start	end	text
2340	6800	Hello, my name is Pablo González and this is my colleague, Fran Ramírez.
6800	9640	We are proud to introduce the ATTPound,
9640	13480	Adversarial Emulation and Offensive Technical Collaborative Project.
13500	16420	We are proud to be at DEF CON this year.
16460	19420	Besides, we like very much the offensive part,
19420	23600	and that's why we bring a tool called ATTPound,
23600	27020	which helps to perform the emulation of adversaries.
27560	30840	Also, we want to tell you about the collaborative
31300	33500	side of the project.
33540	37560	First of all, let's introduce ourselves.
38680	40680	I am Pablo González.
40680	45340	I work at Telefónica in Spain in the pre-innovation department,
45340	50600	where we are very lucky to play with cybersecurity and artificial intelligence.
50860	55500	We develop several open source tools and AGIAR,
55500	58780	and try to contribute with crazy ideas.
58780	62640	I am MVP of Microsoft since 2017.
63020	67360	I have written some books in Spanish about cybersecurity,
67360	72420	and I am a teacher at several universities in Spain.
73000	76940	My partner, Fran Ramírez, works with me at Telefónica
76940	79720	in the same pre-innovation department,
79720	83400	focusing on cybersecurity and machine learning projects.
83400	89240	He has worked several years in the USA as a system administrator,
89240	94180	and has written some books about Docker and machine learning.
94440	100920	Before we discuss the tool and show the use cases first-hand,
100920	104060	let's have a look at the ATT&CK.
107480	112600	The emulation of adversaries has become extremely important in the Red Team world.
112600	117680	It's an exercise that provides a glimpse into the potential for a real threat,
117680	122520	like many others that both business and society have experienced,
122520	124720	to affect an organization.
124720	130980	The goal is to be capable of verifying if the organization controls are efficient and effective
130980	137080	by detecting the threats or displaying weaponry weakness in response to them.
137200	141100	The purpose of a Red Team exercise are the following.
141100	144520	Demonstration of the exposure-run risk level.
144520	146340	Demonstration of the business impact.
146340	148920	Demonstration of the prevention capabilities.
148920	151280	Demonstration of the detection capabilities.
151280	155360	Demonstration of the capabilities of reacting or addressing incidents.
155640	159400	Now, we are going to speak about ATT&CK.
159940	164560	Mitre ATT&CK is a database containing the most common techniques,
164560	167880	tactics, and methods being used by attackers.
167880	171660	Tactics are the high-level vectors of ATT&CK.
172020	175720	The techniques represent the implementation of methods of ATT&CK.
175720	178600	The organizations can perform an adversarial emulation
178600	182940	and keep mapping the security controls that are applied to the techniques.
182940	188740	Organizations can also have several security controls related to a given technique.
189100	192100	The goal is to verify the performance and efficiency
192100	195940	as regards the security control by techniques implemented.
196720	202960	The Mitre ATT&CK framework takes on the security bridge.
203360	207600	So, the starting point is the original intrusion tactic.
207600	210420	Any activity that has been previously carried out
210760	217040	will be covered by a framework called Mitre ATT&CK.
219480	224100	Now, let's find out more about ATTBOUND.
224100	227380	ATTBOUND is a computer security tool designed to emulate
228330	232780	the tool aims to bring emulation of a real threat into closer contact with
232780	238040	implementation based on the techniques and tactics from the Mitre ATT&CK framework.
238040	242940	The goal is to simulate how a threat works in an intrusion scenario
243880	248080	where the threat has been successfully deployed.
248220	253220	It's focused on Microsoft Windows systems through the use of the PowerShell command line.
253220	258400	This enables the different techniques based on Mitre ATT&CK to be applied.
258480	263360	ATTBOUND is designed to allow the emulation of adversaries as for a red team exercise
263360	272020	and to verify the effectiveness and efficiency of the organization control in the face of a real threat.
272140	275280	What is the ATTBOUND core? PowerShell.
276060	281560	PowerShell is released along with Microsoft Windows Vista.
282200	289520	It's not natively embedded in the operating system which makes it very interesting for both
289520	294100	IT administrators and pen testers.
294100	301300	Its new version includes a large number of new features and modules that will help
301300	308160	to integrate interestingly with the operating system and its many tools.
308720	316580	And the first version was released in 2006.
316860	318740	The first stable version.
318740	325960	Okay, two versions appeared in 2009 with the release of Windows 7.
325960	334420	Version 3 appeared in 2012 with the release of Windows 8.
