I used to say in URLs, bug space bounty. 419 00:18:49,180 --> 00:18:50,340 There are a few organizations 420 00:18:50,340 --> 00:18:52,180 who still don't have a bug bounty program 421 00:18:52,180 --> 00:18:55,060 on Buckrod or HackerOne or Synac. 422 00:18:55,200 --> 00:18:56,520 They have their own websites. 423 00:18:56,860 --> 00:18:57,740 So when you do that, 424 00:18:57,820 --> 00:18:59,480 if I try to search for something like this, 425 00:18:59,580 --> 00:19:01,220 instead of having a date range 426 00:19:01,220 --> 00:19:03,040 which says from 1991 to 2000, 427 00:19:03,320 --> 00:19:05,320 I'll have a date range of last one month 428 00:19:05,320 --> 00:19:06,420 or last one week, 429 00:19:06,540 --> 00:19:08,080 which keeps me updated about 430 00:19:08,080 --> 00:19:10,160 all the latest bug bounty programs 431 00:19:10,160 --> 00:19:11,220 which come on the internet, 432 00:19:11,360 --> 00:19:13,160 which means you are one of the first people 433 00:19:13,160 --> 00:19:14,160 who are looking at the target, 434 00:19:14,220 --> 00:19:16,480 which just means you have a better probability 435 00:19:16,480 --> 00:19:17,380 of finding vulnerabilities. 436 00:19:20,100 --> 00:19:21,960 I see that I just have three more minutes. 437 00:19:22,020 --> 00:19:22,940 I'm going to quickly run. 438 00:19:23,300 --> 00:19:26,780 So, again, Google Docs. 439 00:19:26,800 --> 00:19:27,780 Everyone knows about it. 440 00:19:28,160 --> 00:19:29,440 If you don't know, 441 00:19:29,500 --> 00:19:31,080 you should definitely go and check this out. 442 00:19:31,140 --> 00:19:31,600 It's fun. 443 00:19:31,820 --> 00:19:33,660 And this is, again, with Yahoo. 444 00:19:34,160 --> 00:19:36,260 I was using some Google Docs. 445 00:19:36,420 --> 00:19:39,220 I just put FMS underscore admin console. 446 00:19:39,500 --> 00:19:43,420 This is an Adobe Flash media administration console. 447 00:19:44,420 --> 00:19:47,120 Adobe basically decided that they will stop you, 448 00:19:47,220 --> 00:19:48,660 they'll stop supporting Flash 449 00:19:48,660 --> 00:19:49,060 after 20 years. 450 00:19:49,080 --> 00:19:50,040 2020, if I'm not wrong. 451 00:19:50,160 --> 00:19:51,300 That's what I read the other day. 452 00:19:51,760 --> 00:19:54,860 So, again, this was an administration console 453 00:19:54,860 --> 00:19:55,780 I got access to. 454 00:19:56,060 --> 00:19:58,460 No access controls, no passwords, nothing. 455 00:19:58,560 --> 00:20:02,320 Just subdomain.yahoo.com 456 00:20:02,320 --> 00:20:04,120 slash FMS admin console, and that's it. 457 00:20:04,280 --> 00:20:05,620 And I actually found this on Google, 458 00:20:05,760 --> 00:20:06,940 literally using Google, 459 00:20:07,000 --> 00:20:09,180 so I'm like, free money, thank you. 460 00:20:09,440 --> 00:20:11,240 I mean, if you're walking on the street, 461 00:20:11,960 --> 00:20:13,640 and if you just... 462 00:20:13,640 --> 00:20:14,940 I don't want to give that example. 463 00:20:15,060 --> 00:20:15,320 That's okay. 464 00:20:15,420 --> 00:20:16,440 Do you use GitHub? 