start	end	text
13280	15760	All right, everyone, welcome back.
16080	18660	If you're just joining us here in the AppSec Village,
18660	22100	I hope you are ready for a fantastic talk.
22100	24780	If you're still hanging around from the last talk,
24780	27100	glad to have you back. This is going to be awesome.
27180	30840	I wanted to take a few minutes to thank everybody
30840	35380	who helped to put on DEF CON this year.
35440	38540	I know this has been very challenging for people.
38540	41060	It's challenging for us at home.
41060	44260	It's doubly challenging to bring
44680	48240	a great conference experience to DEF CON.
48240	50260	And we really hope that comes through.
50260	53300	Also take a minute to thank the AppSec Village.
53320	56500	Some people have put in amazingly long hours
56500	58860	to make this stuff happen.
58940	62020	And we want to thank them as part of that.
62540	64820	Additionally, if you want to get a shirt,
64820	67440	head over to the AppSec Village website.
67440	69060	You can purchase your shirt there
69060	75060	for the second incarnation of the AppSec Village.
76280	78440	So for our next talk, we've got Paul Abar
78440	82760	and Stanislas Malveaux talking to us
82760	85820	about turning the offensive security mindset
85820	88820	into a developer's toolbox.
89960	92440	Hi. Hello, everyone.
92440	95200	Thanks for joining our presentation,
95200	97920	which is going to be today about our journey
97920	102940	into turning offsec mindset to developer's toolset.
103560	107360	This presentation, we're going to be two of them doing it.
107680	111300	And it's going to be in what we can say three parts.
111420	114240	First one is going to be about a tool
114240	116840	that we created inside our company,
116840	118580	which is called ChopChop.
118580	121000	And we will come to what happened,
121000	123480	what was the context, what was the need for it,
123480	125620	and that we're going to explain what happened.
126100	128860	The second one is how did we want to
129480	132940	broaden our audience into having more and more
132940	135920	and more people using it, and especially developers.
136160	137820	And the last part is going to be the demo
138340	140160	that we're going to do with Stanislas,
140160	143200	who is here just next to me, and who's going to do it.
143220	145860	So three parts in trying to explain our journey
145860	149020	into how we tried at least to achieve it
149020	151200	and some of the mistakes, drawbacks,
151200	153000	and things that we learned on the way.
153000	155740	So hopefully, we hope that you're going to learn
155740	157560	something about it.
158160	160020	All right, let's start.
160520	164760	This graph, we actually took it from CVE details.
164760	167560	And it just shows the number of vulnerabilities
167560	170280	and numbers of CVEs that we got
170960	174840	starting from a couple of years back to basically now.
174840	176880	So we took this graph last year,
176880	181960	and we can realize that between 2016 to 2017,
181960	184300	the number of CVEs just doubled.
185060	187220	And this is something that we can see.
187220	190560	Every day and every week, we get new vulnerabilities coming in.
190560	193920	We get Oracle built-in, which is just full,
193920	196140	and hundreds of vulnerabilities are inside.
196140	198480	We also get built-in of Microsoft,
198480	202060	which are just showing up hundreds of vulnerabilities,
202060	204440	or let's say dozens of vulnerabilities each month.
204440	206600	And this is something that's growing, obviously,
206600	209020	and we're hearing a lot about this.
209060	211760	And in the last couple of days, last couple of weeks,
211760	215280	we got a number of vulnerabilities during the lockdown,
215280	218500	which was just massive, and especially critical vulnerabilities.
218500	220940	So this is something that we can feel,
220940	224020	and this is getting really, really big.
224380	226540	And when we're taking those numbers,
226540	229860	we realize that just by dividing it by 52,
229860	233200	the number of weeks that we have per year,
233200	238480	we realize we get something like 319 new vulnerabilities.
238480	242660	And this is the number of new vulnerabilities that we get per week.
242660	246320	And this is huge, huge for a team to just realize
246320	249560	that we do have to process all this information.
249560	255660	So bear in mind that we are not affected by all those vulnerabilities at the time,
255660	259340	but it really depends on your context, on our context,
259340	262420	on your customer's context, and so on.
262420	266900	But this is something, some information that needs to be digested by your teams
266900	270580	to just realize if you're affected or not,
270580	272680	and if you're vulnerable to it or not.
272680	276760	And this is a huge thing to actually realize and to process,
276760	281380	especially depending on the size of your team.
282000	286620	And usually when we get a new vulnerability, like the MS17010,
286620	291880	or let's say the new vulnerability for the DNS remote card execution on Microsoft,
291880	293780	which happened a couple of weeks ago,
293780	298980	we usually get the management, because they hear a lot about this on Twitter,
298980	302180	on specific magazines, on specific websites,
302180	303920	and they actually hear about like this,
303920	307100	and there's like a really big buzz around those vulnerabilities.
307100	310840	And usually they're coming to the security team and just asking,
310840	315620	all right, are we affected by this vulnerability or this other one that we heard about?
316280	320160	And this is something that, well, we can understand it, obviously.
320160	325060	And the problem with this is we get to the point where the security team is overwhelmed
325060	329740	by the number of new findings that happen each day.