334950	343650	Later, the last version, version 7, appeared in the year 2020.
347400	353120	The idea underlying ATTBOUND to link the Mitre ATT&CK framework along with the techniques that
353120	357040	are implemented via the Microsoft Windows PowerShell command line.
357040	363580	The many techniques implemented to using PowerShell support a high percentage of techniques
363580	368960	laced in the ATT&CK matrix that can be replicated.
369280	371900	The project is also collaborative.
371900	381540	It means that the user can have his initial knowledge base based on ATT&CK but can import
381540	388580	new implementations of the techniques used in PowerShell and relaunch them using the
388580	390980	techniques and tactics in the file.
390980	397680	We have used JSON format files to export this new code knowledge and import it in other
397680	401160	environments where ATTBOUND has been deployed.
401160	405480	In this way, the comparative knowledge has become very significant.
406200	412880	This facilitates multiple users to share knowledge between separate environments.
412880	417800	The techniques are dynamic elements that are emerging through the evolution of offensive
417800	418720	security.
419800	426760	Now, my colleague, Fran Ramirez, is going to give you a little insight into ATTBOUND.
427860	429960	Okay, thank you, Pablo.
429960	431600	And hello, everyone.
431600	436800	Now, let's see what the architecture of ATTBOUND looks like.
438640	442500	ATTBOUND has three main different components.
442680	445700	The first one is the console.
445700	452900	That is the PowerShell code that will be running on the Windows machines emulating the treat.
454580	461320	After this code is executed on Windows machines, it connects towards a command and control
461320	465720	and it waits for the adversary's commands to be emulated.
467240	470580	The second one are the functions.
471240	478260	These are the technical implementations that are mapped in Mitre, ATT, and CK.
479140	486960	This is interesting since any user can create their functions written in PowerShell.
487460	494160	This makes ATTBOUND collaborative and a project where any user can contribute with their
494160	498460	knowledge in the form of technical implementations.
499140	505200	All the functions will be carried out by the console when it is executed through Windows
505200	506050	machines.
508850	513410	And the last one is the command and control MVC or C2.
514010	517050	This is the ATTBOUND control panel.
517810	522780	From this panel, you can set up the treat or adversary to be emulated.
525240	531160	You can use already pre-setup treats or you can build new treats or tests.
535500	541080	The tool's knowledge can be imported and exported from this panel since the user can
541080	546780	create its content in the form of an implementation of a technique in PowerShell.
550070	555670	In other words, a basic architecture scheme has two main elements from the networking
555670	556950	point of view.
558590	561250	The first is the agent or warrior.
561990	567950	It's the adversarial emulation and its code is in PowerShell.
569930	573710	The second one is the root node or command and control.
574570	580330	From this web application, it is possible to manage the application of the treat to
580330	583530	be simulated by the different deployed warriors.
584510	591070	Also, you can manage the results of the emulation and make decisions about the controls.
592290	598430	Everything is fully connected with the identifiers of the ATT and CK metrics.
600770	605550	Again, from the networking point of view, the deployment of warriors over the network
605550	609230	will be accomplished through different options.
609690	614830	Remote invocation through the network privilege, invocation of remote machine without privilege,
614830	616670	lock and invocation, etc.
620120	626760	It is commendable not to include more than 10 or 15 computers in this process, as indicated
626760	628780	by the ATT and CK.
633180	640360	These exercises are simulation, but you must have a real as possible environment for better
640360	642020	results.
645610	649330	Okay, and now let's talk about the operational flows.
652090	657810	These are the different flows between the console or agent and the ATT bound command
657810	659090	and control.
661130	664250	The first flow is the connection flow.
664570	669950	When a console is running on a Windows machine, it sends a high command.
672860	678820	When the console is running, it gathers information from the machine and then passes it on the
678820	681680	control panel through this packet.
685640	691080	During the warrior generation, the IP address to be connected must be specified.
692680	695600	But this is discussed further below.
697040	705340	When the warrior needs to register as a compromised computer, it sends a request through the
705340	712960	HTTP POST method of the root node, stating the warrior ID and the collected information
712960	714520	from the computer.
718050	724970	When this information is received by the root node, the data will be stored into the database
724970	728910	and will be made available for the user.
729430	735710	That is, in order to assign the plan set in a treat and perform its execution.
737630	743750	When all this information reaches the command and control, it saves the information into
743970	746850	a database and sends an OK signal.
748590	754710	The second flow refers to the adversarial planning and execution process.
755950	762170	The console or agent will ask for information about the treat plan to be performed.
