1 00:00:00,000 --> 00:00:04,240 Jason Haddix and this is domain discovery expanding your scope 2 00:00:04,240 --> 00:00:07,020 like a boss. So we did some strike through here because it's 3 00:00:07,020 --> 00:00:09,880 not just domain discovery. I added a little bit of web 4 00:00:09,880 --> 00:00:14,460 discovery here. This talk is primarily focused around my 5 00:00:14,460 --> 00:00:17,240 discovery methodology. I by no means think I have the best 6 00:00:17,240 --> 00:00:21,440 discovery methodology but I think it gets me a lot of sites 7 00:00:21,440 --> 00:00:25,220 to hunt and bug bounties and pen tests when I'm going after a 8 00:00:25,220 --> 00:00:28,760 certain entity or business or something like that. So that's 9 00:00:28,760 --> 00:00:32,360 my twitter if you wanna yell at me twitter. I work for bug crowd 10 00:00:32,360 --> 00:00:35,220 who does bug bounties so we manage enterprise bug bounties. 11 00:00:36,720 --> 00:00:41,720 On the global leader board of 600 thousand register testers on 12 00:00:41,720 --> 00:00:45,280 59th currently on bug crowd. And I play a lot of video games. 13 00:00:45,360 --> 00:00:48,300 That's me and my son. And we're both wearing matching dinosaur 14 00:00:48,300 --> 00:00:54,500 shirts if you can see that. Okay so this is my methodology in 15 00:00:54,500 --> 00:00:57,500 a nut shell. If you guys might have seen this a couple weeks 16 00:00:57,500 --> 00:00:58,740 ago. I did release a. 17 00:00:58,740 --> 00:01:01,860 version of this but I've added more since I did that version. 18 00:01:02,060 --> 00:01:06,840 So my version of a methodology to do discovery for hacking 19 00:01:06,840 --> 00:01:09,560 websites, this isn't an OSINT talk where I'm going to go into 20 00:01:09,560 --> 00:01:12,620 hacking people and individual information. This is a 21 00:01:12,620 --> 00:01:16,120 methodology to find more web assets for me to go after in a 22 00:01:16,120 --> 00:01:20,120 bug bounty or pen test. Usually when you find undiscovered 23 00:01:20,750 --> 00:01:24,060 assets, web assets, they are less secured than the main 24 00:01:24,060 --> 00:01:29,400 domain. So in bug bounty world that means that they will be 25 00:01:29,400 --> 00:01:32,240 less secured and I can find better, more critical bounties 26 00:01:32,240 --> 00:01:37,340 on these sites. So we start with identifying our targets, their 27 00:01:37,340 --> 00:01:41,660 main TLDs. We move on to domain scraping for those discovered 28 00:01:41,660 --> 00:01:46,740 TLDs. We go into domain brute forcing. Then we go into 29 00:01:46,740 --> 00:01:49,920 permutation scanning and port scanning. We do some visual 30 00:01:49,920 --> 00:01:54,040 identification. We do some auxiliary stuff. And then we 31 00:01:54,060 --> 00:01:57,040 go into the sites that we have now discovered and we start 32 00:01:57,040 --> 00:02:00,640 doing platform identification, content discovery and parameter 33 00:02:00,640 --> 00:02:04,740 discovery. So this is kind of how it works. All right. So the 34 00:02:04,740 --> 00:02:07,100 first thing you do when you start trying to find or 35 00:02:07,100 --> 00:02:11,840 discover, you know, assets or IPs or anything associated to a 36 00:02:11,840 --> 00:02:15,800 domain, and it's hard to see this, but you actually have to 37 00:02:15,800 --> 00:02:19,420 look up their ASN, right? The autonomous system number for a 38 00:02:19,420 --> 00:02:22,180 company, right? So this is their kind of registered IP space. 39 00:02:23,400 --> 00:02:24,040 They're all assigned to a specific domain. They're all 40 00:02:24,060 --> 00:02:28,260 assigned an ASN number. Here I've looked up Tesla. So Tesla has a 41 00:02:28,260 --> 00:02:32,880 couple different blocks here. So the site to use this, the site to 42 00:02:32,880 --> 00:02:35,460 do this that I use to do this is Hurricane Electric. It's one of 43 00:02:35,460 --> 00:02:39,700 the only free sites that will let you pull down the large set 44 00:02:39,700 --> 00:02:42,280 of ASN data. Some of them will let you pull it down, but only 45 00:02:42,280 --> 00:02:46,140 will limit you at like 500 requests or 500 lines of the 46 00:02:46,140 --> 00:02:50,460 output. So here I can see that Tesla Motors has a registered 47 00:02:50,460 --> 00:02:54,040 net block of 209.133.79.0. So that's where we're going to 48 00:02:54,040 --> 00:02:58,180 go slash 24. So this will be one way I start gathering or 49 00:02:58,680 --> 00:03:02,200 basically searching for their IP space so I can start looking for 50 00:03:02,200 --> 00:03:06,100 assets. This is just one out of all. Usually when I start, 51 00:03:06,180 --> 00:03:08,420 though, I'm starting from a bug bounty. So I already have a 52 00:03:08,420 --> 00:03:11,340 couple targets to start with, usually their main domain. So for 53 00:03:11,340 --> 00:03:13,820 Tesla, we're using them as an example because they have an open 54 00:03:13,820 --> 00:03:16,020 bug bounty and it's pretty permissive. They say anything 55 00:03:16,540 --> 00:03:20,120 that we own is in scope of the bug bounty, including the cars 56 00:03:20,120 --> 00:03:23,380 and the web assets and stuff like that. So I would already probably 57 00:03:23,380 --> 00:03:26,680 have tesla.com or teslamotors.com in scope and then I 58 00:03:26,680 --> 00:03:31,720 would look up their ASN. So then you want to do reverse who 59 00:03:31,720 --> 00:03:34,720 is. So manually you can use these two sites. There's also 60 00:03:34,720 --> 00:03:37,280 some tools that automate this. So one of the frameworks I'm 61 00:03:37,280 --> 00:03:39,460 going to use a lot, I'm going to rely a lot on in some of the 62 00:03:39,460 --> 00:03:42,860 next slides is called Recon NG and they have a module for 63 00:03:42,860 --> 00:03:46,940 reverse who is. But if you want to do it manually, these are the 64 00:03:46,940 --> 00:03:50,500 two, again, the two sites that you want to use because they 65 00:03:50,500 --> 00:03:53,360 don't cap you at the amount of stuff that they pull back. So if 66 00:03:53,380 --> 00:03:54,820 you want to do it manually, again, all these sites that do 67 00:03:54,820 --> 00:03:59,460 this online kind of reverse DNS information or give you 68 00:03:59,460 --> 00:04:01,880 information about domains and stuff like that, they want to 69 00:04:01,880 --> 00:04:04,320 charge you at some point for some of this info. And as a pen 70 00:04:04,320 --> 00:04:08,460 tester, I'm not going to pay, you know, $70 every lookup I 71 00:04:08,460 --> 00:04:11,800 need to do. So reverse DNS or reverse who is, excuse me, will 72 00:04:11,800 --> 00:04:17,640 find some more scope targets for this type of stuff. The last one 73 00:04:17,640 --> 00:04:22,980 in this area is acquisitions. So this is actually the end all be 74 00:04:22,980 --> 00:04:23,360 all site for the end all be all site for the end all be all site 75 00:04:23,380 --> 00:04:26,500 for acquisitions. Crunch base marks all this stuff when a 76 00:04:26,500 --> 00:04:30,220 company acquires a new company. They mark it all in their 77 00:04:30,220 --> 00:04:33,560 acquisitions table. So you can just go up to the URL at crunch 78 00:04:33,560 --> 00:04:36,580 base. It's crunch base.com, organization, then your 79 00:04:36,580 --> 00:04:40,320 organization name. And you can see here I have a list or a 80 00:04:40,320 --> 00:04:43,720 history of everything that Tesla has acquired in the last ten 81 00:04:43,720 --> 00:04:47,420 years. So depending on if your pen test is really open scope or 82 00:04:47,420 --> 00:04:50,960 your bug bounty is really open scope, these domains are now top 83 00:04:50,960 --> 00:04:52,980 level domains that I have to put back into the beginning of my 84 00:04:52,980 --> 00:04:56,980 discovery. So Grumman Engineering, Solar City, Riviera 85 00:04:56,980 --> 00:05:00,560 Tool. I'm sure if I was doing this, I would also want to check 86 00:05:00,560 --> 00:05:03,320 out SpaceX just because I know that they're related to Tesla. 87 00:05:04,400 --> 00:05:08,220 So you also want to add these top level domains to your 88 00:05:08,220 --> 00:05:11,680 testing. This should be automated. Like, some of these 89 00:05:11,680 --> 00:05:14,200 sites should be automated, but these sites really want you to 90 00:05:14,200 --> 00:05:18,120 pay for this data. So they're all protected by different bot 91 00:05:18,120 --> 00:05:20,940 protection tools. So this one's protected by Distill, which is 92 00:05:20,940 --> 00:05:22,960 actually pretty good. Using a web browser, you can actually get a 93 00:05:22,980 --> 00:05:25,320 web scraper. Doesn't work like all the normal web scraping 94 00:05:25,320 --> 00:05:27,840 libraries that you would because otherwise I would automate this 95 00:05:27,840 --> 00:05:32,180 as part of, like, a tool or something like that. Okay. So 96 00:05:32,180 --> 00:05:36,320 that is gathering from, like, OSINT sites. What I want to do 97 00:05:36,320 --> 00:05:39,480 now in this section of the methodology is move on to 98 00:05:40,360 --> 00:05:43,020 finding subdomains. So I found a whole bunch of top level 99 00:05:43,020 --> 00:05:47,380 domains. I found IP addresses that they've used. Now what I 100 00:05:47,380 --> 00:05:50,020 want to do is find probably subdomains. And there's a 101 00:05:50,020 --> 00:05:52,920 couple different ways to do this, but they involve scraping. 