start	end	text
0	3460	Hello. Well, hello and welcome to what is a day,
3460	7160	one of Red Team Village at DEF CON.
7560	10720	I'm Ben Sadegopour and I have Tanner Barnes,
10720	12180	aka Staticflow here with me.
12180	16100	We want to talk about how to identify assets in the cloud.
16380	18300	And we did some really cool research,
18300	19440	but before we jump into it,
19440	21540	we're going to do some agenda,
21920	23160	intro on who we are,
23160	24640	and kind of give you a background
24640	25700	on why we did this project.
25700	27480	So let's just jump into it.
30220	31700	One sec, there we go.
31700	34140	Cool. I'm trying to see where my notes went.
34220	36600	There we go.
36980	39920	So for agenda for today, we talk about who we are,
39920	45560	why we focus so much on the cloud and our solution,
46040	47600	and talk about how we mass exploited
47600	51060	or look for vulnerabilities and mistakes in mass.
51060	53840	And then we'll also have some really cool examples
54760	56000	of things that we accomplished
56000	59360	and got some boundaries with in the past few months.
59720	61400	So originally when we, before we get into it,
61400	62500	I want to give a background.
62500	65220	Tanner and I were going to work on this for an entire year.
65220	67880	So this was supposed to be for next DEF CON,
68420	70260	but unfortunately things happened
70260	72320	and we wanted to go do an experiment with it.
72320	75360	And you can't say no to want to talk at DEF CON.
75360	77720	So we're doing a smaller version of this today
78380	79800	as a part of DEF CON.
79800	81200	And hopefully next year we can come back
81200	84400	with more examples and more in-depth research.
84940	86700	So a quick about me,
86700	88580	I'll also let Tanner introduce himself afterwards.
88580	89820	Again, I'm Ben Sadigapour,
89820	91220	mostly polynomial as Naham said.
91220	92740	You probably have seen me on Twitch.
92740	95200	If you are a, I have a Twitch user.
95540	99780	I currently work at Head of Hacker Education at HackerOne.
100000	102900	I also create content and stream on Twitch.
102900	105260	And again, you can follow me on all social medias
105960	107500	under the name Naham Sec.
110140	111160	Awesome. Yeah.
111160	113380	So like you said, my name is Tanner Barnes,
113380	115500	Static Flow on Twitter and some other things.
115500	118460	So I am, I apologize for my dog.
118640	120600	I hope it's not terribly loud.
120600	122560	There's nothing I can really do about that.
123500	126780	So I'm a developer originally by trade.
126780	128080	And then I've been doing pin testing
128080	131980	for Aon Cyber Solutions for like the last year and a half now
131980	134240	and I'm an occasional bug hunter,
134800	138220	but I help a lot more with some other bug hunters like Ben
138220	139780	and some other people I know,
139780	142020	helping build some tools for them.
142020	144920	So there's my GitHub where a lot of the stuff I make is up.
144920	147980	And then I also have just recently started doing
147980	151660	some live coding on Twitch as a handler.
153260	154920	Tanner, before we jump into this,
154920	157460	I know that DEF CON has this tradition
157460	161120	where when you speak at DEF CON, you have to take a shot.
161540	162840	I don't know if you have one ready,
162840	165460	but I unfortunately picked one for myself.
165460	168280	So cheers.
168420	169220	Go ahead.
169440	170480	Cheers, man.
172820	175880	Sorry, I did not, I could have ran downstairs,
175880	177260	but I don't think we have the time.
182730	183570	Go ahead.
183570	187790	Cool, so that's kind of the big question of this, right?
187790	189430	Is why the cloud?
189430	191170	Like what's the meaning behind,
191170	193170	why did we get into doing all this?
193950	197050	So there's not currently a ton of great solutions
197050	198870	for looking at cloud assets, right?
198870	200910	So you've got things like Census and Shodan,
200910	202510	but some of those can be really expensive.
202510	205670	I know Census can be $900 a month.
206070	208250	Shodan licenses for their APIs
208250	209930	aren't necessarily the cheapest.
210810	214630	And it's definitely worth looking into, right?
214630	216270	And so we wanted to kind of see like,
216270	220030	how could we look into cloud assets?
220030	223290	And then, what would that look like expense-wise?
223370	224690	And the other part is just kind of,
224690	226150	who isn't in the cloud these days, right?
226150	227510	Like, I think you're probably hard-pressed
227510	231390	to find a large Fortune 500, Fortune 50 company
231390	234050	that's not running some part of their infrastructure
234050	235250	out in the cloud.
235250	237970	So it's a huge target-rich environment, right?
237970	242770	If you look at just Azure, AWS, GCP,
242770	246110	you're looking at something like 88 million IP addresses.
246510	248050	And that's just in their,
248050	250430	what I guess I would call like their EC2 space
250430	253150	or their compute space, right?
253150	256450	We're not talking about like stuff for Lambda functions,
256450	258650	right, that have like pooled up IP addresses,
258650	261650	but 88 million IP addresses that could actually be spun up
261650	263410	for somebody's instance.
264450	267950	And this is also a big part of where organizations,
267950	270270	large ones use to spin up their kind of quick
270270	273050	and easy development boxes.
273050	275330	Things are quickly testing on the edge.
275330	277970	It's a great, cheap, easy way to deploy that.
278050	280630	So if we can get really good coverage and insight
280630	282730	into what's happening on the cloud,
283170	285050	we can really find some really cool targets
285050	288410	and get some really useful data out of it.
288910	290110	Next slide, please.
290790	292810	Yeah, so I mean, this is kind of an example, right,
292810	296390	of just some real quick, like dirty,
296390	298550	just some quick data that we grab
298550	300030	from our database real quick.
300030	303770	So when you're looking at like 1,000 corp domains,
303770	305870	13,000 internal domains,
305870	307650	we found that actually very fascinating
307650	311410	about how a lot of these domains in the cloud,
311430	315150	a lot of their DNS names have stuff like internal corp dev,
315150	316630	and it's odd, you would, I guess,
316630	317790	initially I would have thought
317790	319570	that you wouldn't see a lot of that.
319570	322190	But yeah, so I think that's cool
322190	324990	is that that kind of tells you the type of things
324990	327230	companies are putting out there on the cloud
327230	328590	and on the edge, right?
329130	330810	And then things like API,
330930	333030	a lot of cloud APIs are obvious.
333030	335890	And then if you look at like some specific target options,
335890	339310	right, like anything on Yahoo or OAuth, right,
339310	342490	you're looking at 100,000, 4,000 targets, right,
342490	343850	all out there in the cloud.
346840	349340	Right, so this is my favorite part.
349380	353540	This is when Ben kind of brought this idea to me,
353540	355020	I was immediately hooked
355020	357360	and I thought it was gonna be a real fun challenge.
358620	360820	So yeah, so we're getting to kind of how it works
360820	361900	and what we did.
362220	365940	So it's built in Go, I've been on a huge Go kick,
365940	368760	if anybody knows me, or if you look at my GitHub,
368760	369560	it's kind of funny,
369560	372660	it started out when I really started doing GitHub work,
372720	374320	a lot of Java, a lot of,
374320	376340	I call last year the year of Java for me,
376340	379480	it was a lot of like perf extensions and things like that.
379660	383680	And then I got into writing Golang code
383680	385380	and I just got hooked.
385380	387420	So pretty much everything I've built since then
387420	389860	has been in Go, it's super great.
390000	394180	Go routines make work like this especially easy,
394180	395520	it's incredibly concurrent
395520	398140	and it's a language built for concurrency.
398740	399820	So if you look at like,
399820	403320	what is the tool that we built do as kind of a core thing,
403320	405300	so what we're doing is we're taking IP addresses
406700	410500	and we are hitting them on a certain port over TLS
410500	414220	and then we're pulling the CNAME and DNS name records
414220	415960	out of the certificate it returns
415960	418820	and storing that tied to the IP address.
418820	423840	So we're building a huge database of domain names
423840	425780	to IP addresses in the cloud.
425780	430040	So kind of unmasking who owns these 88 million IP addresses
430040	430860	out in the cloud
430860	434360	and to try to differentiate targets from them.
434680	436980	As far as the actual code goes,
436980	440000	not really incredibly, there's not a lot of magic there.
441260	443840	Mainly, it was just kind of starting ground
443840	445780	for like reaching that data.
445880	449060	The real magic comes from scanning it at scale, right?
449060	451220	So again, 88 million IP addresses,
451880	453560	you're not really gonna be able to hit that
453560	454860	from your box, right?
454860	459080	That's a kind of an untenable amount of data to go through.
459220	462000	So scaling it is super important.
464700	467720	So this is my favorite slide, it was a lot of fun typing.
467720	469980	I sent it to like eight people when I wrote it.