329740	333660	And you get like a backlog, which is full of things that you need to process,
333660	336800	and it turns out that the management is coming and coming and coming again
336800	339820	to just like ask if we are vulnerable to this,
339820	343680	to just answer to the management, to the executive, and so on.
343680	347620	So something to bear in mind, and this is part of the context that we are in
347620	353160	and why we actually had like this old tool ID, and we started like getting this.
353160	356200	So the context was based on this.
356820	360360	So the problematics we had was something circa 2016,
360360	364240	when we started having like this kind of philosophy and mindset.
364240	370560	And the idea was we had thousands of servers and domains that had to be scanned daily.
370620	375660	We wanted to scan them to basically for statistics reason, KPI,
375660	381300	and having some like fresh data, because obviously as soon as you do a penetration test
381300	386440	or any kind of testing, we can consider the test outdated a couple of hours
386440	388620	or let's say a couple of days afterwards.
388620	394220	So we wanted to have like fresh data all the time, and daily fresh data.
394440	401460	Second of all is we did not have direct access to the servers in some specific situations.
401460	407800	And this was based because the servers were materialized, because it was managed by other entities,
407800	410120	and a couple of other reasons that we had.
410120	414480	So we didn't have like SSH access on all the machines all the time.
414480	419420	So this is why we needed to have like another way into assessing the security of the applications
419420	425280	that were exposed on the internet, inside as well in the network,
425280	428420	and really we had like a really big context with this.
428420	433980	And we can see that the situation is quite pretty similar to what we can call black box penetration testing,
433980	438600	which means that we don't have like administration access to the server,
438600	442680	and that we need to like find other ways to qualify and to have an ID
442680	446900	if we are vulnerable to this specific value.
447200	450500	The tech landscape that we had was also unclear.
450720	457740	In 2016, 2017, there were a lot of vulnerabilities, especially with WebDAV, if you can remember.
457740	461680	It was like quite a hot topic at the time, but also with struts,
461680	466540	because there were a couple of critical vulnerabilities which happened in a couple of days.
467220	472420	So these were the things where, okay, there's a huge vulnerability with struts.
472440	475100	Are we vulnerable to it? Yes, no.
475100	481200	And can we quantify the number of servers which might be potentially vulnerable to this?
481200	484600	And the last point, but not least, is interesting.
484600	488440	And speaking of which, it's like this lean security, all right?
488440	495340	And it's the idea of ability to perform checks every time, so again and again.
495340	499580	So basically, this kind of like loop, this lean loop that we can have,
499580	503020	where we would be able to like spot security regression.
503680	508620	And this remembers like a cool anecdote, if we can say it this way.
508620	514520	There's one company, quite big company, having a bug bounty program.
514940	522660	And after speaking with them, they actually told us that they paid some really good bounty
522660	528280	for a specific researcher who found remote code execution on some of the production servers.
528280	529620	They fixed it.
529780	535980	But unfortunately, a couple of weeks later, they redeployed the same vulnerable component.
535980	538920	And another bounty researcher found it.
538940	543040	And they had to pay twice for the same vulnerability that they had,
543040	547180	that they had already patched, and that they already paid one researcher for it.
547180	550360	And this is what I'm going to call security regression.
551340	556160	When we're taking the tech and like the developer landscape,
556160	561520	unit testing is actually one of the foundations of any kind of like new development.
561520	569400	And I think that like this specific mindset and security regression should definitely be something
569400	577620	that we could put on our top priority, just to make sure that we get all those regressions as soon as possible.
577920	583020	We have everything automated right now. We do have like a lot of pipelines for our developers.
583020	585880	Everything is going faster and faster and faster.
585880	589780	And I think that we can improve our way into this.
589780	595060	And this is some of the reasons why we created our tools, and we wanted to tackle this issue.
595060	598640	Security regression was one of the big parts.
599000	600780	So this was our context.
601560	607220	The needs that we have, so needs from the field, and this was again from like 2016,
607220	614140	we had to assess new vulnerabilities, new risks coming in, and we had to do this quickly.
614140	621180	So yeah, 2017, we had Struts, we had RCE, so Remote Code Execution on Drupal.
621260	625960	We had WebDAV, we had like lots, a lot of things happening, obviously.
625960	630200	And we had to process this as fast as we could.
630360	636280	So this was one thing. The other one was, we had like a small team working on this.
636400	640100	When I'm speaking of small teams, it was three to four people.
640100	646640	All of them were all security-oriented, which is really important for the rest of the journey,
646640	650240	because this started introducing some bias,
650240	655780	which means that we were security people working with security tools that we wrote,
655780	660980	and we were more or less like in our circle and in our comfort zone,
660980	666840	which means that when we started and wanted to deploy to other population and other kind of people,
666840	672140	developers, devops, it turns out that we had some interesting gap, I would say,
672140	679200	and those bias that we introduced, we're going to try to give you the mistakes and how we tackle these issues.
679200	681860	But never mind, we will come back to this later on.
682420	687740	So we needed a tool which would be fast, so something where we could just say,
687740	693520	okay, here is the new vulnerability, run it across all our parameters and see if we get a hit.
693520	696840	The second one was having something reliable.
696840	702240	And when we say reliable, it's mostly interesting for the deterministic return,
702240	709800	which means that if we would run the tool twice, we would make sure that if it hits, it would hit again.