102 00:05:52,980 --> 00:05:56,700 Scraping more of these open source sites. So what do we do in 103 00:05:56,700 --> 00:06:00,380 this case? Well, basically, when you're doing subdomain scraping 104 00:06:00,380 --> 00:06:03,040 and you're trying to find more subdomains of a top level 105 00:06:03,040 --> 00:06:06,340 target, a TLD, you want to scrape search engines, right? So 106 00:06:06,340 --> 00:06:10,020 the idea here is you would go to Google.com and search site 107 00:06:10,020 --> 00:06:12,680 colon Tesla.com. And you would get a whole bunch of results that 108 00:06:12,680 --> 00:06:17,260 come back. And that says Tesla.com, right? And then also a 109 00:06:17,260 --> 00:06:21,700 search result that comes back is admin.Tesla.com, forum.Tesla.com. 110 00:06:21,900 --> 00:06:22,960 And iteratively, you would get a whole bunch of results that come 111 00:06:22,980 --> 00:06:24,440 back. And iteratively, you make more Google searches, removing 112 00:06:24,440 --> 00:06:27,780 those ones that you found from the list until you have no more 113 00:06:27,780 --> 00:06:31,180 results and you have a full cache of everything Google's ever seen 114 00:06:31,180 --> 00:06:35,100 for Tesla.com, all the subdomains. So that's manually 115 00:06:35,100 --> 00:06:38,380 is kind of a hard process. So you use tooling to do this. The 116 00:06:38,380 --> 00:06:43,160 other place that you can look for subdomain data is inside of 117 00:06:43,160 --> 00:06:46,560 certificate transparency projects. So cert.sh, Google 118 00:06:46,560 --> 00:06:50,540 Certificate Transparency Project, and their OpenSSL subject 119 00:06:50,540 --> 00:06:51,900 alternative name space. 120 00:06:51,900 --> 00:06:55,720 Now, these are kind of individual talks. You can go 121 00:06:55,720 --> 00:06:58,400 into, like, scraping subdomains out of certificates, or you can 122 00:06:58,400 --> 00:07:01,160 go into search engine scraping. I think there's already been a 123 00:07:01,160 --> 00:07:02,800 couple talks on this. So we're just going to go into the 124 00:07:02,800 --> 00:07:06,580 automation of these and what I use to make this quick. So 125 00:07:06,580 --> 00:07:09,640 there's two tools for doing all this subdomain scraping and 126 00:07:09,640 --> 00:07:14,340 finding targets. One is Recon NG, which I have created a 127 00:07:14,340 --> 00:07:16,800 script around called Enum All that wraps around it. It's a 128 00:07:16,800 --> 00:07:19,400 Python wrapper. And there's another one called Sublister. 129 00:07:20,280 --> 00:07:21,880 And they're both really good. They both have a lot of 130 00:07:21,880 --> 00:07:23,360 resources. They both do the same thing. These are the sources 131 00:07:23,360 --> 00:07:26,200 they pull from. It's kind of hard to see. But on the right, 132 00:07:26,260 --> 00:07:29,760 Sublister does or in the middle, they both do Google. They both 133 00:07:29,760 --> 00:07:32,140 scrape Google, like I just described. They do the same 134 00:07:32,140 --> 00:07:36,000 thing on Bing. They look in the cert.sh project, which is the 135 00:07:36,000 --> 00:07:40,340 SSL certificates directory. They look on the Threat Crowd API and 136 00:07:40,340 --> 00:07:43,600 the Netcraft API. Now, individually, they also do some 137 00:07:43,600 --> 00:07:47,420 different sources. Sublister handles Baidu, Ask, DNS Dumpster, 138 00:07:47,520 --> 00:07:51,640 which is the scans.io project, VirusTotal, and PT Archive. In 139 00:07:51,640 --> 00:07:54,460 some way or another, these sites all have a website that's 140 00:07:54,460 --> 00:07:57,100 aggregating domain information somehow. And these tools will 141 00:07:57,100 --> 00:07:59,400 scrape that out of there for your target. So they will find 142 00:07:59,400 --> 00:08:04,180 Tesla subdomains for me. Recon NG individually will do SSL 143 00:08:04,180 --> 00:08:08,200 Tools API, Hacker Target API, and Shodan, which is a pretty 144 00:08:08,200 --> 00:08:10,660 popular one. And then they have a whole bunch of optional modules 145 00:08:10,660 --> 00:08:16,240 that you can bake into Recon NG. So disparate tools, but the two 146 00:08:16,240 --> 00:08:19,300 best tools. So if I want to scrape all of these, I really 147 00:08:19,300 --> 00:08:20,140 want to have to use both. 148 00:08:21,640 --> 00:08:26,000 So this is a tool called Sublister. And so this is the one 149 00:08:26,000 --> 00:08:28,200 I showed you, Shublister. And so this is a run on the right. It's 150 00:08:28,200 --> 00:08:33,480 hard to see. But basically, I've set it to go after Tesla.com. It 151 00:08:33,480 --> 00:08:36,880 runs. It searches Baidu, Yahoo, Google Bing, Netcraft, DNS 152 00:08:36,880 --> 00:08:40,120 Dumpster, VirusTotal, Threat Cloud, SSL certificates, and 153 00:08:40,520 --> 00:08:43,860 passes DNS.com. And then it just gives me an output of all of the 154 00:08:43,860 --> 00:08:46,460 domains. And you can kind of see them. You can see Tesla.com, 155 00:08:46,560 --> 00:08:51,620 Auth.Tesla.com, Autodiscover, Dev.Tesla.com, Fortis.com. And 156 00:08:51,640 --> 00:08:55,940 forums.Tesla.com, et cetera. So I've significantly expanded my 157 00:08:55,940 --> 00:08:58,560 scope now from just Tesla.com to go after. 158 00:09:00,720 --> 00:09:04,540 So the other tool was enumall that I wrote. And I don't really 159 00:09:04,540 --> 00:09:07,880 feel like running them all independently. I want some form 160 00:09:07,880 --> 00:09:10,840 of automation around this. So this is a project called Brute 161 00:09:10,840 --> 00:09:14,880 Subs, which basically can take any Recon tool written in any 162 00:09:14,880 --> 00:09:18,540 language if you make a Docker file for it and spin it up and 163 00:09:18,540 --> 00:09:21,020 run it and give you the output from such tools. 164 00:09:21,640 --> 00:09:24,980 So Brute Subs specifically takes my tool, enumall, and 165 00:09:24,980 --> 00:09:27,440 sublister, and a couple other tools we're talking about, and 166 00:09:27,440 --> 00:09:30,340 we'll run them. There's some configuration required. You have 167 00:09:30,340 --> 00:09:33,640 to set up the Docker image with some of the modules that aren't 168 00:09:33,640 --> 00:09:37,080 included by default, make a custom environment file. But once 169 00:09:37,080 --> 00:09:41,160 you do that, all you do is Docker up, and it will run all of 170 00:09:41,160 --> 00:09:44,200 this domain scraping for you and just give you an output text 171 00:09:44,200 --> 00:09:47,080 file from three or four different tools that we're going 172 00:09:47,080 --> 00:09:51,620 to talk about in the next couple seconds. So this is the 173 00:09:51,640 --> 00:09:55,180 run on the left. You can see it does a little bit of everything. 174 00:09:55,320 --> 00:09:58,300 It does the scraping. One of the tools is actually a brute 175 00:09:58,300 --> 00:10:00,120 forcer. We're not going to use it because we're going to use 176 00:10:00,120 --> 00:10:03,360 something else for brute forcing. All right. Some other 177 00:10:04,640 --> 00:10:07,980 subdomain finding tools that are scraping data, the one that I 178 00:10:07,980 --> 00:10:12,080 find really cool here is Cloudflare. So Cloudflare, 179 00:10:12,160 --> 00:10:15,360 basically, when you log into the Cloudflare site and you go to add 180 00:10:15,360 --> 00:10:18,640 Cloudflare to a domain, you know, potentially that you own, 181 00:10:19,920 --> 00:10:21,620 you type in here, Disney.com, and it's going to give you a 182 00:10:21,640 --> 00:10:24,680 link to Disney.com, right? And it will tell you if that's 183 00:10:24,680 --> 00:10:27,960 already used, basically, if Cloudflare is already running on 184 00:10:27,960 --> 00:10:31,380 that domain. So this isn't my screenshot, by the way. This is 185 00:10:31,380 --> 00:10:37,200 a tool author screenshot. So by iteratively putting in names into 186 00:10:37,200 --> 00:10:40,900 that search field on Cloudflare once you're logged in, you can 187 00:10:40,900 --> 00:10:44,220 verify or not verify that they have a subdomain in existence 188 00:10:44,220 --> 00:10:47,460 with Cloudflare. Cloudflare runs on 15% of the Internet right 189 00:10:47,460 --> 00:10:51,620 now. So you can get a massive amount of, basically, data that 190 00:10:51,640 --> 00:10:54,420 basically OSINT information from this kind of API or web portal 191 00:10:54,420 --> 00:10:58,800 that they have. So here, it's run against Disney. You can see 192 00:10:58,800 --> 00:11:02,280 that it's returned some success querying the DNS archives of 193 00:11:02,280 --> 00:11:06,060 Cloudflare. There's another one that's individually test 194 00:11:06,060 --> 00:11:11,680 census.io, and that's another project for aggregation of web 195 00:11:11,680 --> 00:11:14,660 data. So