469980	477200	So we were looking at about 535,000 slash 24-siders
477200	481780	across large Barn Bunny targets and cloud infrastructure,
481780	484580	and then across 11 main ports.
484580	489080	So you're looking at about 1.4 billion unique scan targets
489080	490720	that we were looking at.
491040	494400	And I just recently, we just created version two of the API
494400	497440	and I was able to get it down to a full scan of that space
497440	498720	in 15 minutes.
498720	501640	So that comes out to a rate of about 1.6 million
501640	506700	unique scan targets a second with 28 to 29 million
506700	509400	identified targets across those 11 ports.
509400	512180	And then my favorite thing is that all of that costs
512180	517500	about $25 in AWS charges, which to me is wild.
519200	522220	So there is a flip side to any coin like that.
522260	525840	There were a lot of lessons learned on this way.
526420	529080	One thing I learned off the bat is do not try this
529080	530020	with Lambda.
530020	532820	Lambda seems like a really simple solution to do this.
532860	537360	Turns out they will not let you spin up 535,000 Lambda
537360	539580	functions at once, which is not shocking.
540060	544360	I tried that once and my AWS bill was insane.
545660	547660	So that was definitely a no-go.
547660	550640	So there's definitely been some heavy hitting AWS bills
550640	552660	along the way working through this,
552660	556980	getting to that mythical $25 bill of scan.
557180	560420	As far as the code goes, when you get to things like this
560420	563700	at scale, the quicker you can make the underlying code
563700	565340	is obviously super important.
565340	569120	So I had a lot of fun building a really simple solution
569120	571200	and then going through with profiling tools
571200	573820	that are built into Go to really carve out every
574520	577480	wasted piece of memory and wasted CPU cycle
577480	580740	to just make it as fast as humanly possible,
580740	582240	or I guess as computer possible.
582240	584480	So when I did put it on the scaling solution,
584480	586260	it would run quicker on the scaling solution
586260	588500	and thus cost us less money.
589540	592160	One part of the funniest lesson we learned from all this
592500	594640	is definitely be careful like who you're scanning
594640	599600	and what you do with the data you get from the scan.
599600	603000	The cooling about this scanner is it actually is very light
603000	605880	on the network of targets because we're actually
605880	610440	not making a full TLS HTTPS connection.
612340	614620	It's rare you would actually probably see this
614620	617440	on your ingress logs to your server
617440	619960	because we're not actually making a full handshake.
621060	624340	What we mistakenly did once was when we had the data,
624340	625680	we decided, and we'll get to in a bit,
625680	628060	we had a really cool fingerprinting tool that we built
628060	629680	and we decided we'd try to go fingerprint
629680	631500	our entire database.
631900	634880	We got some very hilarious LinkedIn messages
634880	638340	and Twitter DMs from some very worried CISOs
638340	641100	who thought we were trying to take over
641100	642640	or attack their entire network.
642640	645180	So definitely important with great power
645180	646380	comes great responsibility,
646380	648840	especially with a data set this large.
652540	654100	So it's cool, right?
654100	656520	Domain IP mappings, it's a lot of fun.
656520	657700	You can get some really cool insight
657700	659100	into what's out there in the cloud,
659100	660500	but it's just a start, right?
660500	662480	So we have all this data,
662480	664220	but what are we going to do with it, right?
664220	668120	And we kind of hinged and found some really core things
668120	669580	that we do with the data, right?
669580	672680	So we have these 28 million hosts
672680	675480	that we found across 11 ports,
675480	679560	but obviously, XYZ Laundromat's website
679560	681720	isn't going to pay us for that sick IDOR
681720	684460	we found in their website, right?
684460	688100	So we need to filter that down to bounty targets.
688760	694420	There's a great repo we'll get to in a bit about just that.
695500	697340	I'm blanking on the guy's name,
697340	699680	but it's basically a bug bounty targets,
699680	702840	like aggregation list that keeps a wildcard list
702840	706520	of wildcard scopes on bug bounty programs.
706520	708180	So we use that as kind of a seed
708180	710300	and then some kind of custom ones
710300	712900	that we put in there as well to run concurrently
712900	716420	with the scan and filter them off into their own database.
716420	720260	So while we have a list of every domain that we found,
720260	723440	we have a specific database just for bug bounty targets.
723620	726820	And that helps us kind of filter the data down
726820	729080	to then point into some of these other tools.
729560	731200	Another really cool thing that we'll get to
731760	734120	is we started diffing scans, right?
734120	736400	So initially we started out just running
736400	738440	kind of one a week or one every other week,
738440	741140	and we realized we could actually get a lot of coverage
741140	743460	and find some even cooler vulnerabilities
743460	745660	if we started doing this twice a week
746240	749280	and looking at what had changed in between those two days.
749280	750820	So obviously a lot of overlap,
750820	752420	but then those really new ones,
752420	754820	we realized we were catching those only,
754820	757020	but they'd only been in existence a day or two.
757120	759280	And that was really helpful to kind of focus
759280	761540	on what we needed to look at first.
762080	766120	Another really cool one is vhost discrepancies
766120	768500	or virtual host discrepancies with the host header, right?
768500	771760	So we have all these targets, but again,
771760	773760	you're looking at millions of them.
773760	775360	What is kind of a key differentiator
775360	776760	for things that might be interesting?
776760	779640	And one of those things is how they might handle virtual hosts.
779640	781860	So, and I'll get to that,
781860	783380	and we'll come to that later in the slides,
783380	785520	but you'll find some hosts in this data.
785520	788300	We found some where you can hit it by IP
788300	789780	and you'll get one result.
789780	791740	If you hit it by its domain, you'll get a different result.
791740	794500	And if you hit it by a local host header,
794500	796520	or a local host host header,
796520	798580	you will get sometimes access to stuff
798580	800360	you wouldn't have normally.
801700	804160	And then the final thing was that fingerprinting, right?
804160	806880	So being able to pull like titles, response links,
806880	809300	status codes, and take that data
809300	811340	and use it to fingerprint specific services
811340	815020	would let us key in on large technologies
815020	816820	that we knew we wanted to go after,
816820	819500	like the Grafana bug that Ben's gonna talk about
819620	821820	a little bit later and stuff like that.
821820	824680	It allows us to kind of hone in on a specific technology.
828490	829610	So, right.
829610	831350	So like I said, this is, that's the repo.
831350	831850	It's great.
831850	832830	I'd recommend everybody,
832830	835150	if you're starting out with a recon set
835150	837650	and you wanna look at like where to start doing recon on,
837650	841210	that repo right there is a great guide
841210	842790	for sure to get started.
842790	844910	Like I said, you got 1.4 billion targets
844910	846610	that creates a lot of noise.
846610	849850	Obviously not all 1.4 billion come back,
849850	851830	but out of that 28 million,
851830	853990	we really need to kind of filter it down pretty quickly
853990	857310	to get to what will actually get us some good bounties.
857850	859590	I'm so sorry, guys.
860670	862630	So being able to filter like that
863250	867630	brings us access to a smaller target set.
867710	868650	Next slide.
873300	873920	Right.
873920	875740	So like I said, the scan diffing,
875740	877560	obviously multiple scans, like I said,
877560	879340	they have some overlap,
879340	881240	but the kind of the big usefulness there
881240	884000	is determining those new hosts, right?
884000	886460	Can we see, we run on Tuesday, right?
886460	888680	And we run again on Thursday, what's changed?
888680	890980	And those new hosts from Tuesday to Thursday
890980	892400	are gonna be really interesting
892400	894600	because they're really fresh, right?
896180	900080	Along with that, we also started doing historical archives.
900600	902780	The way we've kind of been doing it in the past
902780	904120	was basically we would run on Tuesday
904120	908200	and then on Thursday, on Thursday's scan,
908200	912100	we would push Tuesday's off into cold storage,
912620	914620	just in a CSV file, flat file,
914620	917180	and then we would move Thursday's scan,
917180	921740	or we kept two scans of targets, right?
921740	923600	So Tuesday's would go into,
923600	925120	that's what I'm sorry, that's what I was trying to say.
925120	927460	Tuesday's would go into a historical database,
927460	929020	and then the previous Thursday
929020	930360	would go into cold storage,
930360	932180	and then Thursday would be the newest data,
932180	933960	and then it would continually shift, right?
934180	935860	So we can always go back
935860	940140	if we want to kind of do long-run sentiment analysis
940140	942200	of like, not sentiment analysis,
942200	944220	we want to do a long-run months analysis
944220	947780	of how Verizon spins up domains in the cloud.
947780	949600	We can look at all that historical data
950460	954060	and see like, oh, this is how they name their hosts
954060	955960	when they're deploying things to the cloud,
955960	957840	which can help us in further scans.
