1 00:00:00,000 --> 00:00:05,880 So, my name is Jay Cran. I am the VP of Product at Bug Crowd. I think people have heard of Bug 2 00:00:05,880 --> 00:00:09,620 Crowd before. I saw a few nodding heads, a few Bug Crowd t-shirts in the back, which is cool. 3 00:00:12,220 --> 00:00:15,860 Basically, this is a tool I've been working on. It's open source. It's BSD. It's not affiliated 4 00:00:15,860 --> 00:00:19,560 with Bug Crowd exactly, but it's something I've been working on and we think it's a good fit in 5 00:00:19,560 --> 00:00:26,660 general. Yeah, good. Of course. Steady audio. Oh, am I floating in and out? All right, let's 6 00:00:26,660 --> 00:00:32,180 try this. Anyway, we sort of have this philosophy about open source tools and this idea of spreading 7 00:00:32,180 --> 00:00:37,040 to the community usable tools for bug bounty hunting and for testing and for, in general, 8 00:00:37,100 --> 00:00:42,560 just doing OSN because it's a big part of security testing, too. So, this is a tool that I've been 9 00:00:42,560 --> 00:00:46,900 working on for a while. I'll give you this super quick demo here. We'll jump into slides and then 10 00:00:46,900 --> 00:00:53,680 we'll go back to videos that I've prepared. So, the idea... How many people were here for the 11 00:00:53,680 --> 00:00:56,360 data split talk? Quite a few hands. Well, 12 00:00:56,400 --> 00:00:56,640 so many people were here for the data split talk. So, the idea... How many people were here for the 13 00:00:56,660 --> 00:00:56,700 data split talk? Quite a few people were here for the data split talk. So, the idea... How many 14 00:00:56,700 --> 00:01:02,500 similar ideas between that talk and what you'll see here. It's cool to see what other folks are 15 00:01:02,500 --> 00:01:06,660 doing in the space. It's cool to see how they think about the problem. There's a lot of open 16 00:01:06,660 --> 00:01:10,460 data sources we can all use. It's about combining them and being able to tell a story with those 17 00:01:11,000 --> 00:01:15,620 pieces of data. And so, you'll see very similar ideas here, but a little bit different in sort 18 00:01:15,620 --> 00:01:20,500 of how I think about it. So, there's this idea of an interface, a GUI interface that 19 00:01:20,500 --> 00:01:26,440 you're looking at right now. It's a web app and it's also an API. And so, you can use it 20 00:01:26,440 --> 00:01:30,340 from this GUI or you can also pretty much do anything in the UI through the API. 21 00:01:31,540 --> 00:01:37,440 And so, let's go ahead and actually I'll give you the super quick intro. Create a project. 22 00:01:37,500 --> 00:01:43,780 Let's call it a test DEF CON project. And it creates a project and it drops you into this 23 00:01:43,780 --> 00:01:51,240 module runner. And you can think about modules sort of like tasks, sort of like units of 24 00:01:51,240 --> 00:01:55,680 gathering information. Just like a transform in Maltego world, it's very similar to that idea. 25 00:01:56,600 --> 00:02:03,440 And then there's this idea of entities. And so, you know, we had a list of tasks. Searching GitHub, 26 00:02:04,700 --> 00:02:10,900 scraping websites, doing DNS enumeration basically, and a bunch of different techniques. 27 00:02:11,320 --> 00:02:16,060 What's kind of cool about this module runner is that if you hit this, it basically like changes 28 00:02:16,060 --> 00:02:20,060 the form to ask you a bunch of questions based on that module. So, I mean this is designed for 29 00:02:20,060 --> 00:02:25,160 technical users, but in general like it's meant to be somewhat usable by folks who maybe this is the 30 00:02:25,160 --> 00:02:26,420 first time they're trying these sorts of things. 31 00:02:26,420 --> 00:02:31,680 So, it asks you some questions. Somebody give me a domain. Anything. 32 00:02:32,760 --> 00:02:33,500 What is it? 33 00:02:33,640 --> 00:02:34,460 ibm.com 34 00:02:34,460 --> 00:02:43,140 ibm.com. Let's do it. ibm.com. And let's, this thing's running on AWS server. So, let's like 35 00:02:43,840 --> 00:02:50,680 say brute big and let's give it 10 threads against the DNS server. And then let's run it. 36 00:02:51,600 --> 00:02:54,960 And then you see that little auto-enrich button at the bottom. You'll see that in a second. 37 00:02:55,740 --> 00:02:56,400 That'll basically give you a bunch of questions. So, let's go ahead and do that. 38 00:02:56,400 --> 00:03:00,180 So, I'm going to basically give you some things that I'll talk about in a second. 39 00:03:00,660 --> 00:03:03,480 But you see it like starts to kind of enumerate it right there. 40 00:03:04,400 --> 00:03:07,260 Oh, sweet. We're done copying. So, I'll take that. 41 00:03:10,560 --> 00:03:16,280 All right. And so, it's actively enumerating while we're doing that. 42 00:03:17,340 --> 00:03:25,520 And each one of those creates a little, another entity. So, like a DNS record here. And if you 43 00:03:25,520 --> 00:03:26,380 click on that, you can see it. So, it's like a DNS record here. And if you click on that, you can 44 00:03:26,380 --> 00:03:35,320 actually see, sorry, it's a little bit hard to see probably. But you can kind of see how, we don't 45 00:03:35,320 --> 00:03:41,060 really have any details about this yet. But we do know that it's this IP address. We also know that 46 00:03:41,060 --> 00:03:49,520 it's Akamai. Yeah. There you go. Cool. Can you guys see that in the back? Cool. Some nodding 47 00:03:49,520 --> 00:03:54,660 heads. Awesome. So, we capture this information about this entity. So, we resolved it automatically. 48 00:03:54,960 --> 00:03:56,360 We figured out that there's some other hosting. So, we're going to go ahead and do that. So, we're 49 00:03:56,360 --> 00:03:57,660 going to go ahead and do that. So, we're going to go ahead and do that. So, we're going to go ahead and do that. 50 00:03:57,660 --> 00:04:05,600 We know that we created it from that brute domain subforce. Sorry, DNS brute sub module. And we've 51 00:04:05,600 --> 00:04:09,680 got some other entities here. And notice this little H. It's actually, there's some rules built 52 00:04:09,680 --> 00:04:14,780 into it for stuff that's hidden in general, right? Like Akamai, we tend to like push away 53 00:04:14,780 --> 00:04:18,740 because there's not much we can do with Akamai as testers. It's just a front end basically. 54 00:04:20,980 --> 00:04:25,260 So, anyway, while that's running, it's filling out this entities page. 55 00:04:26,360 --> 00:04:29,420 And I've got this in mobile mode. So, it may be showing up a little funny. 