these are bespoke tools that don't really fit into 196 00:11:14,660 --> 00:11:19,640 anything, but I really like this Cloudflare one. Okay. So we 197 00:11:19,640 --> 00:11:21,620 scraped a whole bunch of stuff off the Internet, searched a lot 198 00:11:21,640 --> 00:11:24,740 of search engines, a whole bunch of open source sites. Now we 199 00:11:24,740 --> 00:11:28,920 have to move on to basically guessing at our target, right? So 200 00:11:28,920 --> 00:11:33,220 I might have some search engine results, but now I want to do 201 00:11:33,220 --> 00:11:38,060 this idea of brute forcing the subdomain. So the classic 202 00:11:38,060 --> 00:11:43,360 example of this is that you have tesla.com, and then you try to 203 00:11:43,360 --> 00:11:46,940 resolve admin.tesla.com. And if it resolves and you go somewhere, 204 00:11:47,160 --> 00:11:49,420 then that site exists. If it doesn't resolve, it doesn't 205 00:11:49,420 --> 00:11:51,620 exist. And you iterate over this in a tool. And then you try to 206 00:11:51,640 --> 00:11:54,480 solve it. Now, over the years of pen testing, we've done 207 00:11:54,480 --> 00:11:56,680 multiple tools that have come out for this. Fierce was probably 208 00:11:56,680 --> 00:12:00,620 the first and best one. New school ones are like SubBrute, 209 00:12:00,800 --> 00:12:04,760 Black Sheep Wall, DNS Parallel Brute Forcer. Now, the problem 210 00:12:04,760 --> 00:12:07,720 with these is that they take a long time with the big list that 211 00:12:07,720 --> 00:12:11,760 you're trying to brute force, right? And different projects 212 00:12:11,760 --> 00:12:13,420 have come out with different lists as well, and some of those 213 00:12:13,420 --> 00:12:17,640 lists are really long. Like this one is a million lines long. And 214 00:12:17,640 --> 00:12:21,120 to do that normally, or at least in my experience, took a lot of 215 00:12:21,120 --> 00:12:21,200 time and effort to do that. So I'm going to go ahead and show you 216 00:12:21,200 --> 00:12:21,300 this. So I'm going to go ahead and show you this. So I'm going to 217 00:12:21,300 --> 00:12:21,620 go ahead and show you this. So I'm going to go ahead and show you 218 00:12:21,620 --> 00:12:21,780 a few more. Now we have past results. You can see that it 219 00:12:21,780 --> 00:12:25,120 took days to weeks to run through a brute force of that 220 00:12:25,120 --> 00:12:28,740 kind of stuff. Now, this is actually some research that I 221 00:12:28,740 --> 00:12:31,260 did. I basically benchmarked all these tools. So you can see 222 00:12:31,260 --> 00:12:34,960 that the two best ones here are two tools called GoBuster and 223 00:12:34,960 --> 00:12:37,720 Mast DNS. GoBuster is written in Go, obviously. It does 224 00:12:37,720 --> 00:12:41,560 subdomain brute forcing. With this list, this one million line 225 00:12:42,220 --> 00:12:45,940 subdomain brute forcing list it completed that whole thing in 21 226 00:12:45,940 --> 00:12:50,580 minutes. Mast DNS finished it in a minute, 24 seconds. Now, the 227 00:12:50,580 --> 00:12:51,600 reason Mast DNS is subdomain brute forcing is, well, m σ is U, 228 00:12:51,600 --> 00:12:55,300 fast is because it's written in C and instead of using just your 229 00:12:55,300 --> 00:12:59,460 DNS infrastructure that you're connected to, it has a list of 230 00:12:59,460 --> 00:13:02,800 DNS servers that it cycles through in parallel to resolve 231 00:13:02,800 --> 00:13:05,660 the sites. It gives you more false positives but it runs 232 00:13:05,660 --> 00:13:10,240 very, very quickly. So these are the two tools that I integrate 233 00:13:10,240 --> 00:13:14,340 into my methodology to do DNS brute forcing or subdomain brute 234 00:13:14,340 --> 00:13:21,260 forcing. Yeah? Yeah. So I'm going to go back to the 235 00:13:25,880 --> 00:13:29,820 No. No. Well, SubBrute obviously 236 00:13:29,820 --> 00:13:33,640 aired out. But DNS Parallel Prober and Black Sheep Wall 237 00:13:33,640 --> 00:13:38,000 returned 61 and 43 respectively but they were all included in 238 00:13:38,000 --> 00:13:44,780 the data sets of GoBuster and MassDNS. Yeah. Okay. So that 239 00:13:44,780 --> 00:13:48,160 file that I said was a million lines that you're doing for 240 00:13:48,680 --> 00:13:51,580 subdomain brute forcing, that is a file that I'm going to 241 00:13:51,580 --> 00:13:54,240 make. It's a file that is made out of basically every file that 242 00:13:54,240 --> 00:13:58,700 I could find that has ever done this type of work, subdomain 243 00:13:58,700 --> 00:14:02,700 brute forcing. So the fierce list is in here, DNS scan, the deep 244 00:14:02,700 --> 00:14:06,900 magic top 500 prefixes for subdomains. There was some 245 00:14:06,900 --> 00:14:10,140 research earlier this year by a guy named BitQuark who did 246 00:14:10,880 --> 00:14:14,220 scraping on the web of the top million most popular subdomains. 247 00:14:14,500 --> 00:14:16,760 Remember, we're brute forcing just names to see if they 248 00:14:16,760 --> 00:14:20,200 resolve. So we want to have a good list to brute force from. So 249 00:14:20,200 --> 00:14:21,560 this is everything that's ever existed. A lot of the stuff that 250 00:14:21,580 --> 00:14:26,500 I could find. So it's all catted into one file for you to use at 251 00:14:26,500 --> 00:14:29,880 that gist. You can just grab it. And the idea here is because 252 00:14:29,880 --> 00:14:36,080 MassDNS is so fast that why not just use a huge list? It 253 00:14:36,080 --> 00:14:38,680 doesn't matter, right? It gives us better coverage. So MassDNS 254 00:14:38,680 --> 00:14:45,380 can complete this in a minute 30. So the yeah, there's even 255 00:14:45,380 --> 00:14:47,720 some extra stuff in here that were not subdomain lists. So 256 00:14:47,720 --> 00:14:51,560 like the raft list. And these were the subdomain lists that 257 00:14:51,560 --> 00:14:55,580 were URL brute forcing. So using words to find URL paths. And I 258 00:14:55,580 --> 00:14:59,260 found that to be sometimes useful in fuzzing subdomains as 259 00:14:59,260 --> 00:15:02,560 well or brooding subdomains. So those are incorporated into this 260 00:15:02,560 --> 00:15:06,060 list as well. Daniel's project, robots disallowed, I ported to 261 00:15:06,060 --> 00:15:13,060 a DNS structure to be in here as well. Okay. So I've done a ton 262 00:15:13,060 --> 00:15:15,420 of brute forcing and I've found some stuff that resolves. I've 263 00:15:15,420 --> 00:15:17,760 scraped a whole bunch of stuff off the internet and I've found a 264 00:15:17,760 --> 00:15:19,840 whole bunch of stuff that might exist because it was off search 265 00:15:19,840 --> 00:15:21,000 engines or in all these. 266 00:15:21,560 --> 00:15:26,300 Open source caches. Now what else do I do? Well, a quick part 267 00:15:26,300 --> 00:15:28,900 of the methodology is trying to find permutations on the stuff 268 00:15:28,900 --> 00:15:33,540 that I've found already. So the idea is that, you know, I may 269 00:15:33,540 --> 00:15:36,160 have brute force for admin.Tesla.com, but a lot of 270 00:15:36,160 --> 00:15:40,560 people use subdomain nomenclature that's like ACS.admin.Tesla.com, 271 00:15:40,700 --> 00:15:44,180 right? So what AltDNS does is it takes keywords that it's seen 272 00:15:44,180 --> 00:15:49,140 before, permutations, and throws them into your results of 273 00:15:49,140 --> 00:15:51,540 other tools. So you take the results of other tools. You 274 00:15:51,560 --> 00:15:56,660 go ahead and run it against the domain and it will add these 275 00:15:56,660 --> 00:16:00,280 permutations all over and then find additional subdomains 276 00:16:00,280 --> 00:16:02,980 against stuff that you've already found because they use 277 00:16:02,980 --> 00:16:05,760 these naming, these weird naming structures in a lot of 278 00:16:05,760 --> 00:16:11,900 places. The other one, this is kind of interesting. I've only 279 00:16:11,900 --> 00:16:14,840 used this once in success, but I really like the idea behind this 280 00:16:14,840 --> 00:16:20,940 is it's called SDBF. It's called Smart DNS Brute Forcer. The 281 00:16:21,560 --> 00:16:24,420 idea here is to use Markov chains and some statistics and an 282 00:16:24,420 --> 00:16:28,880 Ngram model to basically generate these permutations of 283 00:16:28,880 --> 00:16:32,440 domains. I actually don't know what all that means. I've just 284 00:16:32,440 --> 00:16:38,540 used this tool and it's kind of cool. So, yeah, so the white 285 00:16:38,540 --> 00:16:41,200 paper, this was an academic research project. He's published 286 00:16:41,200 --> 00:16:45,200 the code for this. I'd say the variance between this and AltDNS 287 00:16:45,200 --> 00:16:48,760 is actually very low, maybe like 10% more, I found, with this 288 00:16:48,760 --> 00:16:51,540 than AltDNS, but I've only run it a couple times on a couple 289 00:16:51,560 --> 00:16:56,980 of projects. But I like the idea and it has fancy names. Yes, 290 00:16:57,140 --> 00:17:03,220 with 100% coverage so far, yeah. Okay. So, okay, so I've done 291 00:17:06,340 --> 00:17:10,600 acquisitions. I've done their ASN. I've done subdomain 292 00:17:10,600 --> 00:17:13,860 scraping from all kinds of public resources. I've done 293 00:17:13,860 --> 00:17:17,860 permutation scanning to find bespoke, like, weirdly named 294 00:17:17,860 --> 00:17:21,480 subdomains. Now I need to move on to doing some sort of actual 295 00:17:21,560 --> 00:17:23,840 port scanning, right? So I have a whole bunch of targets, right? 