962430	963890	So yeah, so like I said,
963890	966870	the virtual host discrepancies is a lot of fun.
966870	968430	We found some really cool,
971790	972970	some really cool targets
972970	974210	that I guess you wouldn't have found
974210	977130	or you wouldn't have known were immediately interesting
977130	978930	just from looking at,
978930	980510	if all you had was just here's the domain
980510	982770	and here's the IP, you know,
982770	984450	you're just looking at a wall of text, right?
984450	986010	Like, what's the interesting targets here?
986010	986850	But if you take, like,
986850	988650	this is one is just one I grabbed out of the database
988650	990550	last night, kind of looking through the database.
992310	995850	You couldn't hit this host by going to the domain
996550	998550	and a local host header wouldn't work,
998550	1000610	but if you hit it just by IP,
1000610	1002250	you could get access to there.
1002250	1003490	It was an AEM instance
1003490	1005570	that was like definitely meant to be temporary
1005570	1009830	and had a lot of things exposed on it.
1010130	1012350	And stuff like doing this vhost checking
1012350	1015230	lets us see those really quickly at a glance.
1015230	1017950	So this is a tool we're actually dropping
1017950	1019890	at the end of the talk,
1019890	1023550	but it basically, we give it a target
1023550	1027130	with an IP address, a domain, and a port,
1027130	1028910	and it will run these three checks.
1028910	1031370	So it will test visiting the IP
1031370	1033590	with the host header as the IP.
1033590	1036150	We'll do the IP address with the domain as the host name
1036150	1038270	and then local host as the host header.
1038490	1040430	And you can see all those side-by-side
1040430	1041910	and really quickly at a glance,
1041910	1045550	see what might be different in the outputs there.
1049040	1050480	Yeah, and I'll let Ben take it away
1050480	1053340	for some of the cool things we found in the data.
1054320	1057260	Yeah, so again, there is millions
1057260	1058660	and millions of IP addresses, right?
1058680	1061960	There's so much of this that one person
1061960	1063740	or two people can't go through.
1063740	1068300	So we wanted to be as fast as we could with exploitation
1068300	1072620	because from the time we decided to do this talk to today,
1072620	1075440	we had roughly about maybe two, three months.
1075440	1076980	So we wanted to do things fast.
1076980	1078640	We have to do things automated.
1078660	1080340	We have to make sure we know what we're doing.
1080340	1083040	And that's kind of why we went after
1083040	1084580	all these automation things,
1084580	1087980	getting the response headers and the response code,
1087980	1090800	looking at them based on the V host and the host header
1091350	1093480	and kind of seeing all these things that could be weird,
1093480	1096300	that could lead us into getting a vulnerability, right?
1097020	1100140	So we need to do a few things first.
1100680	1103520	We need to decide if we're going to just go after targets
1103520	1106360	that are huge, like for example, Verizon Media,
1106360	1109180	or do we want to go after targets
1109180	1111900	that are vulnerable,
1111900	1114560	but it's across multiple organizations?
1114600	1116560	But we'll talk about each of those in a little bit.
1116560	1117820	So the first thing is,
1117820	1119740	you want to go after a single target, right?
1119800	1121900	Cool. What do we know about these targets?
1121900	1123820	If you watch any of my Sunday streams,
1123820	1126060	I do a lot of hacking on Yahoo.
1126400	1130540	I know how they deploy things, what mistakes they make,
1130540	1132600	where do they make those mistakes,
1132600	1135500	where their APIs are, where do they document,
1135500	1137080	where are they storing the documentation,
1137080	1140340	and also like, where are these internal and corporate hosts?
1140340	1141480	If you hack on Verizon Media,
1141480	1142940	you know that corporate.yahoo.com
1142940	1144980	isn't just the only thing, right?
1144980	1146340	There's other stuff.
1146440	1149680	So again, I talked about Verizon Media,
1151320	1154200	application.waddle and Swagger UI, they're notorious for it.
1154200	1155560	There's other variation of Swagger
1155560	1157020	that you can find on there.
1159160	1161540	Port 4443 is very interesting
1161540	1163860	because from what I've read on blog posts
1163860	1166020	and from what I've seen on that port,
1166020	1166980	it looks like a lot of times
1166980	1170060	it's meant to be internal or accessible by another app
1170060	1173360	and not directly visited by the user in the browser.
1173360	1174980	So you want to really understand your target
1174980	1177160	and understand what are some of the weird things
1177160	1178700	about this target that's important
1178700	1181320	and make sure you fingerprint for those
1181320	1183820	and look for them actively while you're hacking on it.
1185040	1187560	The next one is obviously the multiple target thing.
1187560	1188780	You just want to spray and pray.
1188780	1190860	You spray whatever vulnerability that you want
1190860	1193820	across the entire boundary table that we have.
1193920	1196140	We've set up, when our boundary table went up,
1196140	1198360	we had a set of targets, including private programs
1198360	1200140	and public programs that we hacked on.
1201740	1202740	Excuse me.
1202840	1204880	But we wanted to go after ones that are quick.
1204880	1206340	We want to get quick wins.
1206340	1207440	What's going to get us paid?
1207440	1210120	What is it going to give us some good examples for this talk?
1210500	1213660	Again, time was not on our best side.
1213660	1214900	So we looked at CVEs.
1214900	1216100	There's a ton of good CVEs
1216100	1218200	that got dropped in the past three months.
1218980	1221360	There was a lot of stuff about heap dumps
1221360	1223860	and memory leaks and stuff that comes
1223860	1225200	with Spring Boot or Jolokia.
1225200	1227200	You also want to go after API documentation
1227200	1229680	because if you have API documentation,
1229680	1230700	then you're ahead of the game.
1230700	1232960	You know how the API works, what it expects.
1233160	1236160	So it gives you a little bit of a boost in your work
1236160	1237680	when it comes up to fuzzing an API.
1238140	1239820	And of course, you want to also look for sensitive
1239820	1242280	or internal tooling or applications
1242280	1244060	that are not meant to be really publicly accessible
1244060	1249480	like Jenkins, GitLab, GitHub, Jira, Grafana, you name it.
1249480	1250860	So you want to make sure you understand
1250860	1253320	what those sensitive apps or internal toolings are
1253320	1254840	and then make sure you have a fingerprint for it.
1254840	1256620	We'll talk about all those in a little bit too.
1259040	1261300	But again, like I've been mentioning this whole time,
1261300	1263240	fingerprinting is very, very important.
1263480	1265200	You have to make sure you know
1265200	1267360	how to identify these things properly.
1267880	1270500	So the first thing you want to do is,
1270500	1272580	first of all, understand what you want to go after.
1272580	1276980	So for our case, we really heavily focused on API docs
1276980	1280200	because again, APIs could be huge.
1280200	1281800	You know, it could be 50 endpoints.
1281920	1283000	If you know how to use them
1283000	1284740	because you have the documentation, cool.
1284740	1286300	It's really fast, really easy.
1286300	1287880	You just have to go through and fuzz them.
1288220	1289540	Spring boot stuff, really easy.
1289540	1291120	If they've left it behind as a heap dump,
1291120	1292400	you drop the heap dump,
1292400	1294160	you go through, you pull creds, right?
1294160	1296740	But you have to understand what makes these things unique.
1296760	1298420	Is it something in the response header?
1298420	1299780	Is it something in the response body
1299780	1301500	when it replies on a response?
1301800	1303260	Or is it a specific endpoint?
1303260	1303940	Is it an image?
1303940	1305340	Is it an API endpoint?
1305340	1308300	Is it whatever you hit that endpoint,
1308300	1310720	does it come back with a keyword that explains
1310720	1314140	or that's obvious in this particular application.
1314140	1315740	And we'll have examples of all this in a little bit.
1315740	1317000	So Swagger, for example,
1317600	1321560	if you're looking for a Swagger doc, like here,
1322720	1324540	if you hit Swagger resources,
1324540	1327980	it actually tells you where Swagger is being stored.
1328380	1329420	You don't have to look for this.
1329420	1330620	You don't have to brute force for it,
1330620	1332640	but you can fingerprint for Swagger version
1332640	1334820	because no matter what the version is,
1334820	1337220	it's going to have this keyword in there, right?
1337580	1339800	So you want to use it as a part of your fingerprint
1339800	1341220	and the response body,
1341220	1344420	if it has Swagger version on their Swagger resources,
1344420	1345100	then that's a hit.
1345100	1346140	That's our fingerprint.
1347380	1350380	If you find a Swagger slash API docs,
1350380	1351740	and it's a JSON format,
1351740	1354160	and it doesn't tell you where you got it,
1354160	1355180	just brute force for it,
1355180	1356940	but you're brute forcing for it in mass,
1356940	1358000	you want to look for base path
1358000	1360000	because every single Swagger documentation
1360000	1362200	that is in JSON that I've seen so far,
1362200	1364000	they all have the base path in there
1364000	1365160	because you have to tell the user
1365160	1367360	where the API base path is, right?