763070	769370	If the user has not created a treat plan for that console, the answer will be no treat
769370	770310	plan.
771210	776930	When there is already a treat plan created for that console, an OK signal will be sent
778090	784450	Later, the console will start asking for the functions that are part of the treat plan.
785850	791630	For each function downloaded and executed, the results will be reported to the command
791630	793090	and control.
796030	801610	In other words, when the warrior connects to HTTPound, it requests a new treat plan
801610	804350	through the GETPLAN function.
805850	812510	If the user has assigned already any plan to the warrior, it answers OK and the treat
812510	814470	plan will be delivered.
815030	820210	This plan is generated in a JSON format.
820990	824910	More details about this file will be provided later.
825550	832450	Once the treat plan is available for the warrior, it will perform the request of each function
832450	834330	or task to be accomplished.
835530	839510	This is made through the GETTASK function.
840430	847130	A GETTASK function will be run for each technique implementation that the warrior requires to
847130	851570	be performed in order to fulfill the treat plan.
854070	860610	For each prior run, two values will be returned through the PUTRESULT function.
861570	868590	The first one, whether or not the ATTCK technique has been executed successfully.
869770	876130	In the second case, we get the output from the function that implements the returned
876130	881190	technique ready for a technical review that can check the results.
881850	885670	OK, and now the third flow is the SIGNOUT flow.
886470	891930	After all the techniques have been performed, the communication close and the treat emulation
891930	893170	is finished.
893970	897970	So the console will send the BYE command.
901010	908570	Therefore, the root node will also assume the warrior as dead if it does not report
908570	911710	any activity for a long period of time.
911710	918170	In the other side, the warrior will show activity if, before a treat plan is associated,
918170	920630	the warrior is requesting a plan.
922900	928160	Now let's talk about some key elements in the ATPAM to go a little deeper.
928640	935400	The console will be created from the web application specifying the IP address from where
935400	938200	the console file will be downloaded.
939000	947140	There is a file called console template that houses the instructions that will manage the
947140	953100	connection, the treat plan, and the connection clause we mentioned in the previous section.
953660	959220	When the instruction provided is being executed on a Windows machine, the PowerShell code
959220	965660	necessary to carry out the warrior instantiation will be launched.
966300	972160	The console has two parts with a large if in the middle.
972340	978080	The first part of the basic starting path is the beginning of the thread.
978120	983800	As seen in the previous section, a connection request shall be made.
983800	993420	First, a unique ID is generated for this instance to be identified in the root node.
993420	999600	Also, the information on the operating system where it's running is gathered.
1000060	1008200	The second part is driven by a case that can happen in many thread emulations.
1008560	1013560	The process where a privilege escalation or lateral movement to another machine
1013560	1020040	produces a new privilege process, or one that can be executed in another environment,
1020040	1022060	has been called splitting.
1022060	1027040	In this case, the console will be invoked with an ID.
1027040	1035900	That is, it will not have to generate the warrior ID that identifies the warrior to the root node.
1035920	1043380	In other words, if there is a plan with three tasks, and the second task is a privilege
1043380	1050180	escalation, and this one is successful, then the third task will be executed in another
1050180	1053820	process at an operating system level.
1054000	1059160	But from the 80-pound logical point of view, it's the same warrior.
1059160	1062560	That is, it inherits the same warrior ID.
1065700	1067800	How do we define a thread?
1068080	1071660	Simple, through a JSON file.
1071660	1076580	The thread plan is generated in the root node according to the user's needs.
1076580	1082380	The user can use real threads already created or build their threads and see the output
1082380	1084680	of their monitoring techniques.
1084680	1088720	The document format delivered with the plan is JSON.
1091590	1098110	Let's talk about how to create your ATT-bound functions using the skeleton function.
1100100	1107960	Any user can create or add features to implement techniques from the Mitre ATT and CK.
1109620	1116700	Its implemented function is linked to a technique and one or more tactics in the framework.
1118700	1127980	The main components from the skeleton functions are the technique to be launched or the function
1128500	1130640	and the main program.
1131020	1136520	This main program will be in charge of managing the flow of the technique to be performed.
1139410	1143910	And this main program is in charge of another three tasks.
1145330	1153590	The first one is request the necessary data to the root node for the technique to be executed.
1153890	1157990	This is an execution prerequisite.
1159390	1166750	The second one is check if the execution of the technique has been successful or not.
1168110	1172770	The output will be stored in a true-false variable.