56 00:04:30,100 --> 00:04:34,660 But you can see here, if you just keep scrolling down, you've got those entities. And then all 57 00:04:34,660 --> 00:04:39,040 the aliases for them here. And so, you end up with this list of things that you've discovered. 58 00:04:40,840 --> 00:04:49,340 And if you correlate those, you kind of end up seeing, oh, actually, that IP address is gw.ibm.com. 59 00:04:50,380 --> 00:04:54,440 That's that. And you can now start to see load balancers and things like that. So, 60 00:04:54,460 --> 00:04:55,960 you get this correlation that's happening. 61 00:04:56,960 --> 00:05:04,480 Automatically. But they're each independent. And each entity can also have things run against it. 62 00:05:04,700 --> 00:05:10,440 So, say we wanted to NMAP scan that. You can just go ahead and NMAP scan it. 63 00:05:11,620 --> 00:05:19,820 And it'll do the right thing. So, it kicks off an NMAP scan. Okay. Let me just see here. 64 00:05:20,560 --> 00:05:21,580 How about that? 65 00:05:22,060 --> 00:05:22,260 Okay. 66 00:05:23,080 --> 00:05:23,640 Okay. 67 00:05:25,780 --> 00:05:26,340 Okay. 68 00:05:28,820 --> 00:05:30,800 Got my slides now, which is great. 69 00:05:33,500 --> 00:05:34,240 All right. Cool. 70 00:05:39,920 --> 00:05:43,800 So, that's a super quick demo. That's a super quick intro to the concepts of it. Let me walk 71 00:05:43,800 --> 00:05:49,320 you back for a second. And let's talk about what this thing really is. It's a framework. Much like 72 00:05:49,320 --> 00:05:54,480 other frameworks we've heard today. Many similar concepts to Metasploit and to Maltego. It's built 73 00:05:54,480 --> 00:05:54,940 in Ruby. 74 00:05:55,700 --> 00:06:00,840 Those tasks are individual modules. And it's really oriented more toward discovering 75 00:06:00,840 --> 00:06:05,280 organizational attacks. So, what I mean by that is you can punch in a top-level domain of a company 76 00:06:05,280 --> 00:06:09,340 and it'll fill out everything it can figure out about that company. And I'll show that to you. 77 00:06:09,400 --> 00:06:15,080 I've got a demo for that. It's written in mostly Ruby. Though there is a, you know, we link out to 78 00:06:15,620 --> 00:06:22,980 NMAP and to mass scan and a few other tools where we haven't rewritten it in Ruby. 79 00:06:23,160 --> 00:06:23,560 Okay. 80 00:06:25,520 --> 00:06:29,360 It's also designed mainly for technical users. And it's useful to kind of think about 81 00:06:29,360 --> 00:06:33,780 this thing that I'm showing you as an engine. Because it's also an API. And you can use that 82 00:06:33,780 --> 00:06:37,740 to send information out of it or put information into it and enrich that information. 83 00:06:39,280 --> 00:06:44,960 So, just architecturally, what you were looking at there was the GUI that sits on top of an API. 84 00:06:45,480 --> 00:06:49,600 It has all those concepts of tasks, entities. I'll talk about strategies and handlers in a second. 85 00:06:49,820 --> 00:06:53,500 That sits on top of Postgres and Sidekiq and Reddit. 86 00:06:53,560 --> 00:06:57,860 So, it's pretty massively parallel. You can do lots of things at the same time. 87 00:06:58,220 --> 00:07:03,300 If you've got a powerful box. And so, those concepts that I mentioned, entities, enrichment, 88 00:07:03,580 --> 00:07:09,280 tasks, aliasing strategies. I'll just demo these things for you. Entities. I think everybody here 89 00:07:09,280 --> 00:07:14,140 is pretty familiar with this concept of an entity. It's a thing, right? So, you think about Maltego, 90 00:07:14,220 --> 00:07:20,140 right? Creating a thing. With Intrigue, we have these types over here on the right-hand side. 91 00:07:20,460 --> 00:07:23,040 Some of those are going to look very familiar. DNS record. 92 00:07:23,560 --> 00:07:29,440 IP address. Person. Physical location. Those are kind of things that we know about and they're 93 00:07:29,440 --> 00:07:33,500 built into an ontology. And the only real requirement about these things is they have a 94 00:07:33,500 --> 00:07:40,240 name, right? And a unique name. So, every entity is unique. A name and a type. And basically, 95 00:07:41,040 --> 00:07:44,540 validation. You can validate lots of things about an entity, but the name is the most important 96 00:07:44,540 --> 00:07:49,100 thing. And then there's this enrichment process that allows us to automatically look up a DNS 97 00:07:49,100 --> 00:07:53,540 record, you know, to get the IP address associated with it. Or to find a website and know that, you 98 00:07:53,560 --> 00:07:56,820 know, another website is the same website because we looked at the HTML and it's exactly the same. 99 00:07:58,340 --> 00:08:07,520 So, just to demo that for you. I think I'm going to do it live. What do you guys think? 100 00:08:07,940 --> 00:08:08,340 Yeah. 101 00:08:08,920 --> 00:08:09,800 All right. Cool. 102 00:08:10,140 --> 00:08:12,580 I like it. I like it. All right. 103 00:08:17,440 --> 00:08:22,980 So, we basically kind of did this, but let me show you the thing that I want to point out here. 104 00:08:23,560 --> 00:08:26,320 I have this module called, or this task called create entity. 105 00:08:26,540 --> 00:08:27,280 Okay, cool, whatever. 106 00:08:28,560 --> 00:08:30,860 We can create any of those entities I just showed you. 107 00:08:31,020 --> 00:08:34,540 In this case, I'm going to create, let's create a DNS record. 108 00:08:34,800 --> 00:08:36,720 And my stuff's more oriented to the network side. 109 00:08:36,920 --> 00:08:39,700 I mean, like you saw with data split, it's more oriented to the people side and things like that. 110 00:08:39,860 --> 00:08:42,940 This, in general, you can do a lot of the same things in these tools. 111 00:08:44,700 --> 00:08:47,040 But it's about the flows that you build into them. 112 00:08:47,040 --> 00:08:54,300 And so a lot of the flows are built around enumerating a network and the devices and the websites and things like that on a network today, right? 113 00:08:54,400 --> 00:08:56,360 But there are lots of ways to extend on that. 114 00:08:57,920 --> 00:08:59,520 Anyway, let's create intrigue. 115 00:08:59,560 --> 00:09:00,520 Actually, let's do IBM again. 116 00:09:01,520 --> 00:09:02,620 And let's not. 117 00:09:02,940 --> 00:09:06,080 I'm going to leave this iterations as interactive for right now. 118 00:09:07,140 --> 00:09:09,280 And I'll explain what that means in one second. 119 00:09:09,520 --> 00:09:12,060 And I'm going to keep this auto-enrich box checked. 