1367360	1370160	That's our main way to fingerprint
1370160	1373620	for the JSON formatted API docs from Swagger.
1373780	1376020	And obviously, before people start reporting Swagger
1376020	1377740	vulnerability about running programs,
1377740	1379380	Swagger by itself is not a vulnerability
1380240	1381600	unless it's some internal tool
1381600	1382660	and the company wants to pay for it.
1382660	1384260	I never report them by themselves,
1384260	1385540	but it's really helpful
1385540	1387620	when you're not playing hide and seek with the API,
1387620	1389660	where you don't have to brute force for these API routes,
1389660	1391560	then you don't have to brute force for the parameters,
1391560	1392400	you don't have to brute force
1392400	1395140	if it's a put, post, or get request.
1395260	1396620	So all these things add up, right?
1397160	1398760	So as long as you have this information,
1398760	1400660	it's easier to enumerate for it.
1400900	1403280	We also went off to GraphQL at some point.
1403560	1406980	What we did here was, if you curl to GraphQL,
1406980	1409240	you host and you hit the GraphQL,
1409240	1411960	response is gonna come back as 400 bad requests.
1412060	1413120	And it's going to tell you,
1413120	1415240	hey, look, the get query is missing.
1415240	1417380	Again, this is not the only way to do this,
1417380	1419380	but it was the easiest and the fastest one.
1419480	1423120	So as long as the response code is coming back as 400,
1423120	1426140	and it has the words query missing within the body,
1426140	1427040	then we knew 100%,
1427040	1429660	there's at least some sort of GraphQL on there,
1429660	1431480	which you look for a little bit further.
1433280	1435420	And of course, if you're going after stuff like Jenkins,
1435420	1437920	Grafana, Jira, easy to enumerate for them.
1437920	1440200	There's always an endpoint, there's always a logo,
1440200	1442120	there's always an API endpoint,
1442120	1443320	or even better in the headers
1443320	1447320	or in the text response itself, in the HTTP response,
1447320	1450540	the keywords are in there, like Grafana and Jenkins.
1450820	1451680	So make it easy.
1451680	1452680	This is super simple.
1452680	1455140	As long as it's Grafana coming back,
1455740	1457840	it's not case sensitive,
1457840	1460320	whether if it's, you know, capital G
1460320	1462400	or not capital G down here,
1462400	1464100	as long as Grafana is somewhere in there,
1464100	1468880	in the root directory is redirecting us to log in,
1468880	1471440	then we know that's also a Grafana instance, right?
1471680	1473020	Those are things that we,
1473020	1475280	those are examples of things that we've came up with
1475280	1476280	as a part of our fingerprints
1477200	1479180	to make sure we're avoiding
1479180	1481900	as many false positives as possible.
1482620	1485620	But again, just because you have these fingerprints
1485620	1487540	doesn't mean you can identify them properly.
1487540	1489160	Like you have to have some sort of a tooling.
1489160	1492620	So eventually we ended up releasing a tool,
1492620	1495120	which we're gonna talk about later on.
1495260	1497200	But before all of that, you know, in the beginning,
1497200	1498240	we didn't have enough tooling.
1498240	1500740	We were still experimenting with what we wanted to use.
1500740	1503740	So we started to use this tool called Meg.
1503740	1506240	Big shout out to Tom, if you're watching this.
1507020	1510120	Tom nom nom, amazing developer, amazing hacker.
1510540	1512300	Can't say enough good stuff about this guy.
1512340	1514980	Check him out on Twitter and go to his GitHub repo.
1515520	1516420	Look for Meg.
1516420	1520620	So Meg allows you to spray one or more endpoints.
1520620	1522140	You can either give it one single endpoint
1522140	1525200	and tell it to hit a number of hosts,
1525200	1528260	or you can give it, you can customize those.
1528260	1532200	So it can be one or more hosts or one or more endpoints.
1532760	1536920	And the good thing about it is it saves the entire,
1537540	1541420	it saves a file called index under a folder called out.
1541880	1545740	And within the out index, it tells you the response code.
1545740	1549940	So if it's 302, as you can see, 404, 401, 503, 200.
1549940	1551400	This is very useful, right?
1551400	1556180	But on top of that, as I also showed in the last screen,
1556180	1558200	it saves the entire response,
1558200	1559800	the HTTP response within a folder.
1559800	1563400	So if you go and do a base on IP,
1563400	1565200	it would save them in the IP address.
1565200	1567140	If you do it based on the domain,
1567140	1568580	they would have a domain in the folder
1569920	1572140	with everything that came back as a response.
1572140	1575300	This is very, very useful because we can use this data
1575300	1577760	to see if our fingerprinting is working.
1579480	1581960	So before I jump into this,
1581960	1584380	there is 100% a better way to do this
1584380	1588380	than doing a crappy one-liner in Bash.
1588380	1589900	But again, the whole thing is to show
1589900	1594520	you don't have to be a wizard or a monstrous developer.
1594520	1595440	You don't have to have a huge developer background
1595440	1596180	to do this.
1596180	1597940	As long as you know what you're looking for
1598380	1600560	and you're not going after millions of targets,
1600560	1602080	then you could do it with Bash.
1602080	1605020	And I'll explain how this entire thing works.
1605580	1607560	So the first thing in that code that I showed
1607560	1610100	is we grep for the response code from out index.
1610100	1613980	Remember, out index is where it saves the request
1613980	1616100	that you sent out and it tells you if it came back as 200
1616100	1617700	or if it's not there, right?
1617820	1621020	So right now I'm greping for anything that came back 200
1621020	1624100	in out index, a lot of metrics, right?
1624620	1625700	In that portion.
1625700	1627180	Then we feed this to cut and we say,
1627180	1628960	hey, I want you to cut out everything
1628960	1630120	after this space right here
1630120	1633380	because I want to know where this response is stored.
1633940	1636180	And I want you to store it and make sure it's unique.
1636180	1637040	And you don't need to do this.
1637040	1638080	It's just a bad habit of mine
1638080	1640360	that I always have to make sure I don't have any duplicates.
1640700	1644340	So now we have the location of every single HTTP response
1644340	1646680	that came back and make a save for us
1647080	1650060	that was also 200 for this thing that we were looking for.
1650280	1650880	Cool.
1651120	1652740	Now I want to loop through all of these
1652740	1654940	and we want to read every single one of these files
1654940	1657720	and check it against our fingerprint.
1657820	1659680	So we do a quick XARG.
1659740	1661520	We say for every single one of them,
1661520	1664800	we want to feed it to grep and we're using the dash H
1664800	1667500	so it shows a file name for where the fingerprint matches.
1667980	1669720	And we're doing the dash I
1669720	1671740	because that's where it ignores case.
1671740	1673020	So if it's, you know, capital
1673020	1675780	and we didn't give it a capitalized letter,
1675780	1677360	it's going to ignore it completely.
1677860	1680000	And it's going to run the fingerprint.
1680000	1681580	So example, if we're looking for swagger
1681580	1684540	within the fingerprint, we'll put swagger resources
1684540	1686240	or sorry, we'll put swagger version
1686780	1688920	and it will loop through all of those files and say,
1688920	1690680	okay, this one has swagger version in it.
1690680	1692300	This one doesn't, this one does it.
1692460	1693920	And it keeps on giving it to you.
1694120	1695060	And then you cut it again
1695800	1700120	because you want to get the path of the ones that match.
1700120	1702700	Because again, if we do grep dash H,
1702700	1705720	it's going to give you the location of the file
1705720	1706920	and it's going to tell you what line.
1706920	1707940	So you want to cut that out
1707940	1711520	and only get the path so you can confirm it manually.
1711520	1714180	I saved this entire thing under search.
1714180	1716800	So I have a command called search on my box.
1716800	1719240	So when I type in search, I give it a response code
1719240	1722300	and I tell it the fingerprint and it does the whole thing.
1722300	1723300	So let's look at some examples
1724100	1727820	of how we use Meg to eliminate false positives.
1728460	1730960	So as you remember on this slide right here,
1730960	1734460	I was talking about how if you hit swagger resources,
1734460	1736020	it will give you swagger version.
1736020	1737240	That's our fingerprint.
1737240	1738900	And it's going to come back as 200 obviously
1738900	1740200	because it exists.
1740420	1742680	Cool. We have a list of hosts from Netflix
1743460	1746340	and we're going to hit swagger resources
1746340	1748220	from every single, onto every single host
1748220	1750980	that we have found through our resources.
1750980	1752920	In this case is the database that we had
1752920	1754560	before we started fingerprinting things.