1174690	1180290	And the last one is if there is some data collected such as credentials dump,
1180290	1186310	AP addresses or user enumeration that can be used by another technique because
1186970	1193570	all this information will be dumped to a data store that has the root node.
1194630	1201090	This scheme can be visualized in any of the functions that can be found in ATT-bound.
1202290	1209370	ATT-bound is a collaborative project where the goal is to share knowledge through treat plans.
1211090	1218150	For this reason, the tool allows exporting user-generated treats and importing them into
1218150	1226510	other ATT-bound instances. During the treat plan generation or query,
1226510	1231310	the export plan option can be used as shown in the image.
1235560	1240820	Once the file is stored in JSON format, it can be shared with the community.
1242240	1248580	The JSON file contains all the information needed to recreate the treat plan with all the tasks
1248580	1256860	and implementation of techniques involved, even if these are not available in the new scenario.
1258220	1264100	Now, let's look at some use cases. In ATT-bound, you can execute the
1264420	1271200	default or known threats and threats or adversaries that we create. With our custom
1271200	1281000	threats, we can make our own version of a known threat with HTTP techniques selected by us,
1281000	1289780	create our own version of an attack with HTTP techniques, and perform an execution of a threat
1289780	1297220	now created by us that implements our own functions through the skeleton function.
1298760	1304780	In this section, we will perform different scenarios and explain them.
1310370	1314470	Okay, in this first demo, let's see what a warrior is.
1315300	1322270	To do this, we will create the warrior in this option and copy the code that ATT-bound delivers
1322270	1336680	to us. Then, we go to the computer where we will make the adversary or threat test, paste the code,
1336680	1343160	it will be executed in a new PowerShell, and finally, it connects with ATT-bound downloading
1343220	1353810	a console. If we go to the home section, we will be able to see the computer where the warrior is
1353810	1363470	running. Here, we have the architecture data, the process that it's running, the AP address to which
1363470	1373580	it belongs, and the warriors identified. In the plan section, we have some predetermined threats
1373580	1381120	as we can see here, like WannaCry, NotPetya, Flame, DarkComet, or Dooku.
1382600	1389660	Let's select, for example, WannaCry, and here we can see the techniques and the ATT and CK
1389660	1405030	tactic identified that forms this version of WannaCry. We could use it against a warrior,
1405030	1411590	launch the warrior plan, and finally execute it, step by step, all those techniques that correspond
1411590	1425680	to WannaCry in this case. In this second demo, we are going to gather information to verify that
1425680	1433140	there are different techniques within ATT and CK and ATT-bound to be able to collect that
1433140	1443980	information to recreate the malware threat. Next, we are going to do a privilege escalation technique
1443980	1452280	that will split the ATT-bound console process in two. One without privilege and the new one
1452280	1470690	with privilege. The first step will be to create the warrior, copy the code, go to the PowerShell,
1472830	1499100	run the code, and finally obtain the warrior executed. Okay, now let's go to the plan option,
1502250	1516580	create a new one, select the gathering tactic where we can see here, besides the implemented
1516580	1524100	techniques, we also have the discovery tactic where we can see some ATT and CK techniques generated.
1526180	1533620	In this case, we are simply going to make a selection of the processes that the machine has.
1533980	1539140	We will add this technique, then we'll go to the escalation of privilege,
1539140	1548120	where we are going to use a bypass of USC technique named 1088. We add it,
1548120	1563690	we put a name to the thread, and finally we will create the plan.
1564230	1568570	Once we have the plan created, we can select it here.
1572180	1578960	We see the elements of our plan with which Mitre tactics the mapping is performed.
1580960	1586440	And we can identify the warrior over the warrior we want to launch it, and finally we launch the
1586440	1596120	plan. At this moment, the ATT bound console will start working and it will read the plan, and
1597160	1599860	here we have the pending task.
1602260	1607760	If we go to the result option, we will see how the first technique has already been executed.
1611380	1617280	In bulk process, which is just a collection of processes, we can see success.
1619140	1623560	If we refresh it or we wait for a little while,
1627910	1640930	we will find that USC bypass has also been successful, and we really get a double process.
1641840	1645100	The one on the left is without privilege,
1647130	1654690	but the one on the right is a process in which instructions with privilege are being executed,
1654690	1659850	but we had no more technique after the privilege elevation of execution.
1660010	1665660	In the ATT bound technical part, we can see the technique's output.
1668680	1677320	We can check the processes that the computer has, and here we can also see the UAC bypass result.