120 00:09:14,220 --> 00:09:15,000 So, cool. 121 00:09:15,060 --> 00:09:16,060 We created an entity. 122 00:09:16,060 --> 00:09:17,920 Nothing spectacular there. 123 00:09:18,120 --> 00:09:21,920 But if you do click on this, you'll notice it automatically enriched that. 124 00:09:22,120 --> 00:09:25,120 And it automatically associated it with that IP address. 125 00:09:25,480 --> 00:09:30,820 And so now, if there were multiple IP addresses, I'm going to give you an example of something like that. 126 00:09:32,160 --> 00:09:34,460 I know Yahoo resolves to a lot. 127 00:09:34,500 --> 00:09:36,240 They've got a lot of load balancers and things like that. 128 00:09:36,320 --> 00:09:36,800 So, Yahoo. 129 00:09:38,940 --> 00:09:41,700 I'll just create an entity, DNS record. 130 00:09:43,620 --> 00:09:44,660 Yahoo.com. 131 00:09:45,060 --> 00:09:46,040 Auto-enriching. 132 00:09:46,060 --> 00:09:47,040 Run it. 133 00:09:48,420 --> 00:09:48,820 Cool. 134 00:09:48,840 --> 00:09:49,420 Click on that. 135 00:09:49,560 --> 00:09:50,480 And you'll see, oh, cool. 136 00:09:50,560 --> 00:09:51,660 It's actually all these things. 137 00:09:51,780 --> 00:09:53,380 And there's a bunch of IPv6 stuff there, too. 138 00:09:53,480 --> 00:09:53,840 Cool. 139 00:09:54,820 --> 00:09:55,420 All right. 140 00:09:55,500 --> 00:09:59,660 And then actually show me how that looks for everything. 141 00:10:01,200 --> 00:10:01,600 Cool. 142 00:10:01,820 --> 00:10:02,340 All right. 143 00:10:02,400 --> 00:10:06,280 And again, remember, we can correlate this and actually show it's all the same thing. 144 00:10:07,900 --> 00:10:12,200 Even though those are a bunch of different IPs, now you know they're basically all the same system. 145 00:10:12,260 --> 00:10:14,000 Or there's a load balancer in front of them, right? 146 00:10:16,060 --> 00:10:16,200 Cool. 147 00:10:16,360 --> 00:10:17,180 Yeah, same thing. 148 00:10:18,000 --> 00:10:18,560 All right. 149 00:10:18,580 --> 00:10:18,800 Sweet. 150 00:10:18,900 --> 00:10:20,000 So, that's creating an entity. 151 00:10:20,040 --> 00:10:21,100 That's enriching an entity. 152 00:10:24,300 --> 00:10:25,520 Any questions so far? 153 00:10:25,700 --> 00:10:26,020 Yeah. 154 00:10:26,300 --> 00:10:30,680 So, that's basically focusing on that single entity, right? 155 00:10:30,700 --> 00:10:30,900 Yeah. 156 00:10:30,900 --> 00:10:32,300 It's not like anywhere else. 157 00:10:32,820 --> 00:10:33,220 Right. 158 00:10:33,740 --> 00:10:34,140 Yeah. 159 00:10:34,300 --> 00:10:34,960 But I'll show you that. 160 00:10:35,640 --> 00:10:37,240 And I wanted to start with, like, something simple. 161 00:10:39,460 --> 00:10:40,700 So, tasks, right? 162 00:10:40,760 --> 00:10:42,160 We just ran a create entity task. 163 00:10:42,760 --> 00:10:43,760 There's other tasks. 164 00:10:43,880 --> 00:10:45,020 And, man, it's really hard to see that. 165 00:10:45,080 --> 00:10:45,960 But I'll just give you an example. 166 00:10:46,060 --> 00:10:47,160 By looking at the UI. 167 00:10:47,760 --> 00:10:49,620 Sorry for putting green on black. 168 00:10:49,860 --> 00:10:51,340 I thought it was DEF CON, so I was in this period. 169 00:10:55,280 --> 00:10:55,600 Yes. 170 00:10:57,180 --> 00:10:57,500 Cool. 171 00:10:57,660 --> 00:10:59,100 Maybe that's a little easier to see. 172 00:11:00,140 --> 00:11:00,460 Again. 173 00:11:01,280 --> 00:11:01,600 So. 174 00:11:02,060 --> 00:11:04,160 And these do largely what you'd expect, right? 175 00:11:04,460 --> 00:11:04,780 Just. 176 00:11:06,400 --> 00:11:06,720 Yeah. 177 00:11:07,160 --> 00:11:07,660 Yeah, yeah, yeah. 178 00:11:07,760 --> 00:11:08,820 And we're actively adding this up. 179 00:11:08,840 --> 00:11:09,580 It's a framework, right? 180 00:11:09,640 --> 00:11:10,420 You can contribute a task. 181 00:11:10,500 --> 00:11:12,740 I'll show you the code in one second just so you get an idea of what it looks like. 182 00:11:12,780 --> 00:11:13,420 Very similar ideas. 183 00:11:14,940 --> 00:11:17,420 Some that are relatively new that are kind of interesting. 184 00:11:17,620 --> 00:11:23,100 There's a lot of stuff being discovered right now with AWS S3 buckets being left open. 185 00:11:23,360 --> 00:11:23,940 Nodding heads. 186 00:11:24,160 --> 00:11:24,440 Yes. 187 00:11:24,900 --> 00:11:25,340 Yeah. 188 00:11:25,400 --> 00:11:26,240 People have seen that one. 189 00:11:28,040 --> 00:11:32,560 Basically, it's really easy when you set up an S3 bucket to, like, set everyone permissions 190 00:11:32,560 --> 00:11:36,200 or set authenticated user permissions, and you end up leaving stuff that you probably 191 00:11:36,200 --> 00:11:38,460 ought not leave in the public, in the public. 192 00:11:38,840 --> 00:11:40,080 For example, I was just... 193 00:11:40,080 --> 00:11:42,380 The reason I added this, actually, I was messing around when... 194 00:11:42,960 --> 00:11:43,400 I think it was... 195 00:11:43,400 --> 00:11:45,840 It was Chris Vickery that found the 200 million voter database. 196 00:11:46,100 --> 00:11:46,720 Did you guys see that? 197 00:11:47,180 --> 00:11:52,760 Basically, 200 million accounts that got dumped by a provider of this sort of data. 198 00:11:53,380 --> 00:11:58,060 And I was just floating around and happened to do a Google dork for something that I thought 199 00:11:58,060 --> 00:11:58,640 might be similar. 200 00:11:58,660 --> 00:11:59,320 I was trying to find it. 201 00:11:59,700 --> 00:12:04,860 And found that there was another one by the state of Virginia that was also open, just 202 00:12:04,860 --> 00:12:05,700 open in public. 203 00:12:05,760 --> 00:12:06,600 And it turns out... 204 00:12:07,080 --> 00:12:07,480 No, sorry. 205 00:12:07,540 --> 00:12:08,100 It was North Carolina. 206 00:12:08,320 --> 00:12:13,200 And North Carolina actually mandatorily requires you to gather. 207 00:12:13,400 --> 00:12:15,440 This information and store it, right? 208 00:12:15,500 --> 00:12:16,600 Which is pretty crazy. 209 00:12:16,660 --> 00:12:17,460 They changed the law recently. 210 00:12:17,660 --> 00:12:20,780 So these sort of databases are out there and floating around. 211 00:12:20,900 --> 00:12:23,040 But that's a super digression. 212 00:12:23,160 --> 00:12:23,420 Sorry. 213 00:12:24,280 --> 00:12:26,800 Anyway, I built some modules to, like, help find those things. 214 00:12:28,560 --> 00:12:30,900 And so let me give you an example of those one real quick. 215 00:12:31,280 --> 00:12:36,280 So here's some buckets we can brew. 216 00:12:36,760 --> 00:12:39,060 IBM, anybody else have buckets? 