710080	715600	So there would be nothing random in the processing.
715600	719440	So we would know exactly how the rules would be triggered.
719520	724000	And if we would run it twice, we should have the same output, obviously.
724260	728280	And the last point, but not least, would be no false positives.
728480	732600	So it's interesting because we need to find like a threshold, right?
732600	735040	We need to have like a tool super fast.
735040	740560	But on the other hand, we don't want any false positives, which is really hard to combine all together.
741580	747540	So it's two criteria, which unfortunately don't really work together.
747740	752520	But we think that we did quite a great job, and this is something that we managed to do.
752620	757740	And considering that a hit, chop chop hit, would be a real hit,
757740	761580	which means that if we get something in the output, in the console output,
761580	768640	we would have to open an incident, call someone, or start doing like an immediate action, right?
768640	772280	And not having like a lot and lot and lot information to process.
772360	776160	So really trying to like do some kind of like sniper thing,
776160	780120	and just making sure that we get to what's really valuable.
780260	784640	So those were our needs, and yeah, trust me, we had a lot of them.
785660	792760	So if we can take an image, an analogy, it would be like more or less like going to the jungle, right?
792760	796320	And it would be like something where we would just have like a machete,
796320	802140	and like start just like chopping trees to try to like create a path in like the jungle,
802140	805000	so that we could reach our destination point.
805020	807340	But this was like more or less the case.
807360	812220	As you saw beforehand, it was more or less like an approach of like black box testing,
812220	816040	where the tech landscape was a bit unclear.
816140	822060	We didn't exactly know what we were doing, and what we wanted to do is like creating hypotheses,
822060	827220	and trying to see if it would be valuable for our context.
827220	830620	And making sure that the tool that we released, and that we get,
830620	833700	would be something also valuable for other organizations,
833700	837300	so that they could customize it for their own environments.
837300	842140	This was like mostly like the whole soul of the application.
842140	846040	So yeah, this analogy, really the analogy of jungle,
846040	849720	and having something where we would have to like start chopping trees,
849720	853380	and making sure that we're not in danger.
854760	857860	So we were saying chop-chop, chop-chop, and what does it mean?
858460	861700	It's actually a funny name, and it's something coming from Cantonese,
861700	866920	which means hurry, and suggest to do something like without delay and right now.
866920	872940	So we thought the name was interesting, and exactly what was like the spirit of the tool.
872940	874840	So this is why we called it chop-chop.
874840	879600	We wanted to have like a tool where if an emergency alert was coming in,
879600	884870	we would be able to like respond right now, and having results in no time.
885160	889100	So it was the whole soul, and this is why we kept the name chop-chop,
889100	891420	and released the tool with this name.
891960	896820	The tool initially back in 2017 was written with Python.
896820	900720	We started with Python 2.7, then migrated to Python 3.
900720	904420	We got everything working, and following the upcoming month,
904420	908720	we started getting plugins that the security team mostly wrote.
908720	912060	And in the end, we came up with 80 plugins.
912060	915220	So 80 things processing, which were done.
915440	920620	Going from trying to find if there was like a .git folder exposed on the internet,
920620	923420	or let's say in the web root, accessible in the web root,
923420	927180	to also like checking if the RDP port was also open,
927180	930660	checking if the port was here, and was just responding.
930720	933700	A couple of things like this, and we started like creating plugins,
934300	936580	which were specific to our environment.
936580	941420	Those ones were not released, but this gives you the idea of the flexibility of the tool.
941420	945580	So taking a domain name or an IP, and afterwards doing some processing.
945580	948020	And any kind of processing, basically.
948440	952640	As I said, it was mostly doing things with HTTP,
952640	956120	and this was like the whole soul of the application at first,
956120	961660	but then afterwards, people started integrating new protocols and new modules
961660	964200	to start interacting with other services.
965500	970080	So we had everything running, the ability to run scans daily,
970080	972640	with what we called deterministic wizards,
972640	976380	which was one of the things we were really eager to have.
976380	981940	So daily scans, basically every day, and allowed us to answer two questions.
981940	984520	The first one would be to answer to the management,
984520	986700	are we affected? Yes, no.
986700	991040	And then afterwards, being able to quantify the number of servers,
991040	995820	or number of IPs, which were actually affected with this specific vulnerability.
996260	998880	Is it going to be one? Is it going to be 100?
998880	1002540	Is it going to be dozens, hundreds, thousands?
1002540	1005480	Is it going to be all the servers at once?
1005500	1009600	So it's actually quantifying the results, and we were able to do this.
1009600	1014040	So we would count every console output, every line we would get,
1014040	1018160	and we would have an idea of how many servers would be affected.
1018160	1023480	And this allowed us, and this saved us a lot of time.
1025040	1028740	As I said, ChopChop initially was written in Python,
1028740	1031720	and this is an example of a plugin that we wrote,
1031720	1034900	and this one is to try and check,
1034900	1041320	ensure that the git.git repository, .git folder, is not exposed in the web route.
1041340	1043620	So what it's going to do, it's quite simple,
1043620	1049420	it's going to test on port 80 and on port 443, in HTTP and HTTPS,
1049420	1054220	and it's going to check one specific path, which is going to be .git slash config,
1054220	1058580	and it's going to check for one specific word to appear in the HTTP response.