1682040	1696080	And here's the second demo. In this third demo, we are going to perform an escalation of privilege,
1696080	1708220	but also a credential stamp. To do this, let's create a warrior pointing to the ATT bound IP
1708220	1716220	panel, copy the code, and run it on the PowerShell console as we saw before.
1721190	1726070	Here we can see the information about the new warrior connected to the panel,
1726070	1738270	and now we are going to create a plan. The plan will have a privilege escalation.
1738880	1744560	We will use again 1088, that is the UAC bypass,
1746190	1753590	and we will execute a credential access tactic using a power dump, but we could also use
1753590	1772790	Mimikatz to perform the credential dump. The interesting part is that once we get the
1772790	1778970	privilege escalation working, we will get a new process with privilege, and this process
1778970	1788340	will be able to perform the credential dump. Okay, so let's create the plan, deploy the treat,
1788340	1802860	select the treat, select the warrior, and finally launch the plan. Okay, and now let's go to the
1802860	1810800	ATT bound output section, and here we'll be able to see the techniques or tasks pending execution.
1813510	1826020	Like the 1088, if we give it a little time, we will see that it has been successful.
1826400	1832340	This new process with privilege has not been created yet. We will see in the next refresh.
1834880	1838600	Here we can see the console without privilege,
1843140	1848860	and this second panel, we will find the credential dump still running.
1857010	1865850	And now we can see that the power dump technique is finished. But where can we see the results?
1865870	1871510	Like in the previous demo, here we can see the output that this technique has.
1872770	1874990	In this case, the UAC bypass.
1876610	1881130	While the second technique executed in this process, the credential dumping,
1881130	1884090	has returned us all this information.
1885430	1891870	This information is very important. As we see here, we have users, user ID,
1891870	1900010	has lm, has ntlm. As I said, this information is very important because we will be able to use it
1900010	1910990	through a datastore. The datastore can be used by techniques that are performed afterward.
1911400	1918280	For example, a lateral movement technique can be used by these hashes and these users because of
1918280	1925800	this datastore. This is a very, very important element within ADDbound.
1932410	1936850	In this fourth demo, we will perform the following scenario.
1937810	1944330	First, an escalation of relays. Second, credential dumping.
1945670	1951730	And finally, we will make a lateral movement from a computer with Windows 7 to a computer with
1951730	1959210	Windows 10. First, we are going to deploy a warrior on the Windows 7 machine.
1962380	1970120	Okay, as we have done in previous demos, we type in the ADDbound IP address and finally create
1970120	1984090	the code. We copy the code from PowerShell and run it on Windows 7. Okay, we copy the code
1986810	1991970	from ADDbound and run it on Windows 7 on PowerShell.
1994350	2005370	Okay, once executed, we go to home and obtain, as before, the new warrior running Windows 7.
2009780	2023360	Okay, well, now let's generate a plan where the first step is to execute this technique.
2023360	2036400	For example, by the counts T1078. Okay, the second technique is an escalation of privileges.
2036400	2045200	And third technique is credential dumping. And the fourth step or fourth technique will be a
2045200	2067300	lateral movement. Okay, now insert plan and select a plan, new plan or new thread.
2067840	2090100	And we assign warrior ID to new plan. Okay, and look at results view and we have a data store.
2090100	2109280	Okay, these are several techniques about the new plan and data store. We add an IP address
2109280	2130890	to the data store. Okay, well, refresh the web page several times until the lateral movement
2130890	2137710	is complete. The technique of lateral movement is complete.
2139190	2148130	Now ADDbound is still executing, execute all process.
2151690	2158270	And now refresh the web page several times until the lateral movement is complete. Okay,
2158270	2165170	observe that we have an ADDbound console running on Windows 10.
2170970	2181880	Yeah. Then now we can conclude this demo 4. Okay, now we are going to
2181880	2206810	do a speech about demo 5. Well, in this 5th demo, we will work on an all-in-one thread concept
2207550	2215930	where we will automate the service discovery and the discovery of machines within a network
2215930	2224470	as a thread or an adversary could do. The data discovery will be stored on the data store by a
2224470	2231090	technique being used. Then we will perform a privilege escalation, obtain a new privilege
2231090	2239410	process on the Windows 7 machine. Then we will make a credential dump thanks to that privilege
2239410	2248610	escalation where we will acquire hashes and users. Then we will make a lateral move where we will
2248610	2256230	use the hashes, users, and the IP addresses from the computers within the network to try to make
2257230	2265210	that lateral move through the metered CKE technique. In this way, the whole process is
2265210	2272650	fully automatic, so we can test the effectiveness or efficiency of security
2272650	2279310	controls within the organization. We will start, as always, by generating a warrior. In this case,
2279310	2287310	we check the IP address again. Copy the code and go to PowerShell to paste the code. Okay?