217 00:12:40,600 --> 00:12:41,000 Sweden? 218 00:12:41,960 --> 00:12:42,360 Sweden? 219 00:12:43,600 --> 00:12:44,360 I don't know. 220 00:12:45,560 --> 00:12:47,660 I haven't heard about Sweden losing all of its data. 221 00:12:47,920 --> 00:12:48,820 We'll talk after. 222 00:12:48,900 --> 00:12:49,140 Yes. 223 00:12:49,280 --> 00:12:50,000 Holy crap. 224 00:12:52,080 --> 00:12:52,720 All right. 225 00:12:53,600 --> 00:12:54,440 Poor Swedes. 226 00:12:54,440 --> 00:12:55,300 I feel for them. 227 00:12:57,780 --> 00:12:58,200 Cool. 228 00:12:58,340 --> 00:12:58,920 Do your thing. 229 00:12:59,160 --> 00:13:00,100 Hit run task. 230 00:13:00,380 --> 00:13:01,460 Does that actually work? 231 00:13:02,440 --> 00:13:03,940 I think it's chugging right now. 232 00:13:04,000 --> 00:13:04,600 Give me one sec. 233 00:13:08,320 --> 00:13:08,820 All right. 234 00:13:08,840 --> 00:13:09,600 This is a live demo. 235 00:13:09,740 --> 00:13:11,740 So give me some slack. 236 00:13:14,120 --> 00:13:15,940 You had mentioned box size earlier. 237 00:13:16,120 --> 00:13:16,560 Box size. 238 00:13:16,760 --> 00:13:19,040 Yeah, I would definitely go with, like, 8 gigs. 239 00:13:19,320 --> 00:13:22,720 Like, it's Ruby, and then it's pretty massively parallel. 240 00:13:22,840 --> 00:13:23,820 You can scale it pretty well. 241 00:13:24,000 --> 00:13:27,320 So you can – let me show you a task, and then I'll show you sort of how that works. 242 00:13:27,780 --> 00:13:28,420 No, no, no. 243 00:13:28,420 --> 00:13:28,720 It's fine. 244 00:13:28,840 --> 00:13:29,440 It's a good question. 245 00:13:29,480 --> 00:13:32,180 The question basically was, like, how big of a box do you need to run this? 246 00:13:32,320 --> 00:13:33,460 It's not actually that bad. 247 00:13:35,560 --> 00:13:38,960 Crap, I can't show you because github.com. 248 00:13:40,220 --> 00:13:40,580 Intrigue. 249 00:13:42,180 --> 00:13:42,900 Intrigue core. 250 00:13:44,160 --> 00:13:44,720 There we go. 251 00:13:44,840 --> 00:13:45,760 So this is actually the code. 252 00:13:45,840 --> 00:13:48,000 This is the easiest way for me to show this because it's not my system. 253 00:13:49,420 --> 00:13:53,660 Here are the tasks, and we were looking at AWS Brute. 254 00:13:54,780 --> 00:14:04,940 And so there's some metadata about a task, which basically lets you – that's how it manages all that ability to tell you which things are allowable or not in the module runner. 255 00:14:05,600 --> 00:14:08,920 And then there's a run method, and that's pretty much it. 256 00:14:10,720 --> 00:14:11,080 Yeah. 257 00:14:13,900 --> 00:14:14,520 There we go. 258 00:14:16,120 --> 00:14:18,640 So, I mean, the run method does the right thing. 259 00:14:18,760 --> 00:14:25,520 In this case, it's a pretty dirty module because we're using Nokogiri to scrape HTML, but, I mean, you can use APIs to do these sorts of things, too. 260 00:14:25,540 --> 00:14:31,120 Let me give you another example where it's a little more clean, like searching Shodan or Census, right? 261 00:14:32,220 --> 00:14:32,540 Metadata. 262 00:14:32,800 --> 00:14:36,120 This is going to look a lot like Metasploit in the way that it's set up, right? 263 00:14:36,500 --> 00:14:43,140 There's this idea of a global config that it can pull from, and then it just, like, hits the API, right? 264 00:14:43,140 --> 00:14:49,300 And grabs the results out and creates – this has this idea of creating an entity in this. 265 00:14:50,720 --> 00:14:52,640 Anyway, coming back on track here. 266 00:14:53,440 --> 00:14:55,880 As I mentioned, you can pull data from APIs. 267 00:14:56,360 --> 00:14:57,560 You can scrape data. 268 00:14:58,160 --> 00:15:02,700 Similar concept to transforms or modules and other frameworks, and then that run method really matters. 269 00:15:04,180 --> 00:15:07,460 So I showed you DNS subdomain brute forcing, so I'm going to skip over that. 270 00:15:07,620 --> 00:15:12,000 I mean, let's go back and actually check on it and see how it's doing, but otherwise, let's move on. 271 00:15:15,460 --> 00:15:19,800 I think we did – I don't remember where we did that. 272 00:15:20,660 --> 00:15:21,920 Actually, let's just run it again. 273 00:15:25,940 --> 00:15:27,280 DNS subdomain brute force. 274 00:15:27,860 --> 00:15:30,860 Choose a DNS record because that's the entity type we're going to use. 275 00:15:31,740 --> 00:15:32,540 IBM.com. 276 00:15:34,280 --> 00:15:35,540 And then do the right thing. 277 00:15:35,640 --> 00:15:36,340 I just hit enter. 278 00:15:36,400 --> 00:15:37,540 Sorry, I sped right through that. 279 00:15:39,260 --> 00:15:42,500 It has a list built into it, but there are other sort of options. 280 00:15:42,500 --> 00:15:43,420 And you can set threads. 281 00:15:43,460 --> 00:15:46,280 So, like, if you have a bigger system, you can really thread this thing out. 282 00:15:49,360 --> 00:15:50,240 Ah, right. 283 00:15:50,360 --> 00:15:51,160 Let me get to that. 284 00:16:00,080 --> 00:16:02,840 And so there's the demo of brute forcing. 285 00:16:02,960 --> 00:16:05,080 Oh, also, one small point before we do that. 286 00:16:06,980 --> 00:16:08,360 The brute force is pretty smart. 287 00:16:08,600 --> 00:16:10,280 There's this idea of permutation. 288 00:16:10,480 --> 00:16:11,860 So if it finds a dub-dub-dub. 289 00:16:12,500 --> 00:16:16,760 It'll actually try a bunch of permutations on that. 290 00:16:16,840 --> 00:16:18,760 And that's a pretty good way to find bugs. 291 00:16:18,960 --> 00:16:22,320 Prod, stage, stuff that just gets left open. 292 00:16:24,320 --> 00:16:27,940 So we talked about aliasing. 293 00:16:28,440 --> 00:16:32,480 We talked about the idea that an IP address and a DNS record can really be the same thing. 294 00:16:32,580 --> 00:16:35,840 And you want to preserve that relationship, but also you want to be able to split it apart 295 00:16:35,840 --> 00:16:39,480 and look at them differently because that allows you to see load balancers and things 296 00:16:39,860 --> 00:16:41,960 and really understand if there's stuff on Akamai 297 00:16:41,960 --> 00:16:42,480 or if there's stuff on – yeah. 298 00:16:42,500 --> 00:16:43,280 If there's stuff on different systems. 299 00:16:43,660 --> 00:16:45,680 So that's really what aliasing does for us. 300 00:16:46,880 --> 00:16:48,900 But let's just explore some data. 301 00:16:49,120 --> 00:16:50,440 This is all well and good. 302 00:16:50,600 --> 00:16:51,520 I think you get the concepts. 