296 00:17:24,620 --> 00:17:28,360 There's really no other solution better than mass scan. It's just 297 00:17:28,880 --> 00:17:33,760 what you do, right? Nmap will take forever with a large ASN, 298 00:17:33,840 --> 00:17:36,400 not to mention the amount of time it would take to add on all 299 00:17:36,400 --> 00:17:40,340 those domains I found. So you just can't use it. It's going to 300 00:17:40,340 --> 00:17:45,640 take forever. So for large targets ASN, like 65,000 hosts 301 00:17:45,640 --> 00:17:49,020 live or something like that, the run from Nmap is kind of 302 00:17:49,020 --> 00:17:51,540 infinite and you fall asleep. For mass scan, you can do a 303 00:17:51,560 --> 00:17:55,540 scan like this in 11 minutes. And so the problem with mass 304 00:17:55,540 --> 00:17:57,680 scan is that by default it doesn't have a default ports 305 00:17:57,680 --> 00:17:59,780 list. It's kind of meant for projects where you scan the 306 00:17:59,780 --> 00:18:02,540 whole Internet for one port. So you'd have to specify in the 307 00:18:02,540 --> 00:18:05,240 command line all the ports you want. These are all the ports 308 00:18:05,240 --> 00:18:07,780 that are the default Nmap ports here. So you can use this 309 00:18:07,780 --> 00:18:10,960 command line syntax and just plug it in and go. Or you can 310 00:18:10,960 --> 00:18:13,580 use a config file and put all these ports in your config file 311 00:18:13,580 --> 00:18:17,140 for mass scan and it will go out and search. It will go out and 312 00:18:17,140 --> 00:18:19,600 port scan all this stuff. So it's written in C. It's 313 00:18:19,600 --> 00:18:21,540 distributed really fast. And you don't have to worry about 314 00:18:21,560 --> 00:18:23,280 any of the functions. So that's why it can do what Nmap can't. 315 00:18:23,400 --> 00:18:25,580 It doesn't have any of the functions that Nmap has for 316 00:18:26,700 --> 00:18:29,120 server versioning, for Nmap scripting. It doesn't have any 317 00:18:29,120 --> 00:18:31,200 of that. It's just a port scanner to tell me what's up and 318 00:18:31,200 --> 00:18:48,200 it's really fast. Only TCP. The output of the tool? I think 319 00:18:48,200 --> 00:18:51,540 it's just a list. Yeah, a list in the command line, yeah. 320 00:18:51,560 --> 00:18:55,680 Oh, actually, no. It supports OG, which is the Nmap syntax for 321 00:18:56,860 --> 00:19:00,560 XML, comma separated value, and something else, too. Right? List 322 00:19:00,560 --> 00:19:04,040 as well. Greppable. Greppable. There we go. Greppable. Yeah. 323 00:19:06,380 --> 00:19:10,180 Cool. This tool will melt your boxes. So make sure to do it on 324 00:19:10,180 --> 00:19:12,280 DigitalOcean and not your home network. It will DOS your 325 00:19:12,280 --> 00:19:19,600 router. Okay. So I have port scanned a lot of stuff. I have 326 00:19:19,600 --> 00:19:21,540 scraped a lot of stuff. I've done a lot of stuff. I've done a 327 00:19:21,560 --> 00:19:23,300 lot of stuff. I have a lot of sources that I'm building from. 328 00:19:23,700 --> 00:19:26,680 But in the first part of the methodology, we were scraping 329 00:19:26,680 --> 00:19:29,560 public sources, and those things might not be on the Internet 330 00:19:29,560 --> 00:19:33,180 anymore. Like, they might have been taken off. They might 331 00:19:33,180 --> 00:19:36,580 actually have a registration, but they're redirecting to the 332 00:19:36,580 --> 00:19:40,700 home page of the site I'm after. Right? So a lot of the, when I 333 00:19:40,700 --> 00:19:44,020 did this run, when I did Tesla, a lot of the sites redirected 334 00:19:44,020 --> 00:19:46,120 back to just teslamotors.com, because that's their main 335 00:19:46,120 --> 00:19:48,640 domain. Right? They had registered something, either so 336 00:19:48,640 --> 00:19:51,540 that some, you know, nerd wouldn't hijack a domain that 337 00:19:51,560 --> 00:19:55,720 sounds like them, or they had maybe planned to use a site 338 00:19:55,720 --> 00:19:58,680 eventually but never did or something like that. So there's a 339 00:19:58,680 --> 00:20:00,720 lot of registration and redirects and stuff like that. So 340 00:20:00,720 --> 00:20:03,440 you need to do some visual identification. But I'm not 341 00:20:03,440 --> 00:20:06,880 going to go in my browser and open up, like, 400 tabs of sites. 342 00:20:07,040 --> 00:20:10,100 That's inefficient. So what you do is you use a tool called 343 00:20:10,100 --> 00:20:12,740 eyewitness. There's a couple tools that do this, but I like 344 00:20:12,740 --> 00:20:14,620 eyewitness the best. What they'll do is they'll take your 345 00:20:14,620 --> 00:20:18,140 list of output. And since I've been scraping from search 346 00:20:18,140 --> 00:20:21,360 engines, sometimes I don't get the protocol that I'm supposed 347 00:20:21,560 --> 00:20:24,760 to visit for that site. So it might be HTTPS, it might be 348 00:20:24,760 --> 00:20:28,360 HTTP, depending on the source where I'm scraping from. Now, 349 00:20:29,200 --> 00:20:32,360 what eyewitness will do is it'll try to visit a subdomain 350 00:20:32,360 --> 00:20:35,540 or a domain in both HTTP and HTS, and it'll take a 351 00:20:35,540 --> 00:20:38,360 screenshot, and it'll dump it in a folder. And then it will sort 352 00:20:38,360 --> 00:20:42,280 them by the length of that screenshot. They'll also pull 353 00:20:42,280 --> 00:20:44,860 header information and content type and sort them into folders 354 00:20:44,860 --> 00:20:47,820 for that as well now, too. So what I do is I run this on the 355 00:20:47,820 --> 00:20:50,400 output of everything I've already done, and I start 356 00:20:50,400 --> 00:20:51,400 visually inspecting. 357 00:20:51,560 --> 00:20:55,160 And so you can see some thumbnails there for kind of what the 358 00:20:55,160 --> 00:20:57,680 screenshots look like. But eventually, what you'll see in a 359 00:20:57,680 --> 00:21:00,140 large engagement like this against an OpenScope target is 360 00:21:00,140 --> 00:21:02,180 like an employee login, and that's where kind of I would 361 00:21:02,180 --> 00:21:05,760 want to start, or a partner login, or maybe an old 362 00:21:05,760 --> 00:21:08,580 marketing page that has, you know, long since been forgotten, 363 00:21:08,720 --> 00:21:11,860 or a page that looks like it's coded in a language that you 364 00:21:11,860 --> 00:21:14,880 could probably kick and it would fall over. So that's kind of 365 00:21:14,880 --> 00:21:15,660 where you would want to start. 366 00:21:16,660 --> 00:21:20,980 And this is a run of eyewitness on the left. The added benefit 367 00:21:20,980 --> 00:21:23,520 of eyewitness is it has a library to take screenshots for a 368 00:21:23,520 --> 00:21:26,660 couple other protocols, too, not just HTTP and HPS. It'll also 369 00:21:26,660 --> 00:21:31,560 take screenshots of RDP and VNC. So if these sites have those 370 00:21:31,560 --> 00:21:34,600 ports open, it will take a screenshot of the RDP login. So 371 00:21:34,600 --> 00:21:38,140 I've actually scored pretty good money on sites that have left 372 00:21:38,140 --> 00:21:41,820 RDP exposed to the Internet with admins still logged in, so I had 373 00:21:41,820 --> 00:21:43,780 their usernames, and all I need to do is brute force their 374 00:21:43,780 --> 00:21:45,800 passwords to get into their RDP instance. 375 00:21:46,180 --> 00:21:47,180 Male Speaker 2 in audience RDP and VNC. 376 00:21:47,180 --> 00:21:47,680 Male Speaker 2 in audience RDP and VNC. 377 00:21:48,000 --> 00:21:50,120 Male Speaker 2 in audience RDP and VNC. 378 00:21:50,120 --> 00:21:50,660 Male Speaker 2 in audience RDP and VNC. 379 00:21:50,660 --> 00:21:50,960 Male Speaker 2 in audience RDP and VNC. 380 00:21:53,340 --> 00:21:58,720 Male Speaker 2 in audience RDP and VNC. 381 00:21:59,060 --> 00:22:02,100 Not in my methodology. Usually I'm going after 382 00:22:02,100 --> 00:22:05,400 web targets, but the mass scan output will give you all those 383 00:22:05,400 --> 00:22:07,080 ports. So if I want to, I can go back later 384 00:22:07,080 --> 00:22:10,800 and look at SSH, FTP, whatever protocol I want. I would probably 385 00:22:10,800 --> 00:22:14,200 look at public-facing databases. Like, nobody should have that, 386 00:22:14,260 --> 00:22:17,220 right? You want to brute force those. I don't know. Other 387 00:22:17,220 --> 00:22:19,260 interesting ports, so. Yeah. 388 00:22:22,900 --> 00:22:43,160 Cool. Some auxiliary stuff for enumeration here is if people have DNSSEC enabled, you can use a couple of DNSSEC tools in the LDNS utils package to walk the relationship of DNSSEC registered domains. 