1755000	1756380	And that immediately came back
1756380	1758600	with a ton of IP addresses that matched that fingerprint.
1758600	1760520	So that every IP address that's on here
1761200	1764400	has come back as 200 right here.
1764400	1765820	And it has the word swagger version
1765820	1769380	and it probably has the location of the API docs in it.
1769760	1772480	Very useful stuff that just extends the attack service
1772480	1776040	because now you have a ton of APIs to go after, right?
1776600	1778020	Same thing with GraphQL.
1778020	1780620	I want to look for, I want to search for it.
1780620	1783000	I want it to come back, whatever it has 400
1783000	1785680	and tell me if it has the word missing
1785680	1788040	inside of the response.
1788240	1790000	And I cut it again just because I want
1790000	1791260	to just get the IP addresses.
1791260	1792560	So I'm just telling it, hey, I don't care
1792560	1795300	about the response that you stored it with Meg.
1795620	1796800	Just give me the IP addresses
1796800	1798600	because I'm going to automate some stuff on top of it
1798600	1800940	and see if I can pull information out of it, for example.
1802660	1804960	But that doesn't really scale with automation.
1804960	1808060	And I'll let Tanner talk about the fingerprinting tool
1808060	1810680	that we wrote and why we did it.
1812720	1816060	Yeah, so it's kind of that same thing, right?
1816060	1819080	Where we have all this data and it is,
1819080	1821340	it's like the command line tools are obviously
1821940	1824800	bash one-liners work, but not when you're feeding it
1824800	1831340	some giant couple hundred thousand line file of targets.
1831340	1834580	So the cool thing we were able to do
1834580	1837800	with this pipeline that we built
1837800	1841980	and this kind of framework is that we're able
1841980	1843260	to take the data from the scans
1843260	1845640	and kind of pipe it directly to these tools
1845640	1847620	to run through, right?
1847620	1853640	So the GoFingerprint kind of wraps up
1854420	1856820	that whole bash one-liner of like,
1856820	1858820	I want to take a bunch of targets,
1858820	1862800	get results from their web requests
1862800	1868320	and look through them for the things I'm interested in,
1868320	1870280	right, for the targets that I'm interested in.
1870640	1872660	And so that's really what this does.
1873080	1875260	We kind of have it set up internally for us
1875260	1876980	that when new scans come in,
1876980	1878140	this is triggered automatically
1878140	1880760	and kind of enriches that data, like I said,
1880760	1883420	and all of our records that we keep
1883420	1887180	are internally tagged with these type of things, right?
1887180	1889560	So you, and you'll see this on the repo.
1889560	1891620	I have an entire like fingerprints,
1891620	1896500	JSON file that you can add to or create your own, right,
1896500	1899380	for finding your own kind of targets
1899380	1902060	and fingerprints in the data.
1904880	1907780	Yeah, and then I don't see what Tanner said.
1907780	1909640	You want to make sure you keep these fingerprints
1909640	1911420	as simple as you can.
1911420	1914400	So you just quickly go through them and you tag stuff.
1914720	1917180	It's very important to do your fingerprinting quickly
1917180	1918220	so you can go to your data
1918220	1920660	and make sure you identify these things
1921380	1923040	as soon as they're spun up.
1924400	1926380	Should we talk about some bug bounty examples?
1927560	1928720	Let's do it.
1928920	1931880	Cool, so again, please remember that a lot of these
1931880	1934560	are from bug bounty programs that I've hacked on.
1935320	1937500	It's heavily redacted, unfortunately.
1937940	1939940	I'm hoping my redactions have done properly
1939940	1941980	before I start doing all of these.
1941980	1944340	And we changed a lot of them
1944800	1947620	and it's really hard to use real life examples.
1947620	1948920	I don't blame a lot of these companies
1948920	1950700	because you don't want to end up at DEF CON
1950700	1951940	and end up in the news.
1951940	1956480	But just remember, a lot of these vulns are super simple
1956940	1959580	but yet have been found in the last three months
1960520	1962560	and they're very, very low hanging fruit.
1962560	1965640	And it's just to show if you have the right data,
1965640	1967520	it doesn't even have to be to the extreme
1967520	1968760	that we went with this talk.
1968760	1970300	If you have the right data,
1970300	1972560	you know how to process it and store it,
1972560	1975140	then you can find a ton of good and easy bugs with it.
1976520	1978400	So the first one I'm going to get out of the way
1978400	1979660	is I have no screenshots.
1979660	1981320	I couldn't get this approved, unfortunately,
1981320	1982600	but it was really, really unique
1982600	1986800	because I've gone the same exact XSS six times in a row,
1986800	1989120	the same exact payload and exact endpoint
1989620	1991800	on the same target over and over again
1991800	1993460	for the past few months.
1993460	1994840	So how does it look?
1995140	1996540	So about a year ago,
1996540	1999060	big shout out to actually Space Raccoon for this one.
1999060	2000720	If you don't know Space Raccoon, Eugene,
2000720	2003040	awesome hacker, go follow him on Twitter.
2003300	2005880	We're collaborating on this private program on HackerOne.
2006460	2007500	Casually send him a link
2007500	2009620	and he casually send me back a vuln.
2009800	2011620	Never thought about it ever again.
2011620	2014200	Never spoke of it, never looked for it ever again.
2014220	2015560	But me being me,
2015560	2018660	I naturally added that endpoint to my word list.
2018660	2019960	Hey, you never know what's going to happen.
2019960	2021380	You might use it later on, right?
2021600	2024100	Well, later on happens, I'm working with Tanner
2024700	2026700	and we dump another set of data.
2026740	2031880	And I rediscovered that this demo app.html thing is back up.
2031960	2034620	And we know this thing, we've already seen it.
2034620	2037980	So having access to our fingerprinting tool,
2037980	2040200	I go back to our JSON thing.
2040200	2042040	We write a fingerprint for this HTML thing.
2042040	2044360	And we say, hey, if you hit this endpoint,
2044360	2045900	it comes back as 200.
2045940	2048960	Check and see if this JavaScript file is being called.
2048960	2051720	And if it is, then we know there is an XSS in there
2051720	2054020	because they're not patching the XSS.
2054020	2055940	They're just removing it every time we find it.
2056100	2057500	And we just keep monitoring it.
2057500	2059520	So every time there's a new scan that goes up,
2059520	2061760	you grab the data, you feed it to the fingerprinting tool
2061760	2065540	and you look for this particular endpoint on that target.
2065700	2067800	And if it comes back, you can get a bounty from it.
2067800	2069360	And I've done this six times so far.
2069360	2071760	Super easy, super low hanging fruit,
2071760	2074940	but it just comes down to knowing how to monitor for it.
2075640	2081280	The next one is, first of all, kudos to RhinoRater,
2081280	2084680	Justin Garner, for getting the CVE number with LEET9,
2084680	2086840	as he calls it, 13379.
2087500	2090200	It's an on-auth SSRF in Grafana.
2090620	2093400	I'm not talking about the POC at all during this talk.
2093400	2095200	There is no talks around it at all.
2095200	2098520	If you're interested in the technical aspects
2098520	2101740	of this vulnerability, then I highly recommend going
2101740	2106120	and watching his talk from ActivityCon last weekend.
2106120	2107480	And he has a blog post out for it.
2107480	2109620	So definitely check it out if you want to learn
2109620	2112560	about this phone in particular.
2113980	2118500	So, this is the fingerprint that we came up with.
2118500	2119440	We talked about this already.
2119440	2121660	If you hit root, it 302s to login.
2121660	2123460	If it has the word Grafana in the response,
2123460	2124840	then boom, you have it.
2125200	2126600	But it's not always on 443.
2126600	2129680	We've also seen it religiously come up on 3000.
2129680	2133980	And I've also heard Justin say it comes up on 3001 as well.
2134160	2135460	So you have some fingerprints.
2136220	2137640	The 3000 thing is cool
2137640	2141580	because it doesn't have the keyword Grafana in the,
2141580	2144640	it may be a, you know, most people call it grafana.whatever,
2144640	2146460	the permutation site.com.
2146460	2149960	But in a lot of cases in 3000, it could be a wild card,
2149960	2151720	but you have a higher chance of it being Grafana
2151720	2154480	because it's on that port than you do on 443, right?
2154480	2156840	Because tons of people are hosting stuff on 443.
2158360	2159580	So how does that work?
2159580	2163840	We pull everything that's on port 443 from Bounding Table.
2163840	2167020	And again, Bounding Table is what Tan and I have put away
2167600	2170000	with targets that are valuable to us.
2170360	2172280	It was just a list of maybe 30 companies
2172280	2176740	that had a wild card program and were useful to us.
2176920	2177960	And we shoved them in there
2177960	2179900	and we're just going through them every week
2179900	2181640	or every other day almost.