1058720	1063620	Based on this, we're going to have a severity, which ranks from 0 to 10.
1063620	1066780	10 is going to be critical, 0 is going to be informational,
1066780	1071320	quite similar to what we can find with the CVSS code, something similar.
1071320	1075160	Again, this thing, we will talk about this later on,
1075160	1080260	but we changed it in the new version of ChopChop for particular reasons,
1080260	1085320	and because we thought that having this specific range would be way too far
1086000	1089420	and way too lot of information to process,
1089420	1094700	and based on the audience we wanted to reach, this is something that was a bit useless.
1094740	1096600	But we will come back to this.
1096600	1104800	We had a description, ensuring that the git repository is not accessible from the web root,
1104800	1108020	and one fix, what we can call remediation.
1108400	1112980	And it was really important for us because afterwards, after using it and using it,
1112980	1118100	we started getting people and non-security people using the results of ChopChop.
1118100	1123680	And it turns out that some of them were lost by just having an Excel file or anything like this,
1123680	1127880	just an output, ChopChop output, just didn't know exactly what to do with this.
1127880	1132200	So we started implementing remediations to give some insights and some inputs,
1132200	1137660	so that people could work on their own by just giving them a bunch of pieces
1137660	1141220	so that they could start working on the remediation and mitigation.
1141640	1147640	So this is the kind of plugins that we had, written in Python, giving you some information,
1147640	1152480	so you just had to inherit from the plugin class that we had.
1152480	1159400	And afterwards, you would just have to override a couple of things and you would be start to go.
1160740	1165720	Here are some things that we managed to find on production systems.
1166000	1171880	So for example here, we managed to get repository access for SVN with some files, wc.db,
1171880	1177060	which allowed us afterwards to basically fetch anything from the SVN repository,
1177060	1180080	and afterwards getting the source code and so on.
1180080	1181620	So this was quite problematic.
1181620	1188400	We also had things like htpassword, which was not interpreted by the application server,
1188400	1192080	for some reasons, misconfiguration, things like this.
1192080	1194300	But this is something that we managed to show.
1194520	1200500	And the idea was having hypothesis and trying them across a larger scope,
1200500	1202980	depending on the scope that you have.
1202980	1208520	But this was the idea, having a hypothesis, taking things maybe from the bug bounty,
1208520	1210880	we were speaking about bug bounty beforehand,
1210880	1216720	so just checking things that bug hunters are trying on large scopes.
1216720	1220970	And you will see in the reference that there is a nice talk from James Kettle,
1221500	1225940	Cracking the Lens, which is some research that he did in 2017.
1225940	1230560	It's something quite similar to what we tried as well, and we got inspired.
1230560	1232720	So this is why it's going to be in the references.
1232820	1237580	And if you haven't seen the article, feel free to reach out and just check it out.
1237580	1239060	It's absolutely awesome research.
1239060	1242540	Even if it's 2017, absolutely awesome and just gold.
1242540	1246400	So feel free to get it afterwards, and you will get it in the slides.
1246460	1248280	So these were some things that we were trying.
1248280	1250440	All right, maybe it's not going to be interpreted.
1250520	1251720	Well, what do we lose?
1251720	1255840	Just maybe writing a couple of lines of code and seeing if it's going to match
1255840	1257820	and if it's going to trick somewhere.
1258420	1262760	Fortunately for us, it tricked, and we managed to remediate it in a couple of hours.
1263280	1266340	But also, internal information disclosure.
1266340	1270540	So here we had the server status page, which gave us some information.
1270540	1272640	Nothing super critical, but still.
1272640	1280140	It could give URI, so basically endpoints, and maybe some kind of internal endpoints.
1280140	1285380	But it was also giving some ideas about the IP address range that we were using internally.
1285380	1290500	So those kind of things that we didn't want attackers to have on their hands.
1290500	1296220	We wanted to try this across all our servers again, and finding them.
1296220	1299300	So this is the kind of things that we managed to find.
1300820	1306220	Last but not least, here is, for example, with the wildcard.
1306460	1311760	So basically some cross-domain.xml files, which are way too permissive.
1311760	1316280	Way too permissive, allowing anyone to just craft some payloads
1316280	1320400	and being able to start discussing with our website.
1320400	1324520	Might be afterwards stealing some cookies, stealing some information.
1324520	1328060	And we wanted to just trigger it on all our parameters.
1328060	1330740	This is something that we managed to find.
1331000	1333280	One rule, doing it all.
1334340	1338480	It worked pretty well, and we were really happy with this.
1340320	1343760	So now, what we had was a hypothesis.
1343760	1351240	We had a tool written by a security team, used by security people, and it was working.
1351240	1353780	We were happy, everything was good.
1353900	1357140	But then afterwards, we wanted to try the extra mile.
1357140	1360380	And the extra mile was actually a couple of extra miles.
1361360	1367700	And by saying this is, okay, we had our internal tool, and we wanted to make it available to everyone.
1367700	1370900	And what we mean by everyone is mostly developers.
1370900	1378160	As soon as having a tool, that they could integrate into the pipeline, and in the CI-CD pipeline.