389 00:22:43,620 --> 00:22:50,380 And this has to do with a presentation that was at a conference that I held called Level Up at BugCrowd. 390 00:22:50,380 --> 00:22:54,200 We invited a whole bunch of our bug hunters to come and talk about their techniques. 391 00:22:54,480 --> 00:23:05,260 He did a whole talk on this idea of LDNS walking and NSEC walking and then even NSEC 3 walking, which are all technologies related to DNSSEC. 392 00:23:05,400 --> 00:23:10,120 And so the presentation there taught me a lot about these couple methods. 393 00:23:10,580 --> 00:23:19,560 There was another one for basically using GitHub to find secret keys, internal credentials, API endpoints, and domain patterns. 394 00:23:19,560 --> 00:23:25,420 Inside of GitHub, so just searching your target inside of GitHub really is all it is. 395 00:23:25,920 --> 00:23:34,400 You go to the search box, you say tesla.com, and now any partner that's ever integrated with them that has open source code, you get their domains. 396 00:23:34,740 --> 00:23:37,620 They might have left API keys and stuff in there like that. 397 00:23:38,860 --> 00:23:45,080 So there's also just like the simple fact that people also don't actually just visit the site and see where it takes you. 398 00:23:45,140 --> 00:23:46,740 So this isn't passive, but this is active. 399 00:23:47,900 --> 00:23:49,540 So one method is to use just one method. 400 00:23:49,540 --> 00:23:52,900 It's burp suite and scope filters to find additional domain coverage. 401 00:23:54,080 --> 00:23:55,680 So I'm going to show that in a second. 402 00:23:55,800 --> 00:24:01,720 But basically you load up your main target through an interception proxy burp suite for web testers. 403 00:24:02,160 --> 00:24:04,600 You visit it, and then the JavaScript will start firing. 404 00:24:04,760 --> 00:24:08,980 You walk it a little bit, and you'll start to, you know, your site tree on the left will start to build up. 405 00:24:09,060 --> 00:24:15,440 And then you can just nuke your scope down to a keyword of like tesla.com and start looking at additional sites that they were linking to. 406 00:24:15,920 --> 00:24:19,440 And then you can also do a ton of Google dorking for things. 407 00:24:19,540 --> 00:24:23,140 Like people's ads keys for Google. 408 00:24:23,280 --> 00:24:28,160 So if a company registers an ad key for Google, they're going to use it globally across a lot of domains. 409 00:24:28,540 --> 00:24:32,580 So if I want to find all of their sites, I might want to Google for their ads key. 410 00:24:33,520 --> 00:24:38,000 Also, companies across all of their sites use the same privacy policy in terms of service. 411 00:24:38,560 --> 00:24:43,660 So if I can find that, I can Google for that string and find domains using that. 412 00:24:44,160 --> 00:24:47,660 And then looking for people's S3 buckets and AWS buckets. 413 00:24:48,380 --> 00:24:49,360 That's in a presentation. 414 00:24:49,540 --> 00:24:53,920 This is a presentation by Ben Sekhdaipour, I think is how you say his last name. 415 00:24:54,140 --> 00:24:55,600 He was an intern of mine at Bug Crowd. 416 00:24:55,700 --> 00:24:56,640 He works at HackerOne now. 417 00:24:56,760 --> 00:24:59,460 And he did a presentation on that, which is linked on the right as well. 418 00:24:59,760 --> 00:25:04,880 Those are methods that take kind of a while and could have their own talk. 419 00:25:05,020 --> 00:25:07,060 So I don't go into all of them right here. 420 00:25:07,520 --> 00:25:10,240 So this is just like a simple idea of what you do with Burp. 421 00:25:10,320 --> 00:25:12,640 So I'm going to kind of try to do a live demo. 422 00:25:14,120 --> 00:25:15,360 I'm going to fire up Burp Suite. 423 00:25:23,140 --> 00:25:28,960 So this is using Burp to kind of find all of the domains you can that are linked on one site. 424 00:25:30,440 --> 00:25:31,480 So I'll start at Burp. 425 00:25:32,120 --> 00:25:33,520 Any of you in here use Burp? 426 00:25:34,800 --> 00:25:35,200 Yeah? 427 00:25:40,160 --> 00:25:45,180 It just sits between your traffic and the server and it shows you everything that goes by. 428 00:25:45,300 --> 00:25:48,560 It has a whole bunch of helper tools to manipulate that web traffic. 429 00:25:51,440 --> 00:25:52,900 They have a scanner in it. 430 00:25:52,980 --> 00:25:53,220 They do. 431 00:25:53,280 --> 00:25:54,320 They have a web scanner in it. 432 00:25:54,400 --> 00:25:56,180 But today we're not going to focus on any of that. 433 00:25:57,040 --> 00:25:57,440 Okay. 434 00:25:57,660 --> 00:25:58,660 So I've opened up Burp Suite. 435 00:25:59,420 --> 00:26:02,940 And I have a Chrome tab here that's directed to pass through Burp Suite. 436 00:26:03,440 --> 00:26:07,780 So if I refresh tesla.com, you'll see my proxy tab lights up. 437 00:26:08,380 --> 00:26:09,240 I'll let this through. 438 00:26:10,460 --> 00:26:12,800 So all the traffic is now flowing through Burp Suite to the Internet. 439 00:26:13,000 --> 00:26:17,700 You can see on the left-hand side a whole bunch of stuff has how many domains have traveled through. 440 00:26:19,600 --> 00:26:26,500 Now, I want to make sure that I completely spider Tesla so I can find every related domain. 441 00:26:26,780 --> 00:26:28,920 So here's tesla.com down here. 442 00:26:29,460 --> 00:26:32,220 I can right-click here and spider this host. 443 00:26:32,740 --> 00:26:35,740 It'll say, would you like to modify the scope to include these items? 444 00:26:35,860 --> 00:26:36,900 And you want to answer yes here. 445 00:26:37,700 --> 00:26:39,200 And I'll say yes here. 446 00:26:40,060 --> 00:26:40,560 All right. 447 00:26:40,580 --> 00:26:42,980 So this is going to spider tesla.com with the web spider. 448 00:26:43,340 --> 00:26:44,980 You can see it's transferring bytes. 449 00:26:45,180 --> 00:26:46,040 It's making requests. 450 00:26:46,640 --> 00:26:47,920 It's got some forms queued. 451 00:26:48,600 --> 00:26:51,400 I'm going to stop it here because this could take a long time. 452 00:26:53,160 --> 00:26:56,120 And now I've got a whole bunch of stuff in this site tree on the side, right? 453 00:26:56,200 --> 00:27:02,300 And this will expand out pretty large if I continue that spider to its finish. 454 00:27:02,520 --> 00:27:03,940 Not all these are Tesla sites, right? 455 00:27:04,000 --> 00:27:05,500 These are all links that were on their sites. 456 00:27:05,900 --> 00:27:10,240 But an easy way to just find more scope for your target is just to go to your scope tab here. 457 00:27:10,680 --> 00:27:15,820 And you can add a new rule here in your scope and just add a keyword under your host here. 458 00:27:16,040 --> 00:27:17,000 As Tesla. 459 00:27:19,060 --> 00:27:24,980 And then click here on the ribbon and say show only in scope sites. 460 00:27:25,520 --> 00:27:28,800 Now these are all Tesla sites that were linked from their main domain. 461 00:27:29,080 --> 00:27:31,420 Now what I'd want to do is select all of these. 462 00:27:32,020 --> 00:27:33,700 Spider all of these recursively. 463 00:27:33,980 --> 00:27:35,460 Find out what they're linking to. 464 00:27:36,020 --> 00:27:38,460 And use the same filter to try to find more domains. 465 00:27:38,560 --> 00:27:43,100 So recursively I could do this and probably find a ton of their stuff that they're linking to on their sites. 466 00:27:43,740 --> 00:27:44,140 Um. 467 00:27:44,140 --> 00:27:46,460 Any questions there? 468 00:27:47,820 --> 00:27:48,300 Cool. 469 00:27:48,460 --> 00:27:49,040 All right. 470 00:27:59,220 --> 00:28:01,760 That was the only one I didn't have an animated GIF for. 471 00:28:02,060 --> 00:28:02,120 So. 472 00:28:03,140 --> 00:28:03,780 All right. 473 00:28:06,060 --> 00:28:06,740 All right. 474 00:28:06,760 --> 00:28:11,300 So I've identified a ton of sites to hack now on a large scope program or pen test. 475 00:28:11,620 --> 00:28:12,040 Um. 476 00:28:12,040 --> 00:28:12,560 Now. 477 00:28:12,860 --> 00:28:17,280 I want to do some actual identification of what software they're running to actually do the hacking. 478 00:28:17,360 --> 00:28:17,540 Right? 479 00:28:17,660 --> 00:28:18,940 I found a ton of scope. 480 00:28:19,100 --> 00:28:24,980 So there are some tools that already exist to tell you what technology stacks that these sites are using. 481 00:28:25,320 --> 00:28:25,660 Um. 482 00:28:26,540 --> 00:28:32,600 Wapalyzer and built with are two browser extensions that you can use that will automatically just based on the headers that come back from the site. 483 00:28:32,760 --> 00:28:35,640 Based on strings in the source code of the page. 484 00:28:35,980 --> 00:28:36,460 Um. 485 00:28:36,680 --> 00:28:37,840 The HTML source code. 486 00:28:38,080 --> 00:28:38,480 Um. 487 00:28:38,640 --> 00:28:40,140 They just know it's built with WordPress. 488 00:28:40,280 --> 00:28:41,920 Or they know it's built with whatever. 489 00:28:41,920 --> 00:28:42,360 Whatever framework. 490 00:28:42,640 --> 00:28:42,700 Right? 491 00:28:42,780 --> 00:28:47,140 They can even go as deep as telling you sometimes what the databases are that are running the project. 