2182180	2184060	So we pulled everything that has Grafana in it,
2184060	2185600	everything that's from port 3000.
2185680	2187980	You hit login on all of them with Meg.
2188660	2191820	And once you hit it with Meg, you do the same thing.
2191820	2192920	You have it searched for 200
2193300	2196780	and you want to make sure the keyword Grafana comes back.
2196780	2199240	So you know Grafana is actually on these things.
2199260	2201680	And this returns all the possible instances.
2202160	2204120	You can skip the login part.
2204120	2205760	If you don't care to fingerprint for it,
2205760	2207240	you can just directly hit the POC
2207240	2210060	and tell it to fetch the latest endpoint
2210660	2212240	on the AWS metadata.
2212240	2213940	And instead of looking for Grafana,
2213940	2217200	latest replies with user data, metadata,
2217200	2219360	and I think another folder.
2219360	2220760	So you can fingerprint to see, okay,
2220760	2225340	if my work and the response of the POC
2225340	2227660	have the word meta-data in it,
2227660	2230720	and it's exploitable, flag it for me and give me the results.
2231900	2233640	But we didn't need to really do this
2233640	2237820	because we have already Grafana tagged in our bounded table.
2237820	2240800	So all we have to do is go back to our database,
2240800	2243940	type in our regular query and say,
2243940	2245760	hey, I want you to give me every domain
2245760	2248000	that was tagged as a potential Grafana.
2249080	2252000	And we could have either written a workflow for it
2252000	2254080	where it automatically exports it.
2254080	2254980	I'm against doing those
2254980	2256400	because I like to do that part manually
2256400	2258060	to make sure nothing's going wrong.
2258140	2259340	You never know if it's a typo,
2259340	2262580	if there is something wrong in your POC.
2262580	2263880	I like to do those manually.
2263960	2267840	So we'd get all those potential vulnerable instances
2267840	2270120	and do it manually and make sure they're vulnerable.
2270300	2271960	But again, you can automate it with Meg
2272520	2274220	or write your own workflow of,
2274220	2277600	if we diff it, it comes up as Grafana,
2277600	2279960	hit the POC, if the POC gives you metadata,
2279960	2281080	cool, it's vulnerable,
2281080	2284080	send a hook to Slack or Discord and let us know.
2284200	2285100	But I skip all that.
2285100	2286240	I like to do it manually.
2286420	2288300	And that was really easy to do, right?
2289480	2290620	Again, like I talked about it,
2290620	2292820	we filter the DB,
2292820	2294660	it shows all the assets tagged as Asana
2294660	2296000	and we run it through Meg
2296000	2298660	and it gave us some really good results.
2298760	2300880	But what was cool was that we realized
2300880	2304880	some of these targets weren't really doing this
2305540	2306680	just in one instance.
2306680	2307500	There was a lot of them.
2307500	2309240	This is actually a report that Justin found
2309240	2312300	and we realized there were,
2312300	2313960	I want to say 12 other instances
2313960	2317000	just because we weren't looking at the right domain
2317000	2321240	and we weren't looking at the right internal domain,
2321240	2321820	if that makes sense.
2321820	2323140	I can't talk about the company, unfortunately,
2323140	2325040	because of how private it is,
2325040	2327460	but they were fascinated by the fact
2327460	2329060	that we found so many different IP addresses
2329600	2331380	that was vulnerable to this thing.
2331860	2333820	And of course, that wasn't the only company
2333820	2334960	that was vulnerable to it.
2334960	2336620	There was a ton more,
2336620	2340220	but these were just the most recent ones that we had found.
2341380	2343960	And all of these were bounded at some point, I believe,
2343960	2345780	something big or something small.
2346260	2348760	In a lot of cases, smaller because this was a POC
2348760	2351400	that was about 40, not even 30 days old.
2351700	2354900	We were just reporting it without the expectation of bounty.
2355140	2356880	So if they gave us a bounty,
2356880	2360360	it was just an additional benefit of it.
2360500	2362940	In a lot of cases, it was more than just one asset.
2362940	2365560	So we're identifying a list of vulnerable
2365560	2368460	in that company's infrastructure and sending it to them,
2368460	2371820	which kind of made things more interesting.
2372820	2374680	So key takeaways, again,
2374680	2377300	companies may have the same happening
2377300	2379620	in multiple instances on other IPs,
2380080	2381680	but multiple instances doesn't mean
2381680	2383200	that they're gonna give you multiple bounty.
2383200	2385740	Believe me, I've dealt with that a number of times,
2385740	2388600	but multiple instances, sometimes,
2388600	2389920	or I wanna say in most cases,
2389920	2392580	it means that you're gonna get a higher reward or bonus,
2392580	2395260	but also give the teams an appropriate time to patch.
2396140	2398840	You don't wanna report CV jobs that you wanna go about.
2398840	2399580	You don't wanna be that person
2399580	2401080	that reports at the same day.
2401080	2404400	I get that, it's the security team's job
2404400	2406900	to fix these things, but it takes time.
2406900	2408080	It's not overnight.
2408560	2409940	You gotta let them go through their cycles
2410720	2412000	and let them patch it.
2412000	2414260	So if you decide to report it too early and not get money,
2414260	2415220	don't get upset.
2415220	2416580	It's a part of the game.
2416700	2420600	Give them enough time before you start mass paying for these.
2421760	2424460	So we actually went and also sprayed admin
2424460	2426320	across the entire bounty table,
2426960	2429160	just because we wanted to see, hey,
2429160	2431420	some of these IP addresses are coming back
2431420	2433360	with core or internal within them,
2433360	2437080	and they're not supposed to be accessible publicly,
2437080	2437860	more than likely, right?
2437860	2439120	Like the domain wouldn't load,
2439120	2442160	but if we hit it by IP, then it loaded some stuff.
2442160	2443280	So cool.
2443460	2445740	Let's run admin and see what comes back.
2446400	2450580	So again, we did meg, admin, ls of IPs.
2450580	2452680	We'll search for anything that came back
2452680	2455680	that had the keyword login in it and was 200.
2456040	2457620	A lot of them came back,
2457620	2459980	but we didn't have the time to go through all of them
2459980	2461060	and brute force for them.
2461060	2462440	But there was one that particularly
2462440	2464760	was very, very interesting to us,
2464760	2467660	which was this thing that redirected admin
2467660	2470580	to mgmt some folder login.
2470760	2471920	Cool. All right.
2471920	2474760	Why are we going from admin to this thing?
2474760	2476660	This has to be something interesting.
2476660	2477880	Let's just look at it.
2478080	2479540	Now, of course, when we go to mgmt,
2479540	2482180	it has an admin login page, as you can see on the right.
2483100	2483700	Okay.
2484040	2488540	And the password for the admin username and password
2488540	2489820	were admin, admin.
2490120	2491840	And as you saw the reaction,
2491840	2494820	it was anytime that I put admin, admin, and it works,
2494820	2497500	this is probably the most accurate reaction.
2498420	2499320	But that worked.
2499320	2501680	It got us logged in, but that's not fun, really.
2501680	2503940	There's nothing cool about saying,
2503940	2508220	okay, I found an admin folder, admin, admin worked.
2509120	2511360	It's cool. It's an easy bug.
2511360	2512280	It's an easy bounty.
2512280	2514560	But the bigger question is,
2515270	2517760	are they doing this in multiple places?
2517760	2519880	Is this being reused other places?
2519880	2523220	Are they using this for other applications?
2523220	2524560	How does this look?
2524560	2525860	Is this just a single app?
2525860	2527280	Is it...
2527280	2527980	Let's look at it.
2527980	2530880	So the app name is on the left side.
2530880	2533120	We rename it to XYZ.
2533120	2535820	The permutation here, it's not really a permutation.
2536460	2539500	It's the platform where the game is hosted.
2539500	2543800	So if it's iOS, if it's through Android,
2543800	2546040	other platforms that you can play this game,
2546040	2547280	I wish I could disclose this target
2547280	2549780	is obviously the domain that we can't disclose.
2549780	2551500	And then the core app is the thing
2551500	2554760	that they internally call it when you're logged in.
2554760	2555880	And it wasn't called core app.
2555880	2558820	It was something very unique to this game
2558820	2560060	that made you go,
2560060	2561980	okay, so this endpoint isn't going to come up
2561980	2563380	on other IP addresses.
2563460	2565380	But if we find an IP address
2565380	2568180	that doesn't have a hosting, for example,
2568180	2569860	within their CIDR,
2569860	2571560	but it comes back with this folder,
2571560	2573140	it means it's owned by them
2573140	2574900	and it's running the same code, right?
2574980	2575980	Okay, cool.
2576240	2577820	Now let's go back to our database.