1378160	1384260	So this was our goal, and basically the polar star that we were trying to target.
1384960	1389980	And it turns out that the first issue that we found was actually based on communication.
1390200	1393240	Developers don't necessarily get security things.
1393240	1394840	It's one of the golden rules.
1394840	1396840	But same as the other way around.
1396840	1402780	Which means that we're coming with our needs, we're coming with our ideas, with our beliefs.
1403120	1404780	Developers come with theirs.
1404860	1409020	And it turns out that we need to find a way on how to get a line.
1409440	1415840	We found this interesting thread on Twitter, so we're not shaming anyone or doing any kind of finger pointing.
1415840	1418560	But we think that it's an interesting thing.
1419300	1427240	So we got someone on Twitter basically showing and giving some idea about past experience, and started using acronyms.
1427240	1433080	IR, especially if you're working in security, this is something which stands for incident response.
1433080	1435780	And this is perfectly understandable.
1435980	1442280	But it turns out that in the comments, we got some people where IR didn't mean anything.
1442280	1448760	So people started looking up and found that it was an acronym maybe for infrared cameras.
1448760	1456900	And it's something that if this person doesn't know the acronym, there's some issue with the communication.
1456900	1461180	And we need to find a way into achieving and finding a bridge between them.
1461180	1467020	And the last picture is just showing on the right that everyone is right.
1467520	1471160	Everyone is right based on what they're looking up.
1471160	1480320	But it's just that we need to get those two people aligned to make sure that they can move forward and they can move together in the same direction.
1480540	1484080	Security is not against developers. Developers are not against security.
1484080	1486760	I think both of them can work together.
1487080	1493380	But just trying to get the same beliefs, at least on some very specific topics.
1495040	1501560	So yeah, interesting things about the communication channel and speaking the same language.
1502200	1506340	And when it comes to security, it comes with a lot of details.
1506340	1510040	SSTI, XSS, XSE, SQLI.
1510040	1512680	But also when we're speaking about CVEs.
1512680	1516860	So we get thousands of CVEs as we saw earlier.
1516860	1522160	But also MS-Beltane, MS-08, MS-067.
1522160	1525580	But we also have a name of vulnerabilities.
1525580	1528440	Heartbleed, Eternalblue, Bluebone.
1528440	1533080	And this is a huge referential that we do have in security.
1533080	1534660	Absolutely crazy.
1534660	1540640	And the thing is, security people are actually losing track of all this.
1540640	1542500	It's so much information.
1542500	1544800	We have so much information to process.
1544800	1548280	So yeah, we have those named vulnerabilities.
1548280	1549400	They have websites.
1549400	1550180	They have videos.
1550180	1552660	They have almost like choreography and things.
1552900	1557880	But also like all the names of vulnerabilities and classes, vulnerability classes that we have.
1557880	1560080	So much information to digest.
1560080	1565280	It's already hard for security people and people working in this for day long, right?
1565280	1567680	And who have been doing their careers in this.
1567680	1568980	But what about developers?
1568980	1571620	How can developers keep up with this information?
1572080	1577420	When we just like giving them a report, some of them might just be, I'm just completely lost.
1577420	1578380	I'm just completely lost.
1578380	1579620	I have no idea what this means.
1579620	1586820	I can see this presentation, but I might look like a fool if I just ask the question, what is this acronym for?
1587120	1594600	So it's some information that we need to take care of and just making sure that we get the interesting bits to developers.
1595600	1600620	And there's actually another question, and we're not getting to the debate, maybe afterwards in the Discord.
1600660	1604120	But should developers keep up with all this information?
1604680	1605540	Should they?
1605660	1606700	And I don't know.
1606700	1609320	But I don't have the information so far.
1609320	1610140	I don't know.
1610140	1616200	I have my opinion, but I'm happy to discuss and to chat about this afterwards in the Discord with you all.
1616760	1622940	So a lot of information of process, a lot of vocabulary that we need to take care of.
1624760	1636700	The second part was, all right, if we get a chop-chop hit and the application is flagged because of some reasons, maybe some plugins got in and so on.
1636700	1637720	Now what?
1637720	1640420	Now what is going to do the developer?
1640960	1642200	I don't know.
1642400	1644360	It just is that there's a URL.
1644360	1646140	It's giving some information.
1646140	1647680	But what is he going to do about this?
1647680	1648860	What is the risk?
1648880	1652740	And what is the kind of remediation he can put in place to mitigate this?
1652740	1655720	But he needs to understand the risk and what can happen.
1656140	1659880	What are the bad things that can happen with this specific thing?
1659880	1664280	And in his environment and in his context, right?
1664500	1667060	So security vocabulary is one thing.
1667060	1668800	But remediation is another one.
1668800	1676040	And bringing remediation in the tool and giving this capability is actually like bringing assistance to the developers.
1676040	1680260	Which means that we're going one step forward to them, towards them.
1680260	1684300	And what's going to happen is developers are going to come to us as well afterwards.
1684300	1686840	And it's going to be a win-win discussion.
1686860	1692020	And everyone's going to be aligned against just having secure application, running production.
1692020	1694480	And everyone's going to be happy with this.