465 00:20:17,040 --> 00:20:18,160 I'm sure most of you do. 466 00:20:18,480 --> 00:20:18,840 Okay. 467 00:20:18,840 --> 00:20:19,940 This is a question for you all. 468 00:20:20,540 --> 00:20:23,260 Has anyone of you ever made 469 00:20:23,260 --> 00:20:25,500 one of your private reports public 470 00:20:26,020 --> 00:20:27,980 for two minutes and then made it private? 471 00:20:30,500 --> 00:20:32,100 That's a bunch of smart people there. 472 00:20:32,200 --> 00:20:32,540 Thank you. 473 00:20:32,560 --> 00:20:33,920 Thanks for raising hand with me 474 00:20:33,920 --> 00:20:35,260 because I've done it once. 475 00:20:35,760 --> 00:20:36,960 Now, as we all understand, 476 00:20:37,200 --> 00:20:39,400 there are a lot of scrapers on the internet, 477 00:20:39,540 --> 00:20:42,080 so even if your private repo is public 478 00:20:42,080 --> 00:20:44,460 even for like two or three minutes, 479 00:20:45,120 --> 00:20:45,880 it's already gone. 480 00:20:46,020 --> 00:20:46,600 I'm really sorry. 481 00:20:47,260 --> 00:20:48,740 And if you have... 482 00:20:48,840 --> 00:20:50,380 If your devs are using GitHub, 483 00:20:51,120 --> 00:20:52,540 please give them some training 484 00:20:52,540 --> 00:20:53,680 and then please tell them 485 00:20:53,680 --> 00:20:55,660 not to have private keys on GitHub. 486 00:20:55,880 --> 00:20:57,320 Please tell them not to have 487 00:20:57,320 --> 00:20:58,820 usernames and passwords on GitHub 488 00:20:58,820 --> 00:21:01,320 because, I don't know, unfortunately, 489 00:21:01,360 --> 00:21:03,100 it's a sad story to see 490 00:21:03,100 --> 00:21:05,240 usernames and passwords on GitHub. 491 00:21:05,380 --> 00:21:07,360 I mean, I know a few of you 492 00:21:07,360 --> 00:21:08,360 would be thinking I'm bullshitting. 493 00:21:08,480 --> 00:21:08,960 I'm not. 494 00:21:09,140 --> 00:21:10,780 So this is a vulnerability I've submitted 495 00:21:10,780 --> 00:21:13,000 with one of the largest organizations. 496 00:21:13,180 --> 00:21:14,100 You know what it is. 497 00:21:15,280 --> 00:21:16,540 This was a year ago, 498 00:21:16,600 --> 00:21:17,560 so that's still all right. 499 00:21:17,560 --> 00:21:20,440 Where there was this random user 500 00:21:20,440 --> 00:21:23,180 who had this at-the-rate-salesforce.com 501 00:21:23,180 --> 00:21:24,100 username and password 502 00:21:24,100 --> 00:21:26,480 on one of their Git repos, 503 00:21:26,480 --> 00:21:26,920 and I was like, 504 00:21:28,000 --> 00:21:30,120 thanks for giving me your username and password, man. 505 00:21:30,200 --> 00:21:31,160 I really appreciate it. 506 00:21:31,400 --> 00:21:32,720 I just reported it to them. 507 00:21:33,440 --> 00:21:34,240 They said... 508 00:21:34,240 --> 00:21:36,940 At first, they said it's the employee's problem. 509 00:21:37,060 --> 00:21:38,860 They don't want to really pay bounty for it, 510 00:21:38,940 --> 00:21:41,020 but then they agreed to pay bounty, 511 00:21:41,060 --> 00:21:41,440 and I'm like, 512 00:21:41,560 --> 00:21:43,520 do you really think it's the employee's problem, 513 00:21:43,680 --> 00:21:44,860 or do you think the organization 514 00:21:44,860 --> 00:21:45,940 has to train employees? 