2577820	2579700	We're going to look for this app name,
2579700	2582420	you know, the XYZ part right here.
2582520	2583340	And we're going to say,
2583340	2586320	put everything that has this XYZ portion.
2586700	2589160	And I don't care what's before and after it.
2589160	2590920	As long as that keyword is in the middle
2591480	2592960	and it has a domain,
2592960	2595040	I wish I could disclose.com in it.
2595100	2596260	Give me the results.
2596260	2597420	And I'm going to split it with Meg
2598120	2599380	and see how many come back.
2599380	2601440	So 15 of them came back to be exact.
2601640	2603340	I think some of them were patched by the time
2603340	2605400	we're fingerprinting for more of these,
2605400	2607660	but 12 of them actually allowed us to log in
2607660	2608820	with admin admin.
2608920	2611880	And each of them had access to different user data
2611880	2614120	and PII because we're on different platforms.
2614260	2616300	But from what I heard from their internal team,
2616300	2618520	it was roughly about 1 million users
2618520	2619940	that were using this thing.
2619940	2622260	And I'm 99% sure there was RCE by design
2622260	2626000	in some of the links that were in the admin panel.
2626360	2628400	So again, it was a cool bug,
2628400	2630760	but you go from one bounty to like,
2630760	2631740	hey, it's the same bug.
2631740	2633420	I'm not saying give me multiple bounties,
2633420	2635420	but there are multiple things that could be affected
2635420	2635940	by this.
2635940	2637480	The team investigates this more
2637480	2638900	and they look into it more.
2638900	2640760	And you'd usually turn out with a better bounty,
2640760	2641620	to be honest.
2644000	2647120	All right, this has to be one of the most insane
2647610	2650620	and easiest vulns that I've seen in my life.
2651380	2654820	This is on a megacorp that I know as a fact,
2654820	2656840	everybody watching this presentation
2656840	2658580	probably has heard about them.
2659120	2661280	And you definitely don't know who they are.
2661400	2664260	But unfortunately, because this just got patched
2664260	2667220	and fixed just last week,
2667220	2669240	we didn't have enough time to ask for permission.
2669460	2671840	So there might be a blog post for this later on.
2672040	2673600	But let's, before we talk about the bug,
2673600	2674800	let's talk about a few fingerprints
2674800	2676220	and things that are valuable.
2676220	2678460	If you've ever looked at Spring Boot's documentation,
2678460	2680340	there's a few things that are really interesting about it.
2680340	2683940	Every endpoint that comes back within Spring Boot,
2683940	2684740	it's really interesting.
2684740	2686380	But two of them are really, really interesting
2686380	2688720	because of the data they give you.
2688720	2690620	One of them is being the HTTP trace.
2690620	2694180	It's usually slash HTTP trace or slash trace.
2694240	2697180	That gives you information about the HTTP request
2697180	2698600	and the response exchange.
2698600	2700180	So whatever response you send it
2700180	2702820	or whatever request you send the server,
2702820	2706740	it stores it in trace up to like 50 of them, for example.
2706780	2709880	So if you're brute forcing, it also stores those in trace.
2709880	2711740	And we'll talk about that in a little bit.
2712000	2713680	And also the heap dump is obviously,
2713680	2716160	it gives you a heap dump from the applications JVM.
2717420	2719460	And according to documentation,
2719460	2724240	if you hit a Spring Boot application,
2724240	2726260	it comes back with content type as this.
2726260	2727920	So if you hit slash trace,
2727920	2730200	the response is going to have this and the header.
2730340	2732360	And that's what the documentation tells us.
2732360	2734400	Cool, let's use this, this fingerprint some stuff
2734400	2735840	and go after an org.
2737200	2739280	ZLZ and Zayed, Zayed's going to kill me
2739280	2741440	for capitalizing the Z in his name, but that's fine.
2741440	2742980	If you don't know him, follow him on Twitter.
2743140	2746020	They really, really wanted to hack this megacorp.
2746520	2747580	They were on a mission.
2747580	2749060	We have to own this company.
2749260	2750720	We have to be there internally.
2750720	2752820	We want to see what this company looks like from the inside.
2752820	2753440	Okay.
2753460	2755600	So they dumped every single asset they could find
2755600	2761200	from all of our resources, beyond our IP scans,
2761200	2763580	whatever we have, historic data, old data, new data,
2763580	2766940	whatever we have, we just dump it all into one text file.
2766940	2771680	We split every single one of them with a slash HTTP trace.
2771760	2775080	And we look for it and see which ones come back.
2775380	2776840	So in one of our exchanges,
2776840	2780820	we saw that we came across the following URL.
2780820	2782840	Again, XYZ is the app name.
2782920	2784600	It's just to protect the company.
2784620	2785720	We don't want to disclose who they are.
2785720	2787300	So the app name would be pretty obvious,
2787300	2790740	but it's XYZ-internal-prod.
2790740	2794220	And it was site.com-actuator-http-trace.
2794760	2797920	Okay. Well, let's look at it.
2797940	2800400	When we looked at it, this thing comes up.
2800480	2803240	You know, this is the information that's being stored.
2803240	2804780	It's pretty much a timestamp.
2804860	2807900	What kind of requests it was, what was the URL?
2807900	2809520	They made the request to all the headers,
2809520	2810400	including the cookie.
2810820	2812800	And also they had some other stuff right here,
2812800	2814640	user agent, blah, blah, blah, right?
2815460	2818920	But internal-prod-megacorp is what got us attention.
2819880	2822840	But the cookies that we had in that previous screenshot,
2822840	2825180	the first set of cookies that we found were not useful.
2825180	2827540	We couldn't log into that app that we were hacking on,
2827540	2829840	but we knew if we looked deeper,
2829840	2832020	maybe because we had the heap dump,
2832020	2834800	we could probably find better credentials or cookies.
2834880	2838780	But the one thing that worked out was we understood that,
2838780	2841660	okay, there's XYZ-internal-prod-site.
2841680	2844680	Does that mean there's XYZ.site.com?
2844680	2846480	Is there XYZ-internal?
2846480	2848120	Is there XYZ-prod?
2848120	2851120	And it turns out all of these different permutations exist,
2851120	2854400	and every single one of them have the same exact mistake
2854820	2860280	of having actuator HTTP trace available to hit.
2860460	2862880	So naturally we went through one of them,
2862880	2866720	and we found out that in one of the actual HTTP traces,
2866720	2868800	there are requests being made to these different things.
2868800	2871440	And again, these are all renamed,
2871440	2872900	but there was this thing called core-app.
2872900	2875860	This is the core-corp, it's the app that we're using.
2875860	2877560	There's the application, there's viewer,
2877560	2879720	and there's XYZ-services, where XYZ, again,
2879720	2882060	is what was in the subdomain name.
2882360	2885680	So there are four different apps running on this,
2885680	2888540	and they each have an actuator,
2888540	2892280	and they each have their own HTTP dump and HTTP trace.
2892420	2893920	So we dumped them all.
2894500	2896780	We saved all the results from all of them.
2896820	2898780	We also saved all the heap dumps,
2898780	2901200	and we went through every single one of them,
2901200	2902020	gripping for cookies.
2902020	2905000	And eventually we found a working session
2905000	2907580	that actually logged us into the website,
2907580	2910920	and we loaded them into Burp via match and replace.
2910920	2914960	And we eventually got access to a lot of internal sites
2914960	2916820	that we shouldn't have access to.
2916960	2921120	So, and again, just to explain the whole thing to wrap it up
2921120	2923220	is we found cookies that didn't work.
2923220	2925460	We found more instances of this thing being vulnerable
2925460	2928020	in other places within their network.
2928020	2931160	One of them actually had working employee credentials.
2931160	2934920	We plugged them into Burp Authenticator's internal app.
2935200	2937440	And on accident, when we navigated to other websites,
2937440	2939720	we realized, you know, it's automatically logging us in
2939720	2941560	because we had a match and replace set up
2941560	2943240	that we completely forgot about.
2943240	2945520	It was to the point that none of us knew how we were logged in
2945520	2948720	and then we realized ZLZ had a match and replace
2948720	2950280	that you forgot to take off.
2950420	2952660	But they gave us access to some really cool stuff.
2952660	2954840	There was 3,652 people.
2954840	2956640	I think these are all employees of this company.
2956640	2958480	We had access to their accounts on this thing.
2959320	2961200	This had a little bit of a trick
2961200	2964600	with the path normalization stuff,
2964600	2966760	but it still gave us access because we had cookies.
2967560	2969060	This is called my cells comp.
2969060	2969860	I don't know what it is,
2969860	2972900	but gave us access to some cell stuff that they did.
2973800	2978940	This one was redacted, but you can see it says welcome
2978940	2980800	with the name right here in the top right corner.