1694480	1698180	So bring anything valuable as soon as you have a hit.
1698180	1701340	And that you have something that's actually triggering in your environment.
1701340	1704760	So it could be a link to whatever, what kind of explanation.
1704760	1707920	It could be like a research document. It could be anything on Twitter.
1707920	1710180	It could be just a thread, whatever.
1710180	1712940	Or it could be also a pointer to internal resources.
1713060	1716900	Do you use the OWASP ASVS, for example?
1716900	1719760	So maybe that could be a link to the specific section.
1719760	1723900	And just referencing it so that developers could start getting information.
1723900	1727180	Developers are super curious as security peeps.
1727180	1732100	So I think it's a good opportunity to have this discussion and this conversation with them.
1732100	1738220	So yeah, just bringing assistance and helping them into achieving better security within their application
1738220	1741960	by giving them as much inputs as we can.
1742920	1746170	Another part is contextualization.
1746560	1749900	And contextualization is also key.
1750160	1753090	Again, I'm not going to go into debate.
1753090	1758030	And I think that this is something like a question that you might have to ask yourself.
1758450	1763470	Should we consider the same criticity if we get a chop-chop hit
1763890	1766110	for one machine which is exposed on the Internet
1767350	1771990	and one machine which is completely air-gapped in a segregated environment
1771990	1776610	where only two people are reaching the application and this specific server?
1777230	1780010	It might be some kind of trade-off that you need to find.
1780010	1781650	Maybe it's finding some balance.
1782310	1786510	Because if you start answering yes, this is exactly the same criticity,
1786510	1792110	the same exploitability, it might just start giving red flags to developers.
1792110	1794250	Because everything is going to be critical.
1794750	1797490	And based on this, developers have a lot to deal with.
1797630	1800410	Production errors. They have a lot of development.
1800410	1803950	They have deadlines. They have a lot of work that they have to do.
1803950	1807410	And if we start getting security tasks on top of it,
1807410	1809670	they're going to start getting overwhelmed.
1809670	1811770	And having too much information afterwards,
1811770	1814970	they're not going to be able to process any of it.
1814970	1820870	So this is why I think it's a trade-off about what we try to achieve with them
1820870	1824850	and what's the image that we want them to perceive from us.
1824850	1828310	So balance and trade-off are now part of the game.
1830650	1834670	Last but not least is about collaboration.
1834750	1839050	And we truly believe that collaboration will empower your organization.
1839050	1843990	And by saying this, it's like finding the best tools to do it.
1844230	1849250	So for example, a lot of people, when we released ChopChop in June,
1849250	1852770	we had a lot of people asking us, what's the difference with Nikto?
1852930	1859110	And we are users of Nikto, we find it absolutely an amazing tool, and it works greatly.
1859110	1863210	But it works greatly especially for security-oriented people.
1863630	1867310	Because it's going to give you usually a lot of output,
1867310	1869970	but afterwards you're going to start to have to dig in.
1869970	1872550	You might have between one line and the other,
1872550	1876650	something which is going to be informational and another one which is going to be critical.
1876650	1881890	But this is going to depend on your experience, on what you think about it,
1881890	1884790	and you're going to have to do those choices on your own.
1885250	1887370	Are the developers going to be able to do it?
1887370	1891950	It might not be possible because they might not know anything about security.
1891950	1898630	So this is why we want to help them by doing some kind of triage in all those findings,
1898630	1900750	and providing them good inputs.
1900750	1904530	So finding the best tools to do this is extremely important,
1904530	1907010	and some of them might be tailor-made.
1907370	1910270	So something definitely to bear in mind.
1910630	1915150	Second of all is making sure that the learning curve that you're going to have,
1915150	1917590	if you're looking for people to collaborate,
1917590	1924130	which means writing new rules, helping, maybe doing a pull request on your project,
1924130	1926170	and doing this kind of collaboration,
1926170	1931530	make sure that the learning curve that people are going to have to start digging in the codebase,
1931530	1934030	that's not going to be something too crazy.
1934650	1941570	Usually, when we speak to developers, they find the security quite mystic.
1941570	1945290	It's like some kind of black magic happening behind the scenes.
1945290	1948230	They're using some weird commands and so on,
1948230	1955570	and this is why if we start putting on the shelf a new application that we want people to start playing with,
1955570	1957750	that they start collaborating with us,
1957750	1963050	we need to make sure that this is mostly friendly to new people coming in security,
1963050	1965850	and writing tools, and writing rules, and so on.
1965850	1967530	So something to bear in mind.
1967910	1971290	And again, this depends on the context where you're in,
1971290	1974530	which means if your developers are using YAML,
1974530	1976010	in this case, go for it.
1976010	1981950	If your users stick with XML for some reasons, because in your context, this is what they use,
1981950	1983790	stick with it and go for it.
1983790	1986950	It's really going to depend on your context,
1986950	1993650	and I think that the last point, discernment and clear thinking for your choices within your organization are key.
1993850	1996850	This is one of the most important things that we learn,
1996850	1998610	is just checking the context,
1998610	2003790	and make sure that the security adapts perfectly to this context within your organization.