515 00:21:46,600 --> 00:21:47,280 I don't know. 516 00:21:47,560 --> 00:21:48,900 Man, Microsoft SDLC, 517 00:21:48,940 --> 00:21:49,800 we all have to do that. 518 00:21:50,980 --> 00:21:51,460 Yeah. 519 00:21:51,620 --> 00:21:52,540 This is another tool. 520 00:21:52,640 --> 00:21:53,580 It's called Link Finder. 521 00:21:53,680 --> 00:21:55,720 I'm going to quickly run through Link Finder 522 00:21:55,720 --> 00:21:56,720 in about 30 seconds. 523 00:21:56,880 --> 00:21:58,100 What it basically does is 524 00:21:58,100 --> 00:22:01,160 you give an input of a JavaScript file, 525 00:22:01,860 --> 00:22:04,700 and it's going to basically run a scan on a JS file, 526 00:22:04,820 --> 00:22:06,660 and it's going to basically spit out 527 00:22:06,660 --> 00:22:09,820 all the URLs which are inside a JS file. 528 00:22:10,260 --> 00:22:10,980 If you... 529 00:22:11,620 --> 00:22:12,960 I know most of... 530 00:22:13,340 --> 00:22:14,460 Like, when I started pen testing, 531 00:22:14,660 --> 00:22:17,300 I was ignoring all .js and .css files, 532 00:22:17,560 --> 00:22:18,260 but trust me, 533 00:22:18,280 --> 00:22:19,800 never ignore .js files. 534 00:22:19,900 --> 00:22:21,100 You might find some juicy links. 535 00:22:21,380 --> 00:22:23,100 Like, I'll just give you a simple example. 536 00:22:23,260 --> 00:22:23,840 This was... 537 00:22:23,840 --> 00:22:27,600 This is a very large organization. 538 00:22:28,000 --> 00:22:29,380 A few of you might recognize it. 539 00:22:29,440 --> 00:22:30,280 If you don't recognize it, 540 00:22:30,340 --> 00:22:30,920 I'm really happy. 541 00:22:31,820 --> 00:22:32,980 Just right-clicked it. 542 00:22:33,080 --> 00:22:34,580 I tried to view the page source. 543 00:22:34,780 --> 00:22:37,340 It gave me access to a subdomain. 544 00:22:37,600 --> 00:22:38,360 I was like, 545 00:22:38,880 --> 00:22:39,240 I've... 546 00:22:40,060 --> 00:22:40,640 Heads up. 547 00:22:40,680 --> 00:22:41,800 I've not found this subdomain 548 00:22:41,800 --> 00:22:43,760 using any of the sublister tools 549 00:22:43,760 --> 00:22:44,940 or subdomain scanning tools. 550 00:22:45,020 --> 00:22:45,320 I was like, 551 00:22:45,360 --> 00:22:47,400 I might as well check out what's in here. 552 00:22:47,560 --> 00:22:48,860 And I just check out. 553 00:22:48,920 --> 00:22:49,760 I start playing around, 554 00:22:49,960 --> 00:22:51,020 and then there you go. 555 00:22:51,140 --> 00:22:52,000 It's self-explanatory. 556 00:22:52,160 --> 00:22:52,680 I did, like, 557 00:22:53,000 --> 00:22:53,400 cat space, 558 00:22:53,540 --> 00:22:55,480 etc space password, 559 00:22:55,680 --> 00:22:56,180 and I was like, 560 00:22:56,620 --> 00:22:57,560 OS command injection. 561 00:22:57,840 --> 00:22:58,420 Thank you. 562 00:22:58,460 --> 00:22:59,380 That's free money there. 