492 00:28:47,360 --> 00:28:47,500 So. 493 00:28:48,180 --> 00:28:48,980 Wapalyzer and built with. 494 00:28:49,380 --> 00:28:52,240 They're just little buttons that sit inside of your browser. 495 00:28:52,360 --> 00:28:53,880 And you can click them and get full stack information. 496 00:28:54,100 --> 00:29:00,400 The reason I want to know the full stack information is because it helps me know what techniques I'm going to use to try to hack that server. 497 00:29:00,880 --> 00:29:01,240 Um. 498 00:29:01,520 --> 00:29:03,420 There's also another thing called retire.js. 499 00:29:03,540 --> 00:29:06,780 Which is a scanner to find outdated server side JavaScript libraries. 500 00:29:07,060 --> 00:29:07,340 Um. 501 00:29:07,420 --> 00:29:08,160 Which is super cool. 502 00:29:08,260 --> 00:29:08,860 You can use that. 503 00:29:09,280 --> 00:29:09,640 Um. 504 00:29:09,640 --> 00:29:10,480 I use it a lot. 505 00:29:10,740 --> 00:29:11,040 Um. 506 00:29:11,180 --> 00:29:11,760 And then this. 507 00:29:11,780 --> 00:29:12,920 This is a new tool called. 508 00:29:13,040 --> 00:29:13,360 Um. 509 00:29:13,900 --> 00:29:14,260 Vulners. 510 00:29:14,380 --> 00:29:15,180 Or it's not a new site. 511 00:29:15,260 --> 00:29:17,020 But it's a new burp extension that I like. 512 00:29:17,100 --> 00:29:17,280 So. 513 00:29:17,460 --> 00:29:17,820 Uh. 514 00:29:17,980 --> 00:29:21,000 Vulners.com is a repository of basically CVEs. 515 00:29:21,140 --> 00:29:21,500 Um. 516 00:29:21,600 --> 00:29:23,320 And instead of the actual CVE advisory. 517 00:29:23,580 --> 00:29:27,140 They give you exploitation data on how to exploit old versions of software. 518 00:29:27,500 --> 00:29:27,860 Um. 519 00:29:27,940 --> 00:29:28,300 Like. 520 00:29:28,340 --> 00:29:28,600 You know. 521 00:29:28,640 --> 00:29:29,820 Old hacker sites used to do. 522 00:29:30,180 --> 00:29:30,540 Um. 523 00:29:30,600 --> 00:29:33,420 So they give you all the write ups of the original person who exploited it. 524 00:29:33,460 --> 00:29:34,060 It's not just like. 525 00:29:34,160 --> 00:29:34,280 Hey. 526 00:29:34,360 --> 00:29:34,680 There might. 527 00:29:34,740 --> 00:29:37,400 There is a buffer overflow in this area of the application. 528 00:29:37,620 --> 00:29:38,540 This is the CVE number. 529 00:29:38,940 --> 00:29:39,300 Um. 530 00:29:39,640 --> 00:29:40,760 So what Burp Vulner Scanner will do. 531 00:29:40,860 --> 00:29:41,720 Is it will find. 532 00:29:41,940 --> 00:29:42,300 Um. 533 00:29:42,820 --> 00:29:43,540 Basically pages. 534 00:29:43,660 --> 00:29:44,680 You load it into Burp. 535 00:29:44,700 --> 00:29:45,620 You browse a site. 536 00:29:45,880 --> 00:29:46,200 Uh. 537 00:29:46,320 --> 00:29:48,380 And it will tell you what technologies the site is using. 538 00:29:48,560 --> 00:29:49,580 And what CVEs. 539 00:29:49,580 --> 00:29:51,140 Based on the version number it's returning. 540 00:29:51,380 --> 00:29:52,540 It might be vulnerable to. 541 00:29:52,680 --> 00:29:54,400 And it has complete links inside of Burp. 542 00:29:54,440 --> 00:29:55,640 In the bottom right hand corner there. 543 00:29:55,880 --> 00:29:57,240 That you can go to and click. 544 00:29:57,980 --> 00:29:58,340 And. 545 00:29:58,380 --> 00:29:58,540 Uh. 546 00:29:58,560 --> 00:29:59,780 And find exploitation info. 547 00:30:00,500 --> 00:30:00,860 So. 548 00:30:00,920 --> 00:30:01,280 Um. 549 00:30:01,340 --> 00:30:03,100 It's a pretty sweet Burp Suite tool that. 550 00:30:03,140 --> 00:30:03,340 Uh. 551 00:30:03,460 --> 00:30:04,260 I like a lot right now. 552 00:30:06,580 --> 00:30:07,140 It's plugin. 553 00:30:07,280 --> 00:30:07,460 Yes. 554 00:30:07,560 --> 00:30:07,900 Burp. 555 00:30:07,900 --> 00:30:08,500 Burp Suite plugin. 556 00:30:08,660 --> 00:30:08,860 Yeah. 557 00:30:08,920 --> 00:30:09,100 So. 558 00:30:09,620 --> 00:30:10,420 Is it from Vulner's or. 559 00:30:11,900 --> 00:30:12,260 No. 560 00:30:12,420 --> 00:30:13,700 Vulner's just released it. 561 00:30:13,780 --> 00:30:14,040 Um. 562 00:30:14,500 --> 00:30:15,060 I think. 563 00:30:15,120 --> 00:30:15,780 Two weeks ago. 564 00:30:16,240 --> 00:30:16,600 Yeah. 565 00:30:18,340 --> 00:30:19,640 It's not in the BAP store yet. 566 00:30:19,900 --> 00:30:21,560 At least it's not as far as I'm aware. 567 00:30:21,660 --> 00:30:23,060 So it's on the GitHub on Vulner's. 568 00:30:23,080 --> 00:30:23,840 Vulner's dot com. 569 00:30:23,960 --> 00:30:24,900 Burp Vulner's Scanner. 570 00:30:25,020 --> 00:30:25,380 That's where. 571 00:30:25,520 --> 00:30:26,120 That's where it is. 572 00:30:29,040 --> 00:30:31,500 So this is just loading the extension and running it on something. 573 00:30:31,720 --> 00:30:33,540 Eventually in the bottom right hand corner you'll see the. 574 00:30:34,080 --> 00:30:34,440 Um. 575 00:30:34,640 --> 00:30:35,520 You'll see the output. 576 00:30:35,940 --> 00:30:36,300 Right. 577 00:30:36,820 --> 00:30:37,180 So. 578 00:30:37,360 --> 00:30:37,720 So. 579 00:30:39,240 --> 00:30:39,600 So. 580 00:30:41,340 --> 00:30:41,700 Let's just. 581 00:30:41,700 --> 00:30:42,400 Go into a site. 582 00:30:43,340 --> 00:30:44,040 Selecting a site. 583 00:30:45,840 --> 00:30:46,200 Yeah. 584 00:30:46,200 --> 00:30:47,000 It sees Vulner's detected. 585 00:30:47,300 --> 00:30:50,920 And there's all the CVEs that might be associated to that site because of its versions on the 586 00:30:50,920 --> 00:30:51,540 bottom right hand corner. 587 00:30:52,620 --> 00:30:52,980 Cool. 588 00:30:53,420 --> 00:30:53,960 All right. 589 00:30:54,000 --> 00:30:56,440 So I now have a bunch of targets. 590 00:30:56,620 --> 00:30:57,940 I've started to identify their platforms. 591 00:30:58,180 --> 00:30:59,780 I have auxiliary ports to test. 592 00:30:59,880 --> 00:31:02,920 I really have a lot to test at this point on a large scope pen tester bug bounty. 593 00:31:03,760 --> 00:31:06,120 Now what you have to do in any like web test. 594 00:31:06,240 --> 00:31:07,260 If it's a web technologies. 595 00:31:07,280 --> 00:31:09,120 You have to discover all the content of the website. 596 00:31:09,260 --> 00:31:09,600 Not just the web content. 597 00:31:09,620 --> 00:31:11,360 by spidering stuff that exists 598 00:31:11,360 --> 00:31:13,680 but trying to find stuff that doesn't exist. 599 00:31:13,980 --> 00:31:17,240 So this is a thing called content discovery 600 00:31:17,240 --> 00:31:19,100 or directory brute forcing on websites. 601 00:31:19,340 --> 00:31:21,380 You'll learn about this if you take any web hacking class. 602 00:31:21,740 --> 00:31:25,120 It's basically brute forcing paths on your URL. 603 00:31:25,320 --> 00:31:27,340 So let's say I'm hacking tesla.com, 604 00:31:27,840 --> 00:31:29,600 and there's a hidden page 605 00:31:29,600 --> 00:31:31,960 that is basically the admin's page, and it's slash admin. 606 00:31:32,060 --> 00:31:33,520 But that's never linked anywhere on the site. 607 00:31:33,600 --> 00:31:36,160 Only employees know about that path to go there. 608 00:31:36,360 --> 00:31:38,820 Well, the way you find this stuff is you brute force 609 00:31:38,820 --> 00:31:42,300 words after that path, after the main tesla.com path. 610 00:31:43,600 --> 00:31:47,040 So here, this, just like the old tools in DNS, 611 00:31:47,180 --> 00:31:48,820 used to take a ton of time to do. 612 00:31:49,320 --> 00:31:51,000 Tools like Potador 613 00:31:52,620 --> 00:31:55,060 or any other directory brute forcing 614 00:31:55,060 --> 00:31:56,340 or content discovery tool, 615 00:31:56,480 --> 00:31:58,120 even the content discovery tool in Burp, 616 00:31:59,180 --> 00:32:00,400 not super fast. 617 00:32:00,760 --> 00:32:04,180 Go Buster is kind of the new school tool to do this. 618 00:32:04,240 --> 00:32:05,900 It's written in Go. It's multi-threaded. 619 00:32:06,180 --> 00:32:07,980 It really does a good job for this. 620 00:32:07,980 --> 00:32:10,960 So you can burn through a large list of brute forcing, 621 00:32:11,520 --> 00:32:14,920 this kind of stuff, with Go Buster in, 622 00:32:15,540 --> 00:32:17,460 I can tell you what it's completed in. 623 00:32:18,660 --> 00:32:19,860 Running, sorry? 624 00:32:21,540 --> 00:32:22,860 It is, yes. 625 00:32:23,060 --> 00:32:25,300 It has some of the same functionalities 626 00:32:25,300 --> 00:32:26,600 as the cooler tools where you can, 627 00:32:27,120 --> 00:32:34,900 so it took 40 seconds to run on a 500,000 line 628 00:32:34,900 --> 00:32:36,260 directory brute force list, 629 00:32:36,480 --> 00:32:37,480 which is really fast. 630 00:32:37,480 --> 00:32:39,240 If you don't know, that's super fast. 631 00:32:39,960 --> 00:32:43,960 Which, like, cracker for BNC or BNP, 632 00:32:44,120 --> 00:32:44,940 do you recommend? 633 00:32:46,080 --> 00:32:47,560 For brute forcing the passwords? 634 00:32:48,260 --> 00:32:48,920 Yeah, right. 635 00:32:50,080 --> 00:32:52,900 I think Medusa was the one I used last, I think. 636 00:32:53,180 --> 00:32:53,460 Which one? 637 00:32:53,700 --> 00:32:54,160 Medusa. 638 00:32:54,360 --> 00:32:54,820 Medusa. 