303 00:16:53,860 --> 00:16:58,820 Let's go to DeskCon. 304 00:17:05,180 --> 00:17:06,720 So we're just going to let this load. 305 00:17:08,300 --> 00:17:08,740 Cool. 306 00:17:09,220 --> 00:17:10,980 And you see that there's this searching. 307 00:17:11,700 --> 00:17:12,140 Yeah. 308 00:17:12,500 --> 00:17:18,360 And the ability to filter, show me all DNS records in this project, search. 309 00:17:21,200 --> 00:17:23,040 Sorry for the UI here. 310 00:17:26,340 --> 00:17:29,240 But that's every DNS record in this particular project. 311 00:17:29,300 --> 00:17:34,200 And if you want to search like a name, Yahoo, or maybe the name NotYahoo, 312 00:17:36,620 --> 00:17:40,300 give me everything that's NotYahoo in this that we found. 313 00:17:42,600 --> 00:17:45,640 And so now you start to see all these different systems that we've been able to find. 314 00:17:45,680 --> 00:17:46,640 But how do we find this? 315 00:17:46,680 --> 00:17:47,360 What is the strategy? 316 00:17:47,540 --> 00:17:48,520 What are these iteration things? 317 00:17:48,640 --> 00:17:49,240 Why are they important? 318 00:17:49,400 --> 00:17:50,400 That's really the question here. 319 00:17:50,820 --> 00:17:52,120 So let me show you that. 320 00:17:55,060 --> 00:17:56,280 Let's do IBM. 321 00:17:58,420 --> 00:17:59,580 Let's create an entity. 322 00:17:59,960 --> 00:18:03,400 And we're going to do this – and remember I said at the very beginning, this is organizationally 323 00:18:03,400 --> 00:18:04,160 oriented, right? 324 00:18:04,320 --> 00:18:08,540 You give it a top-level domain for a company, and it'll just kind of span out from there. 325 00:18:09,440 --> 00:18:12,480 So we'll give it a DNS record of IBM.com. 326 00:18:14,120 --> 00:18:16,780 And we're going to use the network enumeration strategy. 327 00:18:16,940 --> 00:18:18,080 And what's a strategy? 328 00:18:18,800 --> 00:18:28,120 Strategy basically says, when you get – I don't think I can step away from the podium 329 00:18:28,120 --> 00:18:28,260 here. 330 00:18:28,360 --> 00:18:32,100 But when you get a DNS record, run a Whois on it. 331 00:18:32,620 --> 00:18:35,580 Or when you get an IP address, Nmap scan it. 332 00:18:35,680 --> 00:18:40,000 And you can build these strategies of like allowing you to kind of build out your own 333 00:18:40,460 --> 00:18:41,460 machine, if you will. 334 00:18:42,160 --> 00:18:43,240 Of how you want to do it. 335 00:18:43,260 --> 00:18:44,240 Now that's a very simple one. 336 00:18:44,680 --> 00:18:47,780 And it basically is one single iteration of this. 337 00:18:48,660 --> 00:18:52,080 But this recursion allows you to fan out. 338 00:18:53,720 --> 00:18:57,920 So instead of setting that to interactive, where it's kind of man in the loop, I can 339 00:18:57,920 --> 00:18:59,000 run modules one by one. 340 00:18:59,200 --> 00:19:02,180 In this case, we're going to say, go ahead and run a bunch of modules, depending on what 341 00:19:02,180 --> 00:19:02,540 you get. 342 00:19:02,620 --> 00:19:04,180 So if you get an IP address, go ahead and scan it. 343 00:19:04,240 --> 00:19:06,200 If you get a DNS record, go ahead and brute force it. 344 00:19:06,900 --> 00:19:10,020 If you get something that looks like an AWS bucket, go ahead and try to brute it. 345 00:19:11,300 --> 00:19:12,340 So we'll do six. 346 00:19:12,460 --> 00:19:15,840 Because you don't want to scan the entire internet at once, right? 347 00:19:16,440 --> 00:19:17,660 You want to limit it. 348 00:19:17,740 --> 00:19:18,760 So there's this idea of iterations. 349 00:19:18,880 --> 00:19:20,440 I try to be sensible in my iterations. 350 00:19:21,120 --> 00:19:23,480 Anything more than eight finds the internet. 351 00:19:24,220 --> 00:19:25,580 So we'll put it at six. 352 00:19:26,320 --> 00:19:27,600 And we'll just run this. 353 00:19:27,640 --> 00:19:28,720 And we'll leave enrichment on. 354 00:19:28,780 --> 00:19:30,820 Enrichment is that idea of correlation between entities. 355 00:19:32,580 --> 00:19:34,180 And it creates an entity. 356 00:19:36,120 --> 00:19:39,880 And then it starts to fan out. 357 00:19:39,940 --> 00:19:40,000 Cool. 358 00:19:40,020 --> 00:19:43,380 Let's see if my demo works appropriately. 359 00:19:44,280 --> 00:19:47,960 Actually, I may do a video for this one, guys, just because it's live. 360 00:19:55,160 --> 00:19:57,060 Yeah, let's just do the video for this. 361 00:19:58,720 --> 00:20:00,200 And I'll talk you through this. 362 00:20:01,740 --> 00:20:03,080 So create a new project. 363 00:20:03,200 --> 00:20:04,900 We're going to fan out, right? 364 00:20:05,480 --> 00:20:06,760 We're going to create an entity. 365 00:20:09,000 --> 00:20:10,520 And it's going to be a DNS record. 366 00:20:10,680 --> 00:20:12,520 And a lot of this stuff is oriented around DNS today. 367 00:20:12,620 --> 00:20:13,400 But it could be people. 368 00:20:13,520 --> 00:20:14,120 It could be anything. 369 00:20:14,520 --> 00:20:15,220 We're going to use Yahoo. 370 00:20:16,000 --> 00:20:19,080 We're going to use network enumeration because we want to do the network side of this. 371 00:20:19,440 --> 00:20:20,680 That's the strategy we're using. 372 00:20:21,160 --> 00:20:22,240 And we'll do six iterations. 373 00:20:22,760 --> 00:20:23,560 And we'll enrich. 374 00:20:24,980 --> 00:20:25,680 And it runs. 375 00:20:27,360 --> 00:20:28,880 I'm making this as big as I can. 376 00:20:29,120 --> 00:20:31,120 I'm trying to talk you through it if you can't see it in the back. 377 00:20:31,660 --> 00:20:33,140 And it's starting to fan out. 378 00:20:33,320 --> 00:20:35,080 And do that look up. 379 00:20:35,160 --> 00:20:36,700 You notice that it found net blocks there. 380 00:20:36,740 --> 00:20:38,640 Those net blocks are associated with Yahoo. 381 00:20:38,900 --> 00:20:40,160 We just grab all the information. 382 00:20:40,880 --> 00:20:42,300 And we grab that from Whois. 383 00:20:42,940 --> 00:20:43,780 Pretty basic. 384 00:20:45,160 --> 00:20:48,720 And I notice in there it's yahooinc.com that that's registered to. 385 00:20:48,840 --> 00:20:51,240 So I'm going to go start another fan out from Yahoo Inc. 386 00:20:51,900 --> 00:20:55,520 Because I want those net blocks to be automatically enumerated. 387 00:20:55,980 --> 00:21:01,860 And it's got a rule that basically says if the name of the entity, the top level entity is in there, go ahead and enumerate and build it out. 388 00:21:04,260 --> 00:21:04,680 Cool. 389 00:21:07,540 --> 00:21:10,780 And then you'll see this stuff starts to get scanned right away, too. 390 00:21:10,860 --> 00:21:12,680 See that tasks run on this entity? 