2003790	2007990	Because if you're trying to get a bigger audience,
2007990	2011470	and broaden the usage of your tools,
2011470	2014070	you need to actually get them in,
2014070	2016810	and by doing this, you need to look like them,
2016810	2020610	so that they can start getting it without any issue.
2021150	2024810	And last point, but not least, change the posture from no, you can't,
2024810	2026530	to yeah, let's see how to make it.
2026530	2028650	For example, if some people want to use the tool,
2028650	2031230	because they also want to do some monitoring and things,
2031230	2032530	yeah, why not? Why not?
2032530	2034530	They should be able to do this, right?
2034530	2039610	If they start asking questions about new technology, new frameworks that they want to put in,
2039610	2041890	well, obviously there's going to be a balance into,
2041890	2045010	is it something that's good for my company, for my organization?
2045010	2046790	But you need to have this discussion,
2046790	2049610	and not having just really close answers.
2050130	2054530	So that's, we think, some of the keys that we got,
2055710	2059130	and that we managed to see following this development,
2059130	2063170	and trying to broaden the usage of our tools.
2063810	2066430	So this is why we created GoChopChop,
2066430	2069990	and what I'm going to do is give my seat to Stanislas,
2069990	2072350	and he's going to present you the tool,
2072350	2076690	and hopefully make an awesome testing session and demo video.
2076770	2077530	Cheers!
2080630	2081970	All right.
2083810	2087050	Hello everyone, and thank you for watching this talk.
2087050	2091330	I'm Stanislas Malveaux, I'm working currently as an intern,
2091970	2093910	a security intern at Michelin.
2094670	2099330	So I present to you how we created GoChopChop,
2099330	2103110	which is the second version of ChopChop,
2103110	2105970	which Paul presented to you.
2106670	2109430	So, ChopChop, GoChopChop is a command line
2109430	2113070	for dynamic application security testing,
2113070	2115310	and it's written in Golang.
2115310	2119790	Its purpose is to scan several endpoints,
2119790	2125350	and expose services, files, folders, through the web root.
2125570	2133230	And we created the tool so it can be fully configurable by developers,
2133230	2136050	even by non-security people.
2136210	2139150	And I present to you how it works,
2139150	2143670	and how easy it is to modify and add a role, for example.
2146170	2147430	Alright.
2148050	2153090	So, here we are testing our own web application,
2153090	2156490	which is exposed on port 80.
2160010	2161690	Alright.
2161830	2165190	So, for the purpose of the demo,
2165190	2170090	we exposed a git config on the web application.
2170090	2176090	So, we can see here, we did a curl on a web app,
2176090	2179230	and it returns a status code of 200,
2179230	2183350	and a core repository format version, and so on.
2183650	2189930	So, now we're going to try the tool on our own web app.
2192970	2194170	Here.
2196250	2197130	Alright.
2197130	2202530	So, we launched GoJarChat on our URL foobar.com,
2202530	2208650	and it flagged the git config vulnerability,
2208650	2213450	and it gives you a severity level, which is high in our case,
2214290	2215570	a name for the plugin,
2215570	2221330	and a remuneration we can use later to remunerate the vulnerability.
2221330	2225510	So, now we're going to see how to configure ChopChop
2226910	2230590	to make new rules, and how you can configure it.
2231070	2235450	So... no.
2235610	2236690	Alright.
2238210	2243070	So, the rules are written in YAML,
2243070	2248570	and it's very easy to create a new one or modify.
2248570	2252130	So, here, for our example, we have the rule git config,
2252130	2257170	so it will scan the endpoint slash git slash config.
2257430	2260690	We give it a name, so git exposed,
2260870	2262570	a status code of 200,
2262570	2270410	which will scan the HTTP response to see if the HTTP response gives a 200 status code,
2270630	2278230	a match, which is a list of strings the tool needs to find in the HTTP response.
2278230	2280550	So, in our case, we saw it was core.
2281530	2286130	There is other things like no match.
2286130	2293670	No match is a list of strings which needs to not be in the HTTP response.
2293850	2299490	And another one is headers, for example, content-type application-json.
2299830	2303350	And you have to give it a remuneration,
2303350	2308590	so here we say do not deploy .git folder on production servers.
2308590	2312630	A quick description so the developers understand what is going on
2312630	2317430	and why it has a severity level of high.
2317430	2322330	So, here, it verifies that the git repository is accessible from the site
2322330	2325830	and a severity level of high.
2325830	2332190	So, you can easily modify it, for example, high to a low level.
2332190	2340610	Or, for example, if the developers don't really know what to do, we can give FUBAR, for example.
2345070	2351390	So, if we launch it now, it will say,
2351390	2358670	OK, I don't understand FUBAR, you need to give a severity level of informational, low, medium, and high.
2358670	2363150	So, we can modify it again to, for example, low.
2363710	2364530	All right.
2364590	2372650	And if you relaunch it, it will take into account the modification and the severity level goes to low.
2372870	2377370	All right. So, now, we're going to do a new rule.
2377370	2388370	For the sake of the demo, we created a quick HTML page.
2391530	2397970	So, yeah, we see here we created an HTML which says DEFCON rocks.
2397970	2406270	So, I want the tool to flag it and to give us an output on this.
2407070	2409110	All right.
2411550	2412910	OK.
2413410	2421450	So, here, I'm going to scan the main endpoint of the web application.