639 00:32:54,880 --> 00:32:55,400 Yeah, Medusa. 640 00:32:56,340 --> 00:32:59,560 Anyway, okay, so you're brute forcing URLs, right? 641 00:32:59,620 --> 00:33:01,280 So you have a fast tool, Go Buster, 642 00:33:02,280 --> 00:33:03,940 but you also need a great list 643 00:33:03,940 --> 00:33:05,660 to find out what common paths there are. 644 00:33:05,720 --> 00:33:07,460 So there's three lists, 645 00:33:07,460 --> 00:33:09,480 that are really kind of the industry standard now. 646 00:33:10,160 --> 00:33:12,440 SecList is a project that Daniel and I run together, 647 00:33:12,580 --> 00:33:15,760 and it has lists of paths that usually exist 648 00:33:15,760 --> 00:33:16,500 that are sensitive. 649 00:33:17,020 --> 00:33:20,220 Dan did a separate project called Robots Disallowed. 650 00:33:20,220 --> 00:33:22,040 He went out to the whole internet, right, Dan? 651 00:33:22,740 --> 00:33:26,320 And basically found every robots.txt file that existed, 652 00:33:26,480 --> 00:33:28,920 which is the stuff that admins don't want you to spider, 653 00:33:29,020 --> 00:33:31,180 and then put that into a list so you can then spider it. 654 00:33:31,980 --> 00:33:32,380 Yeah. 655 00:33:33,220 --> 00:33:34,760 So it's like the whole internet status. 656 00:33:34,920 --> 00:33:35,600 So it's super cool. 657 00:33:35,700 --> 00:33:37,120 You run that through Go Buster. 658 00:33:37,120 --> 00:33:37,780 It's really fast. 659 00:33:37,980 --> 00:33:39,220 You'll find good stuff there. 660 00:33:39,680 --> 00:33:42,020 Then there's these Digger Word Lists. 661 00:33:42,800 --> 00:33:45,440 These Digger Word Lists are two projects put out by, 662 00:33:45,980 --> 00:33:47,580 I forget what consultancy it was. 663 00:33:48,420 --> 00:33:49,700 It used to be Stack & Lou, 664 00:33:49,860 --> 00:33:51,600 which is now Bishop Fox, I think. 665 00:33:52,240 --> 00:33:52,980 Yeah, yeah. 666 00:33:53,080 --> 00:33:54,980 So they're cool guys. 667 00:33:55,100 --> 00:33:56,020 They had these Digger tools, 668 00:33:56,180 --> 00:33:57,480 and what they did is they went to 669 00:33:58,560 --> 00:34:00,200 the source code repositories, GitHub, 670 00:34:01,020 --> 00:34:02,060 and there's another one. 671 00:34:02,580 --> 00:34:04,120 I don't know what the other one was. 672 00:34:04,760 --> 00:34:05,160 What? 673 00:34:05,580 --> 00:34:06,660 Might have been Bitbucket. 674 00:34:06,660 --> 00:34:08,040 I'm not 100% sure. 675 00:34:09,040 --> 00:34:10,220 Anyway, they went there, 676 00:34:10,280 --> 00:34:12,080 and they spidered all the code from those projects, 677 00:34:12,760 --> 00:34:14,440 and then parsed out the paths, 678 00:34:14,680 --> 00:34:16,460 any paths that they saw for directories, 679 00:34:16,540 --> 00:34:18,160 and then made lists based off of that 680 00:34:18,160 --> 00:34:19,220 in reoccurring instances. 681 00:34:19,900 --> 00:34:21,780 So you can use any three of those lists, 682 00:34:21,860 --> 00:34:23,420 but use them with Go Buster. 683 00:34:23,540 --> 00:34:25,340 You can also do this inside of Burp, 684 00:34:25,800 --> 00:34:27,200 but it's just not as fast. 685 00:34:27,340 --> 00:34:28,380 But if you want to keep it all in Burp, 686 00:34:28,420 --> 00:34:29,040 you can do it in Burp. 687 00:34:31,540 --> 00:34:33,460 All right, so now I have paths. 688 00:34:33,740 --> 00:34:34,600 I have sites. 689 00:34:34,860 --> 00:34:36,560 I've got a ton of stuff to work with. 690 00:34:38,100 --> 00:34:39,780 Is there anything else I need to do? 691 00:34:40,140 --> 00:34:40,880 There can be. 692 00:34:41,040 --> 00:34:42,120 I don't do this a lot, 693 00:34:42,180 --> 00:34:43,220 because this is like an extra step, 694 00:34:43,360 --> 00:34:44,700 but it is worth mentioning. 695 00:34:44,900 --> 00:34:45,740 I think it's a cool idea. 696 00:34:46,260 --> 00:34:48,060 So the idea here is that I might have found 697 00:34:48,060 --> 00:34:48,860 a whole bunch of scripts, 698 00:34:49,020 --> 00:34:50,260 and maybe I found an admin script 699 00:34:50,260 --> 00:34:51,880 or resource on the page, 700 00:34:52,520 --> 00:34:55,320 but this resource doesn't tell me how to use it. 701 00:34:55,380 --> 00:34:56,040 I'm not an admin. 702 00:34:56,140 --> 00:34:57,700 I don't know what parameters to send 703 00:34:57,700 --> 00:34:59,720 or data to pass into this script to do anything. 704 00:35:00,100 --> 00:35:02,020 So the idea here is you can actually 705 00:35:02,020 --> 00:35:03,020 brute force that as well. 706 00:35:03,640 --> 00:35:05,400 So this is a tool called Parameth. 707 00:35:05,860 --> 00:35:06,640 You pass it through here, 708 00:35:06,640 --> 00:35:07,980 and you pass it a resource name 709 00:35:07,980 --> 00:35:10,460 or a script name here on the bottom. 710 00:35:10,560 --> 00:35:13,860 It found a simple test.php script, 711 00:35:14,000 --> 00:35:15,420 but it has no idea what parameters 712 00:35:15,420 --> 00:35:16,720 to pass this to execute anything. 713 00:35:18,720 --> 00:35:21,520 Or it could find a path or something like that. 714 00:35:21,880 --> 00:35:23,200 So what it does is it brute forces 715 00:35:23,200 --> 00:35:25,440 parameter names for that. 716 00:35:26,260 --> 00:35:28,820 There's another project that Burp actually put out 717 00:35:28,820 --> 00:35:30,720 called Backslash Powered Scanner, 718 00:35:30,840 --> 00:35:33,540 and they did a similar research to Dan's, 719 00:35:33,620 --> 00:35:36,480 but instead of crawling all of the robots.tech, 720 00:35:36,640 --> 00:35:37,860 files on the internet, 721 00:35:38,000 --> 00:35:39,320 and putting that into a list, 722 00:35:40,020 --> 00:35:40,980 they basically, 723 00:35:41,600 --> 00:35:42,760 I don't know where they got the data, 724 00:35:42,860 --> 00:35:45,460 but they pulled out the top 2,500 725 00:35:45,460 --> 00:35:47,580 used parameter names on the internet. 726 00:35:48,100 --> 00:35:49,960 So you can load that into Parameth 727 00:35:49,960 --> 00:35:52,660 and try to find parameters that will execute. 728 00:35:53,580 --> 00:35:54,920 You know when you're successful 729 00:35:54,920 --> 00:35:56,260 because this tool will do 730 00:35:56,260 --> 00:35:58,960 like a reject response discovery 731 00:35:58,960 --> 00:36:00,900 and a comparison between sending it nothing 732 00:36:00,900 --> 00:36:04,020 and then sending it this brute force parameter. 733 00:36:04,200 --> 00:36:04,800 So it'll tell you, 734 00:36:05,240 --> 00:36:06,200 hey, this differed. 735 00:36:06,200 --> 00:36:07,060 You should go check this out 736 00:36:07,060 --> 00:36:08,920 because I think I actually executed something here. 737 00:36:09,460 --> 00:36:09,500 Yeah. 738 00:36:13,040 --> 00:36:14,120 No, that is not. 739 00:36:14,200 --> 00:36:14,880 It's a different thing. 740 00:36:15,560 --> 00:36:15,600 Yeah. 741 00:36:20,120 --> 00:36:21,440 No, this is a command line tool. 742 00:36:21,860 --> 00:36:22,220 Yeah. 743 00:36:23,540 --> 00:36:24,800 You could do it in Burp. 744 00:36:24,900 --> 00:36:26,340 You would just have to do it in Intruder. 745 00:36:27,160 --> 00:36:27,520 Yeah. 746 00:36:28,680 --> 00:36:30,660 I mean, command line tools are usually faster, 747 00:36:30,860 --> 00:36:31,700 but if you do it in Burp, 748 00:36:31,760 --> 00:36:33,100 you keep it inside of your Burp workflow, 749 00:36:33,260 --> 00:36:33,740 which is nice. 750 00:36:34,000 --> 00:36:34,280 Yeah. 751 00:36:35,100 --> 00:36:35,460 Okay. 752 00:36:35,460 --> 00:36:36,900 So parameter brute forcing is a thing. 753 00:36:37,400 --> 00:36:37,880 All right. 754 00:36:37,900 --> 00:36:39,660 So there's a lot of stuff that we've done in here. 755 00:36:40,300 --> 00:36:42,060 You know, like how do you keep track of it? 756 00:36:42,120 --> 00:36:42,900 How do you automate it? 757 00:36:43,040 --> 00:36:45,720 Like really there's not great solutions right now. 758 00:36:46,540 --> 00:36:48,260 The problem here is I see a lot of people 759 00:36:48,260 --> 00:36:50,540 making these frameworks to do all this for you. 760 00:36:50,680 --> 00:36:51,640 And that's really great. 761 00:36:51,760 --> 00:36:53,900 Like J. Crane at my work has one called Intrigue, 762 00:36:53,900 --> 00:36:56,080 and it is the slickest looking OSINT tool. 763 00:36:56,160 --> 00:36:57,840 There's one called DataSploit, which is badass, 764 00:36:58,800 --> 00:37:00,580 which these guys actually make, which is cool. 765 00:37:01,820 --> 00:37:05,000 But my problem is that the tools and the sites 766 00:37:05,000 --> 00:37:08,080 that I'm scraping and that are written right now, 767 00:37:08,900 --> 00:37:09,900 they change a lot. 768 00:37:10,140 --> 00:37:11,880 Like sometimes those sites go offline. 769 00:37:12,040 --> 00:37:13,820 Sometimes they start limiting your API access. 770 00:37:14,380 --> 00:37:17,200 The tool and the technology may be distributed 771 00:37:17,200 --> 00:37:18,280 next time it's written. 