391 00:21:12,880 --> 00:21:17,200 It actually kicked off a mass scan on port 80 across that net block. 392 00:21:18,600 --> 00:21:20,740 Which is going to take a while to run, to be totally honest. 393 00:21:20,800 --> 00:21:23,140 We're not going to have time to show you everything that comes out of that. 394 00:21:23,240 --> 00:21:24,920 But see how all this stuff just fans out? 395 00:21:25,260 --> 00:21:26,780 This is all based around the strategy. 396 00:21:26,920 --> 00:21:28,560 You have to build a strategy that makes sense. 397 00:21:28,640 --> 00:21:30,240 You don't want to scan the entire Internet at once. 398 00:21:31,080 --> 00:21:31,840 I mean, you may. 399 00:21:31,980 --> 00:21:32,380 We do. 400 00:21:33,940 --> 00:21:34,660 But it's all based around the strategy. 401 00:21:34,680 --> 00:21:36,000 It's not a good idea unless you're properly equipped. 402 00:21:38,660 --> 00:21:39,600 And you can search. 403 00:21:39,660 --> 00:21:43,100 I think I just showed searching there for all the mass scan stuff. 404 00:21:43,300 --> 00:21:45,520 Notice that it creates IP addresses and network services. 405 00:21:45,800 --> 00:21:48,960 It does try to look up and resolve and create URIs. 406 00:21:48,960 --> 00:21:52,080 And URIs become, like, websites as well. 407 00:21:52,420 --> 00:21:54,740 And I'll show you something cool with websites here in just a second. 408 00:21:54,760 --> 00:21:55,320 I've got another demo. 409 00:21:57,100 --> 00:21:58,820 Anyway, that's pretty much the end of that. 410 00:21:59,200 --> 00:22:00,680 Let's fast forward a little bit. 411 00:22:00,760 --> 00:22:03,320 And let's show you sort of how that looks once we have the data. 412 00:22:03,320 --> 00:22:06,720 I keep telling you about the tool, but the data actually matters. 413 00:22:07,840 --> 00:22:09,520 And see, we've got these statistics over here. 414 00:22:09,560 --> 00:22:11,000 So it tells us basically what it was able to find. 415 00:22:11,040 --> 00:22:13,240 If you click those, it'll take you right to here. 416 00:22:15,500 --> 00:22:15,820 Cool. 417 00:22:15,840 --> 00:22:16,860 Lots of IPv6. 418 00:22:18,960 --> 00:22:21,440 And notice the Nmap scan results are being pulled in, too. 419 00:22:21,540 --> 00:22:24,020 So I've got, like, again, hard to see in the back. 420 00:22:24,040 --> 00:22:24,340 I apologize. 421 00:22:24,720 --> 00:22:29,380 But I've got the OS and things like that being populated there. 422 00:22:30,140 --> 00:22:32,320 And if you correlate it, it gets really interesting. 423 00:22:32,420 --> 00:22:33,300 Because you can see load balance. 424 00:22:33,300 --> 00:22:36,620 You can see load balancers very easily in front of these systems. 425 00:22:41,640 --> 00:22:42,120 . 426 00:22:45,520 --> 00:22:47,080 Yeah, really good question. 427 00:22:47,680 --> 00:22:51,640 Even with low numbers of iterations, maybe two, how do you avoid, you know, scanning Akamai? 428 00:22:51,800 --> 00:22:52,740 Really good question. 429 00:22:53,800 --> 00:22:56,240 Really boils down to looking at the DNS name. 430 00:22:56,400 --> 00:23:01,300 And if the DNS name says Akamai or Akamai Edge or, you know, one of a set of things. 431 00:23:02,160 --> 00:23:02,440 . 432 00:23:02,440 --> 00:23:02,600 Yeah. 433 00:23:03,600 --> 00:23:03,920 Exactly. 434 00:23:04,240 --> 00:23:07,220 So there's a prohibited list in this that's kind of built into it. 435 00:23:07,740 --> 00:23:08,800 I'd like to expose it. 436 00:23:08,840 --> 00:23:10,800 But I'm not sure exactly where to expose it yet. 437 00:23:11,200 --> 00:23:12,040 I'll show it to you. 438 00:23:14,140 --> 00:23:14,460 . 439 00:23:20,520 --> 00:23:20,840 Correct. 440 00:23:21,440 --> 00:23:22,440 I'm not sure who asked that. 441 00:23:22,540 --> 00:23:22,800 But yes. 442 00:23:23,000 --> 00:23:23,320 Yeah. 443 00:23:23,320 --> 00:23:23,760 Right on. 444 00:23:24,120 --> 00:23:24,440 Yeah. 445 00:23:25,580 --> 00:23:25,900 Yeah. 446 00:23:26,020 --> 00:23:31,660 And the idea of, like, when I get something, as long as I'm not at that depth, right, I'm not over my depth that I can't go further. 447 00:23:31,660 --> 00:23:34,460 Go ahead and do everything that you know to do for that particular entity. 448 00:23:34,820 --> 00:23:34,920 Right. 449 00:23:35,100 --> 00:23:35,260 So. 450 00:23:35,400 --> 00:23:35,520 Yeah. 451 00:23:40,500 --> 00:23:40,860 Tasks. 452 00:23:42,600 --> 00:23:42,960 Helpers. 453 00:23:43,180 --> 00:23:45,280 And then I think there's a prohibited list in here. 454 00:23:46,880 --> 00:23:47,240 . 455 00:23:51,980 --> 00:23:54,160 This is the list of stuff that I will not do. 456 00:23:54,980 --> 00:23:58,100 It basically comes down to, like, Akamai is a lot of that. 457 00:23:58,200 --> 00:23:58,540 Azure. 458 00:23:59,360 --> 00:23:59,720 . 459 00:23:59,720 --> 00:24:02,420 You just don't want to go into Azure's infrastructure. 460 00:24:02,600 --> 00:24:06,280 It's cool about infrastructure that sits on top of it and is DNSed appropriately for your company. 461 00:24:06,660 --> 00:24:09,500 But beyond that, you don't want to go scan the Internet. 462 00:24:10,700 --> 00:24:12,220 And this can be edited, obviously. 463 00:24:14,240 --> 00:24:15,820 Anyway, let me show you another demo. 464 00:24:17,760 --> 00:24:18,780 How am I doing on time? 465 00:24:18,880 --> 00:24:19,300 Am I close? 466 00:24:19,400 --> 00:24:20,680 Do I need to get kicked? 467 00:24:21,900 --> 00:24:22,300 Okay. 468 00:24:22,380 --> 00:24:22,620 Cool. 469 00:24:24,640 --> 00:24:25,280 Thank you. 470 00:24:25,300 --> 00:24:25,860 Thank you. 471 00:24:25,860 --> 00:24:26,420 That's my man. 472 00:24:26,500 --> 00:24:27,780 I appreciate that. 473 00:24:27,780 --> 00:24:29,120 He's like, whatever, man. 474 00:24:29,240 --> 00:24:29,760 I like it. 475 00:24:29,800 --> 00:24:30,500 You just do you. 476 00:24:30,940 --> 00:24:31,260 . 477 00:24:33,500 --> 00:24:34,600 I mentioned it's an API. 478 00:24:34,860 --> 00:24:36,020 You can also use it from the CLI. 479 00:24:36,060 --> 00:24:36,760 I have a demo for that. 480 00:24:36,900 --> 00:24:38,620 But this is a cool demo. 481 00:24:39,200 --> 00:24:41,640 Not a lot of people know about this. 482 00:24:41,740 --> 00:24:43,840 This is one of those, like, kind of fun ones that I like showing people. 483 00:24:44,280 --> 00:24:45,400 Again, it's small back there. 484 00:24:45,460 --> 00:24:45,760 I apologize. 