563 00:22:59,740 --> 00:23:00,020 So... 564 00:23:00,880 --> 00:23:01,280 So... 565 00:23:01,280 --> 00:23:03,640 How much time did it take for me to do it? 566 00:23:03,720 --> 00:23:04,980 I guess less than an hour. 567 00:23:05,160 --> 00:23:06,520 I wouldn't say five or ten minutes, 568 00:23:06,580 --> 00:23:07,000 but, yeah, 569 00:23:07,020 --> 00:23:09,400 it took about 30, 40 minutes for me to find it. 570 00:23:09,480 --> 00:23:12,540 But it's worth more than $2,000, 571 00:23:12,760 --> 00:23:13,220 so I'm like, 572 00:23:13,340 --> 00:23:13,920 yeah, sure, 573 00:23:13,980 --> 00:23:15,840 I don't mind $2,000 for 30, 40 minutes. 574 00:23:16,520 --> 00:23:16,920 So... 575 00:23:16,920 --> 00:23:17,160 So... 576 00:23:19,100 --> 00:23:19,980 For this, 577 00:23:20,140 --> 00:23:20,780 link finder. 578 00:23:20,820 --> 00:23:21,080 So... 579 00:23:21,740 --> 00:23:22,560 So it's... 580 00:23:22,560 --> 00:23:23,040 It's on... 581 00:23:24,120 --> 00:23:24,980 It's on GitHub. 582 00:23:25,160 --> 00:23:27,060 I do have a quick demo for this. 583 00:23:27,200 --> 00:23:28,420 So you just download it. 584 00:23:29,240 --> 00:23:30,480 There should be simple English. 585 00:23:30,940 --> 00:23:31,640 Python space, 586 00:23:31,820 --> 00:23:32,980 link finder dot py space, 587 00:23:33,200 --> 00:23:33,480 i space. 588 00:23:33,700 --> 00:23:35,380 I'm just running it on demo dot test file 589 00:23:35,380 --> 00:23:36,860 because it's easy for me. 590 00:23:37,200 --> 00:23:38,760 I'm just gonna click it, 591 00:23:38,800 --> 00:23:39,600 click on enter. 592 00:23:40,220 --> 00:23:43,380 It'll generally not take SSL error. 593 00:23:43,480 --> 00:23:44,760 Oh, that's because of the phone, I guess. 594 00:23:46,040 --> 00:23:46,620 I'm sorry? 595 00:23:46,800 --> 00:23:47,220 Sorry? 596 00:23:47,560 --> 00:23:47,740 That's smaller. 597 00:23:49,800 --> 00:23:50,580 You think... 598 00:23:50,580 --> 00:23:51,520 I'm sorry, I didn't get that. 599 00:23:53,340 --> 00:23:53,780 Yep. 600 00:23:54,080 --> 00:23:54,900 Yeah, so... 601 00:23:54,900 --> 00:23:55,820 I'm sorry? 602 00:23:56,260 --> 00:23:57,620 We can't see it in the back. 603 00:23:57,800 --> 00:23:58,200 Oh, okay. 604 00:23:59,200 --> 00:24:00,960 He said you should increase it to size three. 605 00:24:01,080 --> 00:24:01,540 Yeah, that's it. 606 00:24:02,140 --> 00:24:02,980 Oh, there you go. 607 00:24:03,100 --> 00:24:04,880 Yeah, there's an SSL error anyways. 608 00:24:05,220 --> 00:24:06,220 So that's like... 609 00:24:06,220 --> 00:24:06,520 Shit. 610 00:24:06,820 --> 00:24:07,260 Okay. 611 00:24:07,640 --> 00:24:10,200 So you should try out link finder. 612 00:24:10,260 --> 00:24:12,140 I guess there are a couple of other tools 613 00:24:12,960 --> 00:24:16,560 by dudes called Nahamsek and Zedciano. 614 00:24:17,180 --> 00:24:17,340 Zedciano? 615 00:24:17,960 --> 00:24:18,700 That's Sean. 616 00:24:18,840 --> 00:24:19,500 That's his name. 617 00:24:19,560 --> 00:24:21,440 They're a few top bug bounty researchers. 618 00:24:21,740 --> 00:24:25,320 So I forgot to change the title, but yeah. 619 00:24:26,300 --> 00:24:27,960 Play around with JS files. 620 00:24:28,140 --> 00:24:29,040 Try to find some links. 621 00:24:29,220 --> 00:24:30,420 You would find some juicy information. 622 00:24:30,640 --> 00:24:31,440 Start playing around. 