772 00:37:18,840 --> 00:37:19,940 I mean, a lot of these tools are writing 773 00:37:19,940 --> 00:37:21,340 their own tools to do this. 774 00:37:21,420 --> 00:37:23,280 And so it's never as fast or as complete 775 00:37:23,280 --> 00:37:24,060 as I need it to be. 776 00:37:24,140 --> 00:37:25,460 So I always end up having to go back 777 00:37:25,460 --> 00:37:28,480 to manually using these tools to get the data I want. 778 00:37:29,440 --> 00:37:30,600 So there are two projects, 779 00:37:30,720 --> 00:37:34,980 one called Hodor and one called Kubot by Onshuman Baris. 780 00:37:35,000 --> 00:37:38,640 And basically the idea here for Hodor 781 00:37:38,640 --> 00:37:40,680 is that you set everything up as a Docker container 782 00:37:40,680 --> 00:37:43,400 with a standard Docker config file. 783 00:37:43,620 --> 00:37:46,880 So if you have a new tool and it's the new hotness, 784 00:37:47,060 --> 00:37:48,940 you load it into your Docker config file, 785 00:37:49,500 --> 00:37:51,880 and then you run one command in Hodor, 786 00:37:52,000 --> 00:37:56,200 and it distributes your command across all of the machines. 787 00:37:56,400 --> 00:38:00,720 Let's say I just say Docker up slash something, 788 00:38:00,920 --> 00:38:02,080 and then I say Tesla.com. 789 00:38:02,200 --> 00:38:04,500 It'll stand up new Docker instances for everything, 790 00:38:04,500 --> 00:38:06,680 run all my tools simultaneously, 791 00:38:07,440 --> 00:38:09,400 and then spit back the output to my host machine. 792 00:38:10,160 --> 00:38:12,520 And so that's where I think kind of the future is of everything, 793 00:38:12,680 --> 00:38:14,160 because then if I find a new tool I like, 794 00:38:14,240 --> 00:38:15,520 it doesn't matter what language it's written. 795 00:38:15,620 --> 00:38:17,180 I can just make a Docker container for it 796 00:38:17,180 --> 00:38:19,520 and start it and bring back the output. 797 00:38:19,720 --> 00:38:21,120 Then all I have to do with that output 798 00:38:21,120 --> 00:38:22,680 is parse it a little bit on the command line, 799 00:38:22,820 --> 00:38:23,660 and it's usable. 800 00:38:24,160 --> 00:38:25,780 So I think Hodor and Kubot 801 00:38:25,780 --> 00:38:27,600 are what I'm going to use in the future. 802 00:38:27,880 --> 00:38:29,400 There's also, in the bug bounty world, 803 00:38:29,620 --> 00:38:33,140 there's this idea of in order to hack these things, 804 00:38:33,180 --> 00:38:34,380 I have to be the first to know 805 00:38:34,380 --> 00:38:34,760 about them. 806 00:38:34,820 --> 00:38:36,700 When someone stands up a new subdomain, 807 00:38:36,840 --> 00:38:38,600 I need to be the first to know about it 808 00:38:38,600 --> 00:38:41,480 so I can hack it and get a good bug. 809 00:38:42,640 --> 00:38:44,940 Asset note is a framework 810 00:38:44,940 --> 00:38:46,580 that will do some of this for you, 811 00:38:46,620 --> 00:38:47,820 and you can write custom modules for, 812 00:38:48,000 --> 00:38:49,700 and it will basically text you 813 00:38:49,700 --> 00:38:50,740 when it finds a new domain. 814 00:38:50,960 --> 00:38:52,660 So I have a couple of bug bounty hunters 815 00:38:52,660 --> 00:38:54,540 who use this in great success. 816 00:38:54,780 --> 00:38:55,980 They get an alert on their phone 817 00:38:55,980 --> 00:38:57,700 that says Tesla stood up a new domain. 818 00:38:58,000 --> 00:38:59,360 You need to go home right now, 819 00:38:59,460 --> 00:39:00,340 stop whatever you're doing, 820 00:39:00,440 --> 00:39:03,220 and go hack it before the rest of the 500, 821 00:39:04,380 --> 00:39:05,940 1,000 bounty hunters are going to go after it. 822 00:39:06,040 --> 00:39:07,800 And so really, it makes a difference. 823 00:39:07,880 --> 00:39:09,900 It does when you're trying to do bug bounty full time 824 00:39:09,900 --> 00:39:11,200 for a living. 825 00:39:18,700 --> 00:39:19,560 Oh, that's it. 826 00:39:19,720 --> 00:39:20,380 Any questions? 827 00:39:22,760 --> 00:39:23,160 Yes? 828 00:39:32,820 --> 00:39:34,120 Where can we find your talk? 829 00:39:34,380 --> 00:39:37,700 I haven't published this version of the slides. 830 00:39:38,820 --> 00:39:39,460 I don't know. 831 00:39:39,480 --> 00:39:41,220 Are you guys publishing somehow the slides at all? 832 00:39:42,520 --> 00:39:43,700 Yeah, I'll give them to them, 833 00:39:43,720 --> 00:39:45,540 and they'll probably be on the Recon Village site. 834 00:39:46,020 --> 00:39:46,780 So, yeah. 835 00:39:46,980 --> 00:39:47,720 You have a question? 836 00:39:48,200 --> 00:39:52,180 Have you used AWS Azure or Cloudflare APIs 837 00:39:52,700 --> 00:39:54,620 to do some of your recon? 838 00:39:55,760 --> 00:39:57,640 Yeah, so there's also the idea 839 00:39:57,640 --> 00:39:59,000 of looking for that kind of stuff. 840 00:39:59,300 --> 00:40:01,780 I haven't found any tooling that I've settled on yet. 841 00:40:01,820 --> 00:40:03,080 That's why I didn't include any of it. 842 00:40:04,380 --> 00:40:05,500 There's probably four or five tools 843 00:40:05,500 --> 00:40:06,720 that will scour the internet 844 00:40:06,720 --> 00:40:09,620 for misconfigured Git directories 845 00:40:09,620 --> 00:40:14,000 and also misconfigured AWS S3 buckets. 846 00:40:14,500 --> 00:40:16,900 And so I haven't really found one I liked yet, 847 00:40:16,980 --> 00:40:18,380 so I didn't add it in the presentation, 848 00:40:18,580 --> 00:40:20,480 but that is a method that I do use. 849 00:40:20,580 --> 00:40:20,840 Yes? 850 00:40:21,900 --> 00:40:22,380 Yes? 851 00:40:22,620 --> 00:40:24,760 Do you have any suggestions for UBs 852 00:40:24,760 --> 00:40:29,980 on how to do UB space safely? 853 00:40:30,520 --> 00:40:32,180 I guess, you don't want to go home. 854 00:40:32,620 --> 00:40:33,720 Maybe you need that. 855 00:40:34,380 --> 00:40:35,860 I don't do anything from home anymore, 856 00:40:36,020 --> 00:40:38,100 so I did a bounty a couple weeks ago, 857 00:40:38,900 --> 00:40:42,200 and I went up against Akamai's WAF, 858 00:40:42,360 --> 00:40:45,320 and if you get blocked by Akamai's WAF, 859 00:40:45,420 --> 00:40:47,940 it blocks you from PayPal, eBay, all your banks. 860 00:40:48,060 --> 00:40:49,360 I tried to register for a hotel. 861 00:40:49,500 --> 00:40:50,420 It wouldn't let me to that site. 862 00:40:50,620 --> 00:40:52,440 My wife was really angry with me. 863 00:40:54,620 --> 00:40:55,420 So, yeah. 864 00:40:55,540 --> 00:40:57,600 So I do everything from DigitalOcean VPSs 865 00:40:57,600 --> 00:40:58,160 pretty much now. 866 00:40:58,400 --> 00:40:58,740 Yeah. 867 00:40:59,880 --> 00:41:00,280 Yeah. 868 00:41:02,500 --> 00:41:02,900 Yeah. 869 00:41:03,080 --> 00:41:03,220 Yeah. 870 00:41:03,640 --> 00:41:03,880 Yeah. 871 00:41:04,000 --> 00:41:04,320 Yeah. 872 00:41:04,320 --> 00:41:04,340 Yeah. 873 00:41:04,340 --> 00:41:04,360 Yeah. 874 00:41:04,380 --> 00:41:05,800 They haven't bothered me yet. 875 00:41:06,480 --> 00:41:06,540 Yeah. 876 00:41:07,080 --> 00:41:07,480 Yeah. 877 00:41:08,300 --> 00:41:08,320 What? 878 00:41:09,480 --> 00:41:10,280 Nothing yet. 879 00:41:11,300 --> 00:41:11,700 Yeah. 880 00:41:13,320 --> 00:41:13,720 Yeah. 881 00:41:16,600 --> 00:41:17,000 Oh. 882 00:41:17,320 --> 00:41:19,040 So, we have extra recon badges, 883 00:41:19,260 --> 00:41:20,440 which are super sweet. 884 00:41:23,140 --> 00:41:24,000 How am I going to do this? 885 00:41:25,820 --> 00:41:28,040 Somebody name off one of the tools I use in my methodology. 886 00:41:29,020 --> 00:41:29,820 All right. 887 00:41:29,820 --> 00:41:30,820 Who said BurpSuite first over here? 888 00:41:30,900 --> 00:41:31,380 It was you, yes. 889 00:41:31,820 --> 00:41:32,220 Okay. 890 00:41:32,600 --> 00:41:33,200 One of these. 891 00:41:34,740 --> 00:41:35,460 All right. 892 00:41:35,520 --> 00:41:37,860 What was one of these subdomain scraping things 893 00:41:37,860 --> 00:41:38,540 that I talked about? 894 00:41:39,560 --> 00:41:40,800 I think he said it first. 895 00:41:41,140 --> 00:41:41,500 Subluster. 896 00:41:41,600 --> 00:41:41,960 Yes. 897 00:41:42,760 --> 00:41:43,120 Cool. 898 00:41:44,580 --> 00:41:45,140 All right. 899 00:41:45,180 --> 00:41:45,480 Sorry. 900 00:41:46,100 --> 00:41:46,860 I only had two. 901 00:41:47,020 --> 00:41:47,460 Oh, you dropped it. 902 00:41:47,560 --> 00:41:47,960 You need the battery. 903 00:41:48,060 --> 00:41:48,460 You need the battery. 904 00:41:48,780 --> 00:41:49,340 It's right there. 905 00:41:50,300 --> 00:41:54,520 I also have a couple printed copies of proof of concept 906 00:41:54,520 --> 00:41:55,980 or get the F out. 907 00:41:57,440 --> 00:41:58,620 So, if anybody wants one of those, 908 00:41:58,660 --> 00:41:59,640 they can just come up and grab one. 909 00:41:59,760 --> 00:42:00,880 So, I'll just put them right here. 910 00:42:01,540 --> 00:42:01,900 Yeah. 911 00:42:02,580 --> 00:42:02,940 Cool. 912 00:42:03,140 --> 00:42:03,900 Well, really, 913 00:42:03,900 --> 00:42:04,500 thanks for coming. 914 00:42:04,580 --> 00:42:05,380 I really appreciate it. 915 00:42:05,680 --> 00:42:06,520 Thank you. 916 00:42:06,980 --> 00:42:07,340 Thank you. 917 00:42:07,340 --> 00:42:07,780 Thank you. 918 00:42:08,000 --> 00:42:08,220 Thank you.