485 00:24:45,880 --> 00:24:46,540 I'll talk you through it. 486 00:24:46,660 --> 00:24:48,400 We just opened up the URI spider module. 487 00:24:48,640 --> 00:24:49,520 And we're giving it a website. 488 00:24:49,680 --> 00:24:51,100 So I'm going to give it whitehouse.gov. 489 00:24:51,220 --> 00:24:51,880 Because why not? 490 00:24:52,560 --> 00:24:52,880 . 491 00:24:52,880 --> 00:24:54,520 And we'll give it some threads. 492 00:24:54,700 --> 00:24:55,200 Ten threads. 493 00:24:56,000 --> 00:24:56,640 Five threads. 494 00:24:56,720 --> 00:24:57,760 Because we're on a slow pace. 495 00:24:57,760 --> 00:24:57,840 It's a slow connection. 496 00:24:59,520 --> 00:25:01,480 Extracting DNS records, which is a pretty cool idea. 497 00:25:01,620 --> 00:25:04,820 So anything that matches .gov will actually get extracted out as a DNS record. 498 00:25:05,300 --> 00:25:06,520 Go ahead and give me email addresses. 499 00:25:06,660 --> 00:25:07,420 Give me phone numbers. 500 00:25:08,360 --> 00:25:09,420 Don't give me URIs. 501 00:25:09,420 --> 00:25:10,600 Because that will give you a lot of crap. 502 00:25:12,640 --> 00:25:13,920 And go ahead and run it. 503 00:25:15,300 --> 00:25:16,840 And it starts right away. 504 00:25:17,040 --> 00:25:18,520 So we found www, obviously. 505 00:25:19,660 --> 00:25:20,880 Even I can't read this. 506 00:25:20,940 --> 00:25:21,240 I apologize. 507 00:25:21,920 --> 00:25:23,260 Go.whitehouse.gov. 508 00:25:23,880 --> 00:25:24,680 Senate.gov. 509 00:25:25,180 --> 00:25:26,360 We found a phone number. 510 00:25:27,100 --> 00:25:27,500 . 511 00:25:27,760 --> 00:25:29,100 We found an email address. 512 00:25:29,660 --> 00:25:31,120 Karen Pence's email address. 513 00:25:31,740 --> 00:25:32,460 Thanks, Karen. 514 00:25:34,340 --> 00:25:36,760 Clinton Library, Nixon Library, blah, blah, blah. 515 00:25:36,880 --> 00:25:37,460 So you get it. 516 00:25:37,500 --> 00:25:45,700 It's basically scraping each page on the website, spidering, and then extracting out things that it knows about based on a rule matching engine. 517 00:25:46,380 --> 00:25:47,740 And all this stuff is extensible. 518 00:25:47,780 --> 00:25:51,200 It's pretty easy to write and to expand on it. 519 00:25:51,240 --> 00:25:52,860 But here's a cool one. 520 00:25:52,920 --> 00:25:53,920 That software package there. 521 00:25:54,840 --> 00:25:57,740 We found Adobe PDF Maker 11 for Windows. 522 00:25:58,760 --> 00:25:59,900 How do we get that? 523 00:26:00,120 --> 00:26:02,000 We actually parse PDFs. 524 00:26:02,020 --> 00:26:03,400 And pretty much any media file. 525 00:26:03,500 --> 00:26:05,100 There's this cool library called Tikka. 526 00:26:05,560 --> 00:26:07,620 And Tikka is super easy to embed. 527 00:26:08,180 --> 00:26:11,760 And so it fires off Tikka for each PDF we find. 528 00:26:11,900 --> 00:26:12,600 And we parse it. 529 00:26:12,640 --> 00:26:13,220 And we give you all the information. 530 00:26:13,420 --> 00:26:15,100 There's an EXIF that got parsed. 531 00:26:16,440 --> 00:26:18,740 So we just kind of grab everything and parse it if we can. 532 00:26:19,440 --> 00:26:20,880 And then store that data as JSON. 533 00:26:21,020 --> 00:26:23,080 So all of this can be grabbed as JSON, by the way. 534 00:26:23,200 --> 00:26:25,240 Like, literally, everything is available as a big JSON blob. 535 00:26:25,980 --> 00:26:27,460 So you can do whatever you want with it. 536 00:26:27,520 --> 00:26:27,740 That's pretty easy. 537 00:26:27,740 --> 00:26:28,240 That's that demo. 538 00:26:31,420 --> 00:26:32,920 And I'll show you the CLI quick. 539 00:26:33,040 --> 00:26:34,640 And then I think I'm getting kicked off. 540 00:26:37,300 --> 00:26:37,660 Yeah. 541 00:26:37,860 --> 00:26:38,200 Hey. 542 00:26:39,500 --> 00:26:40,760 We can continue in the hallway. 543 00:26:40,860 --> 00:26:41,120 It's cool. 544 00:26:42,160 --> 00:26:42,780 Seven minutes? 545 00:26:44,600 --> 00:26:45,560 All the time in the world. 546 00:26:46,220 --> 00:26:46,820 I love it. 547 00:26:48,260 --> 00:26:49,980 This is just hitting that same API. 548 00:26:50,240 --> 00:26:51,780 And I just listed out the modules. 549 00:26:52,280 --> 00:26:54,340 You can run it as a command line tool. 550 00:26:54,960 --> 00:26:55,820 It's a command line tool. 551 00:26:55,900 --> 00:26:56,340 It's built in. 552 00:26:56,740 --> 00:26:57,720 And I'm telling it to run. 553 00:26:57,740 --> 00:27:01,760 And I'm telling it to, in the default project, go ahead and kick off a subdomain brute force 554 00:27:02,260 --> 00:27:04,380 for whitehouse.gov. 555 00:27:08,180 --> 00:27:11,020 And make sure I got my syntax right. 556 00:27:13,740 --> 00:27:14,140 Cool. 557 00:27:14,200 --> 00:27:14,860 It kicks it off. 558 00:27:14,920 --> 00:27:19,280 It gives us the result ID, which we could pull as JSON and actually display it here. 559 00:27:19,340 --> 00:27:20,440 But it'll take a long time to complete. 560 00:27:20,660 --> 00:27:25,000 So the idea of web hooks, I'm building into it eventually, roadmap. 561 00:27:27,100 --> 00:27:30,360 And you see, it's kicking it off in the UI, and everything just works in the UI, too. 562 00:27:30,460 --> 00:27:32,960 So you can automate stuff via the CLI. 563 00:27:33,000 --> 00:27:36,760 You can automate stuff via the API if you want to build it into a pipeline of some sort. 564 00:27:37,440 --> 00:27:38,340 Anyway, that's that. 565 00:27:38,480 --> 00:27:40,280 I think I'll take questions if there are any. 566 00:27:40,740 --> 00:27:41,360 I'll leave it there. 567 00:27:41,520 --> 00:27:42,220 I've got a question in the back. 568 00:27:42,280 --> 00:27:42,580 . 569 00:27:43,440 --> 00:27:43,760 Yeah. 570 00:27:43,900 --> 00:27:44,120 Cool. 571 00:27:44,260 --> 00:27:45,600 And how can you get involved? 572 00:27:45,720 --> 00:27:45,900 Cool. 573 00:27:46,820 --> 00:27:48,400 I just roped you in, by the way. 574 00:27:48,500 --> 00:27:48,960 Thank you. 575 00:27:50,900 --> 00:27:51,220 Yeah. 576 00:27:51,380 --> 00:27:54,220 So actually, intrigue.io is the easiest way. 577 00:27:54,300 --> 00:27:54,980 It'll get you to the right place. 578 00:27:56,440 --> 00:27:58,880 And it'll help sort of steer you in the right direction. 579 00:27:58,980 --> 00:28:00,160 I did put my slides up here. 580 00:28:00,240 --> 00:28:02,000 If you're interested in those, I'll post the videos later. 581 00:28:02,620 --> 00:28:07,600 Hit the news thing, and you end up here on a blog. 582 00:28:07,900 --> 00:28:09,980 I guess I really like black and blue as a color. 