2421790	2427590	So, what we check is we give a name to the rule, so DEFCON rule here.
2427590	2432890	We need a status code of 200 and we need to match the string DEFCON.
2432890	2437290	So, if the DEFCON is found in the HTTP response, it will flag.
2437330	2440470	And a remediation and description and the severity.
2440930	2442670	So, we can test it.
2445530	2446690	All right.
2447970	2454650	And here, you see the tool flagged it on the main endpoint, the severity level and the remediation.
2455830	2458410	All right. That's pretty much it.
2459390	2463790	Paul will finish this presentation and thanks for listening.
2466690	2468710	Welcome back.
2469430	2473310	Thank you, Stanislas, for the demo.
2474110	2476390	So, what we learned from this.
2476430	2483570	So, from going from an offensive mindset to creating a tool used by developers.
2483570	2497870	And what we learned was things that finding the same language, same vocabulary and speaking the same with the same concept is extremely important.
2498350	2504830	Second of all is make sure that they get your points and that you get theirs as well.
2504830	2513030	Which means that if you have some beliefs, if you have some things and reasons that you think that the application should be secured this way.
2513030	2518830	Just make sure that you also understand what are their problematics in terms of development side.
2518830	2521990	Maybe it can be something based on the organizations.
2521990	2525050	But this is something that has to be done, definitely.
2525050	2533390	It has to be done and having you to be conversational in two channels, basically.
2533890	2538310	Third point is bringing assistance will lead to better collaboration.
2538310	2545310	So, as Stanislas showed you before, by giving some remediations.
2545310	2559610	This could be giving links, giving information to the ASVS OWASP, to a bunch of resources and trying to give more information to the people so that they could secure it in a timely manner.
2559610	2570150	This is something that bringing this will actually help them and helping them will bring definitely more joy and they're going to be able to help you as well if you're looking for something.
2571310	2578070	Again, don't underestimate collaboration to broaden your audience based on your context.
2578370	2586370	If the developers that you have that you're trying to target are using XML and you're coming with something in YAML, this is not going to work.
2586370	2587790	The opposite as well.
2587790	2595850	Because everything which might be shiny or anything like this might not be the real solution and you're not going to bring anything to them.
2595850	2598370	So, try to bring something super valuable.
2598970	2601070	This is extremely important.
2601070	2607910	And last point, but not least, that we have on our checklist is the contextualization in the trade-off.
2608010	2609650	Having this balance.
2609650	2622250	As I showed you before, Stanislas, during the presentation, you are able to change, for example, the severity of one specific finding if your organization has a specific context.
2622550	2630970	For this specific trigger, this specific hit, especially with the GitExpo, I would not recommend putting it in low.
2630970	2636130	But this is something that we can do and programmatically everyone can do this.
2636130	2638830	Even non-developers people, non-tech people.
2638830	2646710	You could definitely imagine a product owner or anyone just like, you have this file and you can actually start tweaking a couple of parameters.
2646730	2648870	This is something that we can do.
2648870	2659570	And even though you can tweak the parameters, if anyone is just going wrong, you can see that there are a couple of checks that Stanislas developed to make sure to give some insights about,
2659570	2661970	okay, it failed, but why does it fail?
2661970	2669150	And okay, so it's got an enumeration and you can only choose from those specific values.
2669250	2676810	But anyway, so those are, I would say, the lesson learned from having an offensive tool and putting it into developers' hands.
2677790	2683210	We do have a couple of references and obviously we're just on the shoulder of giants.
2683210	2691070	And I think that those specific links are quite valuable, especially with what we try to build.
2691070	2697830	And I think that those talks and those blog posts are actually similar to the mindset that we have.
2697830	2702390	So first of all, and we talked about it with cracking the lens from James Cato.
2702390	2714710	And I think it's interesting in terms of the scope he has, taking everything from the bug bounty platform and having hypotheses and running it and seeing if it triggers anything or not.
2714710	2719630	The second one is the keynote from the STIC. STIC is a French conference in France.
2719630	2726110	And we had the privilege to have Alex Ionescu in 2019 speaking about security with developers.
2726110	2743570	He started dealing with Rust and a bunch of things like this where he was actually launching the debate about should developers keep up with the compilation flags to avoid having any kind of memory corruption errors, etc.
2743750	2749830	And it's an interesting discussion. I think that might have some English subtitles because the talk is in French.
2749830	2754990	But definitely something that I would consider to watch afterwards.
2754990	2758310	The last two are actually from Harold Meir.
2758850	2763850	And two great conferences talks. The first one, learning the wrong lessons from offense.
2763850	2768490	And the second one from B-Sides Doha, which is make more stuff.
2768650	2771610	And this was oriented to security people.
2772050	2776650	So those four references are absolutely awesome.
2776650	2781770	And we recommend you to watch them. It's worth the watch, definitely.
2783370	2787490	So thanks a lot. Thanks a lot for your time. Thanks a lot for watching.
2787570	2793390	Feel free to check our GitHub if you want to follow the project and start collaborating with us.
2793390	2801510	And if we do have one advice, embrace hackiness, have fun and collaborate with your organization to make it more secure.
2801930	2803890	Cheers. Bye.