623 00:24:31,680 --> 00:24:33,460 I'm sure you'll find some critical ones. 624 00:24:33,580 --> 00:24:36,800 So the whole point of doing this kind of recon 625 00:24:36,800 --> 00:24:39,520 is you no longer find SQL injection 626 00:24:39,520 --> 00:24:41,440 and command injection on login pages 627 00:24:41,440 --> 00:24:43,580 and then domain web applications. 628 00:24:43,820 --> 00:24:46,160 That's why you would try to find other places 629 00:24:46,160 --> 00:24:47,380 where you can find candies. 630 00:24:47,560 --> 00:24:47,800 And cookies. 631 00:24:48,060 --> 00:24:50,040 So you just try to find those places, 632 00:24:50,240 --> 00:24:50,840 go to the store, 633 00:24:50,920 --> 00:24:52,160 and then get your free candies. 634 00:24:53,300 --> 00:24:54,380 So moral of the story, 635 00:24:55,020 --> 00:24:56,020 recon is really cool. 636 00:24:56,500 --> 00:24:57,700 If you are doing pen testing, 637 00:24:57,820 --> 00:24:58,860 if you are doing red teaming, 638 00:24:58,880 --> 00:25:00,560 you should definitely do recon. 639 00:25:00,960 --> 00:25:02,220 If you are a red team engineer 640 00:25:02,220 --> 00:25:05,720 and if you have not heard of a few of the things 641 00:25:05,720 --> 00:25:07,500 that I've talked or Jason had access to, 642 00:25:07,640 --> 00:25:08,880 then you should probably go back, 643 00:25:08,960 --> 00:25:10,880 quickly do a Google search, 644 00:25:11,040 --> 00:25:12,440 and then try to play around with those tools 645 00:25:12,440 --> 00:25:14,200 and run it against your own organization. 646 00:25:14,500 --> 00:25:16,880 Again, run it against your own organization first 647 00:25:16,880 --> 00:25:18,480 before doing it on bug bounties 648 00:25:18,480 --> 00:25:22,460 because you don't want to get hacked 649 00:25:22,460 --> 00:25:24,440 and you don't want to get name shamed, right? 650 00:25:26,300 --> 00:25:29,240 There is one final thing that I want to demo. 651 00:25:29,440 --> 00:25:31,600 This is another cool tool by Nahum Sec. 652 00:25:32,120 --> 00:25:33,140 Let me zoom it. 653 00:25:36,420 --> 00:25:38,960 It's called Hostile Sub Brute Forcer. 654 00:25:39,120 --> 00:25:41,420 So there's this attack called Subdomain Takeover, 655 00:25:41,500 --> 00:25:42,420 if you have heard of it. 656 00:25:42,600 --> 00:25:44,140 So this tool is really cool. 657 00:25:44,340 --> 00:25:46,460 It not only gives you a list of subdomains, 658 00:25:46,460 --> 00:25:50,460 but it also checks if you could do a subdomain takeover. 659 00:25:50,620 --> 00:25:53,200 And I really love using Nahum Sec's tool 660 00:25:53,200 --> 00:25:54,760 because if I use this tool, 661 00:25:54,900 --> 00:25:57,860 it's just helping me with the subdomains, 662 00:25:57,860 --> 00:25:58,860 it's giving me the IP addresses, 663 00:25:59,120 --> 00:26:00,840 and it also gives me the response codes. 664 00:26:01,060 --> 00:26:02,520 So if there is a 301, 665 00:26:02,580 --> 00:26:03,960 I generally don't like to check it 666 00:26:03,960 --> 00:26:06,460 because obviously I think they are redirecting the subdomain 667 00:26:06,460 --> 00:26:07,420 to the original domain. 