583 00:28:10,040 --> 00:28:10,400 I don't know why. 584 00:28:11,400 --> 00:28:13,140 Getting started is probably where you want to go. 585 00:28:13,680 --> 00:28:17,020 Getting started with Intrigue on Docker or getting started with Intrigue on AWS. 586 00:28:17,440 --> 00:28:21,200 As I mentioned, there's quite a few dependencies in Postgres, Ruby. 587 00:28:22,060 --> 00:28:24,180 So managing these things are a pain unless you set up. 588 00:28:24,180 --> 00:28:25,340 Unless you're familiar with Ruby. 589 00:28:25,560 --> 00:28:28,880 So try to Dockerize it or give you an AWS image that you can just play with. 590 00:28:29,100 --> 00:28:29,740 Makes it easier. 591 00:28:32,000 --> 00:28:32,360 Yeah. 592 00:28:32,700 --> 00:28:33,640 So two questions. 593 00:28:33,800 --> 00:28:35,220 First, how can you do this? 594 00:28:35,780 --> 00:28:36,300 No, no, no. 595 00:28:36,300 --> 00:28:36,560 Go ahead. 596 00:28:36,620 --> 00:28:36,840 Sorry. 597 00:28:36,960 --> 00:28:37,900 I just happened to Zoom. 598 00:28:38,600 --> 00:28:39,120 You first. 599 00:28:40,200 --> 00:28:44,660 So first, how can you do this without Cloudflare wanting to rape you and, like, blocking everything? 600 00:28:44,940 --> 00:28:48,860 How can I do this without Cloudflare blocking me and doing other really bad things 601 00:28:48,860 --> 00:28:49,140 to me? 602 00:28:50,460 --> 00:28:51,560 Well, I mean, listen. 603 00:28:51,560 --> 00:28:55,580 Every hosting provider has their rules about scanning. 604 00:28:55,720 --> 00:28:58,620 Every hosting provider has their rules about what you can and cannot do. 605 00:28:58,680 --> 00:29:00,160 Some are more friendly than others. 606 00:29:01,180 --> 00:29:04,400 As long as you're talking to the AWS folks, they're really cool. 607 00:29:04,660 --> 00:29:07,800 Their security team is pretty cool with the idea of research. 608 00:29:08,640 --> 00:29:10,700 Linode is another that's really good with research. 609 00:29:11,460 --> 00:29:14,400 And so as long as you choose a provider that's open to these things and you're not doing 610 00:29:14,400 --> 00:29:19,140 anything terribly malicious, you're kind of surveying data, you can find people that are 611 00:29:19,140 --> 00:29:19,300 good. 612 00:29:19,360 --> 00:29:19,540 Yeah. 613 00:29:19,540 --> 00:29:19,640 Yeah. 614 00:29:19,700 --> 00:29:21,120 That was my second question, actually. 615 00:29:21,520 --> 00:29:23,260 Nmap has two different modes. 616 00:29:23,360 --> 00:29:26,340 Like, there are some that are actually offensive in nature and there are some that are more 617 00:29:26,340 --> 00:29:27,600 passive and can cause damage. 618 00:29:27,900 --> 00:29:32,680 Does this have anything in it that, when running against a target, would cause problems 619 00:29:32,680 --> 00:29:34,560 where, like, something would crash, et cetera? 620 00:29:35,420 --> 00:29:37,220 It's mostly meant for the external side. 621 00:29:37,300 --> 00:29:38,760 At this point, I haven't done a lot of testing internally. 622 00:29:38,880 --> 00:29:42,720 So the short answer is I'm not super aggressive with my scanning settings. 623 00:29:43,260 --> 00:29:45,260 Like, there's a pretty good balance in there. 624 00:29:45,540 --> 00:29:45,940 Yeah. 625 00:29:46,000 --> 00:29:47,600 We're certainly not trying to knock systems over. 626 00:29:48,680 --> 00:29:49,080 Yeah. 627 00:29:52,520 --> 00:29:52,880 Yeah. 628 00:29:52,880 --> 00:29:53,120 Yeah. 629 00:29:55,240 --> 00:29:57,960 So I stayed away from social media for a long time. 630 00:29:58,040 --> 00:29:59,160 I need to actually build it in. 631 00:29:59,280 --> 00:30:00,820 The short answer is I'm going to say roadmap. 632 00:30:00,980 --> 00:30:02,700 There's a little bit of stuff in there today. 633 00:30:04,600 --> 00:30:06,360 Let me actually just pull it up and show you. 634 00:30:13,200 --> 00:30:14,340 And I haven't tested this. 635 00:30:14,360 --> 00:30:15,420 This is truly a live demo. 636 00:30:16,020 --> 00:30:17,220 Phone number lookup. 637 00:30:17,220 --> 00:30:17,660 Let's see. 638 00:30:17,740 --> 00:30:18,320 What was I going to do? 639 00:30:18,700 --> 00:30:19,060 Okay. 640 00:30:19,060 --> 00:30:21,100 Let's create a person first. 641 00:30:23,140 --> 00:30:24,160 Anybody volunteer? 642 00:30:24,560 --> 00:30:25,040 Donald Trump. 643 00:30:25,100 --> 00:30:25,820 Donald Trump. 644 00:30:25,900 --> 00:30:26,120 Yeah. 645 00:30:26,340 --> 00:30:27,420 I like it. 646 00:30:30,940 --> 00:30:32,000 Donald Trump. 647 00:30:32,160 --> 00:30:33,480 And we're not going to do any iterations. 648 00:30:34,180 --> 00:30:35,000 Do that. 649 00:30:35,820 --> 00:30:36,760 Click this. 650 00:30:39,720 --> 00:30:40,800 And web. 651 00:30:40,860 --> 00:30:42,040 I can do a web account check. 652 00:30:42,240 --> 00:30:43,540 It's not that great. 653 00:30:43,660 --> 00:30:46,640 I need to actually do more searching and scraping of social media. 654 00:30:46,860 --> 00:30:48,280 We'll say roadmap on that. 655 00:30:48,400 --> 00:30:48,880 All right. 656 00:30:48,880 --> 00:30:49,040 All right. 657 00:30:49,540 --> 00:30:49,860 All right. 658 00:30:49,860 --> 00:30:50,600 But here, I'll show you. 659 00:30:50,600 --> 00:30:51,380 You can search Bing. 660 00:30:51,680 --> 00:30:54,240 Oh, also, I should show you the configuration for this stuff. 661 00:30:59,760 --> 00:31:00,860 Oh, am I out? 662 00:31:00,920 --> 00:31:01,660 I'm getting kicked out. 663 00:31:01,720 --> 00:31:01,900 Sorry. 664 00:31:02,120 --> 00:31:03,080 Last thing then. 665 00:31:05,040 --> 00:31:06,160 Configuration is super easy. 666 00:31:06,820 --> 00:31:07,720 It's all built in here. 667 00:31:07,780 --> 00:31:08,520 You just click this thing. 668 00:31:08,700 --> 00:31:09,780 Go sign up for the key. 669 00:31:10,120 --> 00:31:10,720 Come back. 670 00:31:11,040 --> 00:31:11,600 Plug it in. 671 00:31:12,280 --> 00:31:13,260 Let's see which one that was. 672 00:31:13,420 --> 00:31:14,360 That was data.gov. 673 00:31:14,520 --> 00:31:16,880 I tried to send you to the right place so that you can just sign up for a key and make 674 00:31:16,880 --> 00:31:17,180 it easy. 675 00:31:17,420 --> 00:31:18,880 You don't have to have every key. 676 00:31:18,880 --> 00:31:20,100 Models will work without them. 677 00:31:20,240 --> 00:31:21,260 Try to fail gracefully. 678 00:31:22,440 --> 00:31:22,760 That's it. 679 00:31:22,840 --> 00:31:23,080 All right. 680 00:31:23,100 --> 00:31:23,540 I'm kicked out. 681 00:31:23,620 --> 00:31:23,860 Cool. 682 00:31:24,320 --> 00:31:24,600 Awesome.