2289730	2299490	Okay. In the home section, we will see the control connected soon. Here we see the data.
2299490	2316930	Now we go to the plan section. Okay. Waiting for the warrior. And we go to the plan section.
2316930	2328950	We create a new plan beginning with the discovery tactic using the T1046 technique
2329650	2337230	where this port scanning will allow us to discover computers. Okay.
2337530	2345590	We add the technique to the plan indicating an escalation of privilege and then credential dump
2345590	2355810	with power dump or mini cuts. And finally, the last technique, again, a lateral movement.
2356650	2368450	Okay. And thread name, DEF CON GIMU5, and thread description, blah, blah.
2371830	2377050	Okay. We put the name on the one, create a plan, and link it with the warrior.
2377050	2389730	We go now to the results. Okay. Well, first locate plan. And now we go to the results.
2391920	2395390	We see the control begins to work.
2398010	2405440	Now we can see here the task to be done. And the scan begins.
2408510	2418310	One moment here. Yeah. The scan is a technique that can take quite a long time.
2418310	2426990	Can be seconds or minutes. So, we will speed up the demo a little bit so that this part goes as
2426990	2440660	fast as possible. Okay. Once the scan has finished, we will be able to check that it has been successful
2440660	2452640	if we go to the data store. Okay. Now, we go to the data store. We will be able to see the
2452640	2461940	computer IP addresses that are currently alive on the network. Right now, the second technique,
2461940	2470160	that is the escalation of village has also been successful. So, the process has been unfolded.
2470160	2481220	Right now, the process is done. Okay. If we refresh the page, we will see the credential
2481220	2491160	dumping has been successful, too. And if we go to the data store, we see that we have IP addresses,
2491160	2501600	users, and hostess. This hostess can be from here directly. Like any data from the data store
2501600	2509980	and the changes will be saved by clicking on the update code. Okay. For the thread to finish,
2509980	2514620	we will have to check if the result is correct or not in the lateral movement.
2514620	2522740	And we must consider that these techniques are used to test the efficiency and effectiveness
2523360	2530380	of the security controls within the organization. Therefore, certain implementations may be
2530380	2541740	dated and avoid the execution of some codes. Okay. Now, a new process on Windows 10 has
2541740	2548280	been implemented. There are no tasks and we have performed the lateral movement. In other words,
2548280	2555620	the thread has moved from Windows 7 to Windows 10 from one machine to another over the network.
2555900	2564340	We have also done the whole process of thread that is real for us. Detecting computers in the
2564340	2572520	network. Dumping and accessing information such as hashes. And finally, a lateral move
2572520	2579880	with one of the techniques that can be implemented within the lateral movement. Move tactics.
2583290	2590970	In this final demo, we are going to export the thread plan and then import it into
2590970	2599450	HTTP. To make a simple example, we can choose notepad, select the thread,
2599450	2604740	get the techniques to use, and proceed with the plan export.
2606830	2619070	In this button, we export this knowledge. If we want to share knowledge with other users,
2619070	2627010	our thread knowledge that we already have created, or even techniques that we have implemented
2627010	2636230	in PowerShell, we can create a new plan, set a name, create a plan, choose it, and proceed to
2636230	2658410	export it. If we want to share this plan with another user, we will send him the JSON file
2658410	2673340	which we are going to open to see the content. Okay, JSON, opening JSON file in Firefox, okay.
2675880	2683680	Okay, as you can see, even the function definition written in PowerShell,
2683680	2692820	exactly as we have created it, is transferred. So, if we want to share this information with
2692820	2699260	another user, we can export those plans containing the functions that we have
2699260	2714050	created in PowerShell and added to HTTP and send this JSON. Okay. It's a very simple and
2714050	2719790	collaborative way to provide the knowledge to other users with offensive techniques
2719790	2729610	within the HTTP mapping. Well, this is the last demo, and I will pass the word on to my partner, Fran.
2730970	2737570	Okay, so that's all. Feel free to visit the ATTPound GitHub and download the software.
2738550	2743930	This is a new tool we are currently working on, and we are adding new techniques.
2745410	2749630	Also, the project is collaborative, and everyone can help the project grow.
2750890	2755990	And now, we are ready to answer any questions you may have about HTTP.