668 00:26:07,620 --> 00:26:09,720 But if it's a 200, that's when I like to play around. 669 00:26:10,680 --> 00:26:14,100 And if the tool says there might be a subdomain takeover, 670 00:26:14,200 --> 00:26:16,300 that's when I go back and see if there's a... 671 00:26:16,460 --> 00:26:17,220 subdomain takeover. 672 00:26:17,440 --> 00:26:19,260 And then, to be very honest, 673 00:26:19,440 --> 00:26:21,520 I've only found one subdomain takeover 674 00:26:21,520 --> 00:26:22,980 in the last one or two years, 675 00:26:23,120 --> 00:26:24,180 which is really sad. 676 00:26:24,480 --> 00:26:26,860 I think I should probably work on it more, 677 00:26:26,960 --> 00:26:28,920 but hey, maybe that's not my skill. 678 00:26:29,000 --> 00:26:30,780 So these are a few cool people 679 00:26:30,780 --> 00:26:31,760 that you would want to follow 680 00:26:31,760 --> 00:26:35,520 if you're interested in Recon. 681 00:26:35,720 --> 00:26:38,520 Like, most of them have pretty cool tools. 682 00:26:39,160 --> 00:26:41,220 Most of them do a lot of research in Recon. 683 00:26:41,400 --> 00:26:42,980 Yeah, and me. 684 00:26:43,080 --> 00:26:44,720 You also want to follow me, but yeah. 685 00:26:45,800 --> 00:26:46,200 Credits. 686 00:26:46,460 --> 00:26:49,100 I've not used a lot of memes and GIFs, but... 687 00:26:49,100 --> 00:26:49,900 Could you go back? 688 00:26:50,080 --> 00:26:50,480 Yes. 689 00:26:51,540 --> 00:26:52,440 Last page, this one? 690 00:26:53,060 --> 00:26:54,720 With the names, okay. 691 00:26:55,920 --> 00:26:57,180 Ten seconds to take a photograph. 692 00:26:57,480 --> 00:26:58,860 Nine, eight, seven. 693 00:27:01,060 --> 00:27:02,820 Okay, six, five. 694 00:27:03,000 --> 00:27:03,700 That's an iPhone. 695 00:27:06,040 --> 00:27:06,440 Oops. 696 00:27:10,160 --> 00:27:10,560 Credits. 697 00:27:11,180 --> 00:27:12,360 Thanks to all the authors. 698 00:27:12,560 --> 00:27:14,200 Again, I didn't write these tools. 699 00:27:14,280 --> 00:27:14,740 I have a tool. 700 00:27:14,820 --> 00:27:15,520 It's called Fazzapi. 701 00:27:15,620 --> 00:27:16,420 I basically... 702 00:27:16,460 --> 00:27:17,420 He presented it in the morning 703 00:27:17,420 --> 00:27:18,640 and at Black Hat Arsenal, 704 00:27:18,680 --> 00:27:19,860 so I don't want to talk about it 705 00:27:19,860 --> 00:27:21,500 because I've talked enough about it, 706 00:27:21,600 --> 00:27:24,520 but thanks to these guys for writing these tools. 707 00:27:24,740 --> 00:27:25,940 If you have some other ideas 708 00:27:25,940 --> 00:27:27,620 with respect to automation and Recon, 709 00:27:27,740 --> 00:27:28,780 you should definitely do it. 710 00:27:28,860 --> 00:27:30,360 If you do it, please open source it 711 00:27:30,360 --> 00:27:31,760 because sharing is caring, right? 712 00:27:31,920 --> 00:27:34,200 So thanks to these guys 713 00:27:34,200 --> 00:27:35,620 for making internet secure again. 714 00:27:35,900 --> 00:27:36,580 Like, yay. 715 00:27:37,020 --> 00:27:38,000 I work with Synac. 716 00:27:38,120 --> 00:27:39,920 You should definitely check out these guys 717 00:27:39,920 --> 00:27:40,880 and then... 718 00:27:40,880 --> 00:27:42,500 I don't work with Synac. 719 00:27:42,580 --> 00:27:43,700 I do bug parties with Synac. 720 00:27:43,820 --> 00:27:44,840 Sorry, just to be clear. 721 00:27:44,960 --> 00:27:45,360 No. 722 00:27:45,820 --> 00:27:46,220 No. 723 00:27:46,440 --> 00:27:46,800 If you do bug parties, 724 00:27:47,360 --> 00:27:48,380 if you don't do bug parties, 725 00:27:48,500 --> 00:27:50,720 it's probably the right time for you to get in 726 00:27:50,720 --> 00:27:52,580 because you can learn a lot at the end of the day. 727 00:27:52,640 --> 00:27:53,320 Forget about bounty. 728 00:27:53,460 --> 00:27:54,580 You can definitely learn a lot 729 00:27:54,580 --> 00:27:57,260 and I would definitely recommend you guys to do it. 730 00:27:57,340 --> 00:27:58,740 If you guys don't have a bug party program, 731 00:27:58,900 --> 00:28:00,000 if you want to start a bug party program, 732 00:28:00,220 --> 00:28:00,700 I think you should. 733 00:28:00,940 --> 00:28:02,000 It'll help people like me. 734 00:28:03,380 --> 00:28:04,680 Yeah, thanks for listening to me. 735 00:28:05,420 --> 00:28:06,040 Any questions? 736 00:28:07,380 --> 00:28:07,880 Yes, hi. 737 00:28:08,860 --> 00:28:11,540 We got a question about, you know, 738 00:28:11,540 --> 00:28:12,980 how you can actually, let's say, 739 00:28:13,020 --> 00:28:14,200 find the word, let's say, 740 00:28:14,200 --> 00:28:16,280 if the domain is behind the cloud, 741 00:28:16,960 --> 00:28:17,360 yes. 742 00:28:19,100 --> 00:28:20,620 So, unfortunately, I'm not... 743 00:28:23,020 --> 00:28:24,360 Yeah, his question is 744 00:28:24,360 --> 00:28:27,160 how to attack stuff that's behind Cloudflare. 745 00:28:27,900 --> 00:28:30,980 Unfortunately, I'm not an expert in that area. 746 00:28:31,160 --> 00:28:32,120 I can give you an answer, 747 00:28:32,240 --> 00:28:34,260 but my answer would not be the best answer, 748 00:28:34,360 --> 00:28:36,520 so I don't want to direct you in the wrong direction. 749 00:28:36,760 --> 00:28:37,360 So, I'm a nice guy. 750 00:28:39,740 --> 00:28:40,140 Yeah. 751 00:28:40,980 --> 00:28:41,380 Yeah. 752 00:28:41,480 --> 00:28:44,620 So, there is this guy called Pete Peter. 753 00:28:44,940 --> 00:28:46,340 So, if you just go to YouTube, 754 00:28:46,440 --> 00:28:49,100 and type Peter S3 Buckets. 755 00:28:49,360 --> 00:28:51,840 So, he talks about how to take over S3 Buckets, 756 00:28:51,840 --> 00:28:53,780 and he talks a bit about Cloudflare, too. 757 00:28:53,980 --> 00:28:56,200 So, if I were you, I would probably go there 758 00:28:56,200 --> 00:28:57,220 and then look at his talk, 759 00:28:57,320 --> 00:29:00,820 instead of taking a point from someone like me 760 00:29:00,820 --> 00:29:01,560 who is not an expert. 761 00:29:02,700 --> 00:29:03,060 Yeah. 762 00:29:04,440 --> 00:29:05,120 Any other questions? 763 00:29:06,420 --> 00:29:06,960 Thank you. 764 00:29:06,980 --> 00:29:07,880 You'll find me around. 765 00:29:08,020 --> 00:29:09,540 If you have any questions, feel free to ask me. 766 00:29:09,700 --> 00:29:10,160 Thank you.