2980800	2983340	I think this thing had some weird functions
2983340	2988460	when it let us impersonate other users.
2988460	2990420	We never explored what those users were
2990420	2994300	because we were already too deep in this company's assets
2994300	2996900	that we just deleted the cookies, send an email,
2996900	2999060	apologize for doing this, but we want to show impact
2999060	3000940	and let them know this is very, very serious
3000940	3002140	and it should be fixed.
3003600	3005500	And we learned some lessons from it.
3005500	3008100	First of all, dig deep.
3008100	3009680	There's not just cookies, there's credentials
3009680	3010460	that could be in there.
3010460	3011420	It could be basics to four.
3011420	3012380	It could be keys.
3012380	3014020	It could be authorization headers.
3014740	3016160	There could be a lot more information there
3016160	3018280	than what I just explained.
3018460	3021300	The biggest lesson learned from me is to stop brute forcing
3022100	3024720	when you have HTTP trace available.
3025080	3027420	And that's because if you're doing HTTP trace
3027420	3028680	and you're monitoring it for cookies
3028680	3031000	and somebody else like me is just sending
3031000	3033200	like 200,000 requests to find another folder
3033200	3035900	that's on there, it's gonna mess up someone else's work
3035900	3037660	while they're monitoring for cookies.
3038000	3040160	And the Megacorp that we mentioned in here
3040160	3042260	wasn't the only company that was vulnerable.
3042260	3045000	So we actually went after the entire bounty table
3045000	3047540	that we had and we did the same exact thing.
3048960	3050620	But before I show those examples,
3050620	3052680	please, please understand like understanding your targets
3052680	3053900	is very, very important.
3053900	3057300	If you see one mistake being made on one app,
3057300	3059140	you get a bit that it's gonna happen again
3059140	3061300	and again and again within the infrastructure.
3062140	3065280	So this is a few examples of it.
3066120	3069080	It was just us throwing a bunch of these IP addresses
3069080	3071520	and pretty much fingerprinting for it.
3071840	3072940	Now the good stuff.
3072940	3076540	I'll let Tanner explain what we're doing next
3076540	3078320	with all these things that we've talked about.
3080820	3081900	Awesome, thanks, Ben.
3081900	3085160	Yeah, it's been a real exciting, to say the least.
3085160	3087220	It's been an exciting couple of months for sure,
3087220	3089040	really crawling through this data.
3089100	3090460	Next slide, please.
3091620	3094000	Yeah, so these are the two tools
3094610	3096000	that I mentioned kind of at the start
3096000	3098860	is GoFingerprint and VhostScan.
3098860	3103340	So GoFingerprint takes a list of URLs
3103900	3105280	and the fingerprints.
3105280	3108320	Jason, there's an example one in the repo.
3108320	3109880	You can obviously add to it
3110880	3112960	or take away the ones you think are dumb,
3112960	3114840	however it kind of suits you.
3114880	3116060	And up there in the top right
3116580	3118620	is kind of what the output you'll get back, right?
3118620	3122800	You'll get the domain that it was on
3122800	3125060	or the IP, whichever one you're kind of feeding into it,
3125060	3127860	and then a colon and then whatever it was tagged.
3127860	3131480	So you'll get back all the positive ID services.
3132480	3134780	The last one is VhostScan.
3134780	3136100	So again, like I mentioned before,
3136100	3140120	so you give it a CSV file with a host name, IP and port.
3141500	3144500	And right now it doesn't return a JSON file.
3144580	3145640	It's still kind of a new tool.
3145640	3146920	I'll be pushing some updates to it,
3146920	3150000	but right now it just kind of dumps those JSON
3154100	3156020	paths, basically just JSON objects.
3156020	3157700	They're just like printed out to the terminal
3157700	3160500	and you've got the domain, the IP and the port
3160500	3161460	from what you gave it.
3161460	3164860	And then it has the status code from hitting it by IP,
3164860	3169220	the response link by IP, the status code and response
3169220	3171680	by hitting it with a host header of the domain,
3171680	3173600	and then the status code and response
3174220	3175700	of hitting it by local host.
3175700	3178240	And then a final one called domain accessible,
3178240	3181220	which will tell you whether or not you can hit this
3181220	3184340	by its domain, the DNS record.
3184420	3186940	The point of that was we noticed in the data,
3186940	3189040	it was kind of a pretty consistent identifier
3189040	3192260	that if you had a target where you couldn't,
3192260	3194420	if you try to pull it up by domain,
3194420	3196620	even though there was a domain name or a C name
3196620	3198440	in the certificate for the IP,
3199260	3201920	you couldn't hit it by domain.
3201920	3203120	You could only hit it by IP.
3203120	3204780	And typically that ended up netting us
3204780	3206440	some more interesting targets.
3206440	3208320	So we put that in there as well as kind of a way
3208320	3213560	to differentiate them extra wise.
3214140	3215340	Next please.
3215340	3218760	This is the goldmine that I think.
3218780	3220740	We've been excited to share this last slide
3220740	3222160	for a very long time,
3222160	3225260	and I'm very excited for Tanner to release this right now.
3225580	3230080	Yeah, so this is gonna be real fun to watch.
3230700	3232880	I really hope it stays alive.
3232880	3235280	I have a hunch that the little micro instance
3235280	3237520	it's running on is probably gonna die.
3239020	3241820	Regardless, if you go to api.recon.dev,
3241820	3243260	search and then domain,
3244940	3248040	right now it's just a simple, really dumb API.
3248040	3250060	Just give it a domain you're interested in.
3250060	3251560	You don't need a period at the end of it,
3251560	3253860	just the kind of the root domain you're after.
3254800	3256240	Or really, I mean, you can do multiple, right?
3256240	3257960	You can do like foo.bar.com.
3257960	3259580	You just don't need that first period.
3259920	3264660	And you'll get a JSON array returning the domain,
3264660	3267000	the raw domain, the raw IP of the target,
3267000	3268980	and then those two things with their port
3268980	3271100	they were found on as a full URL.
3272080	3273660	So it's really dirty.
3274700	3277620	It's obviously very raw data, but it's super fun.
3277620	3279180	I think, Ben, you've got it pulled up, right?
3279180	3279980	We can give like a...
3280620	3282400	Yeah, I can actually do a demo of it
3282400	3284760	if I think it's already struggling
3284760	3286320	with how many people are hitting it.
3286420	3287300	Oh, probably.
3287380	3290480	I mean, it's, yeah, I mean, obviously it's...
3290480	3291880	So I'll show that quickly.
3291880	3294000	A lot of you know how much I love cert.sh
3294000	3296480	and I didn't like what they did with it recently.
3296480	3298400	So we thought we'd do it on our own.
3298540	3299680	Kind of looks the same almost.
3299680	3301540	You just have to get the domain out of it.
3301540	3302480	And then you can use it for OAuth.cloud
3302480	3305660	because if you hack Verizon Media, you know what's up.
3306140	3308040	So this is what it looks like
3308040	3310020	when you would get the data from it.
3310780	3312240	Yeah, so if you try to hit that
3312240	3315180	and it takes like four hours to come back,
3315180	3316000	that's not us.
3316000	3317680	That's all your other fellow hackers
3317680	3320420	that are keeping you away from really juicy P1s.
3320420	3324320	So, you know, if you want the API to stay alive,
3324320	3325840	you know, coffee goes a long way
3325840	3328440	to keeping these things running.
3328440	3331320	And again, we released, we worked on this last night.
3331320	3332680	So we're going to work on this a little bit more
3332680	3335060	and make it better as we have more time now.
3335060	3337360	But we just want to make sure there is something here
3337360	3338400	for everybody to look at.
3338400	3341280	And yeah, once this talk is over,
3341280	3343100	we'll look through it and see where it goes.
3343620	3345460	But let's quickly, we're almost out of time.
3345460	3346320	Let's do a conclusion.
3346860	3349040	First of all, understand your targets as always.
3349040	3350320	Where do they deploy their new apps?
3350320	3351420	How do they do it?
3351900	3353900	Knowing things that, mistakes they make
3354280	3355720	is very, very important.
3356220	3357280	Again, familiarize yourself
3357280	3358820	with things that you see frequently.
3358920	3361040	If you don't, if you understand how these things work,
3361040	3362480	it's easier to exploit them.
3363260	3364360	Fingerprinting becomes easier.
3364360	3365600	Make sure you have a solid understanding
3365600	3367580	of the apps and the backends.
3368000	3371520	And also get a good database of assets you care about
3371520	3372820	and make sure you keep them updated
3372820	3374980	and you keep historic data.
3374980	3375640	And you definitely, again,
3375640	3377460	you don't have to go to the extreme that we did.
3377460	3380720	A lot of this data is available on Census and Shodan.
3381600	3382960	You just have to know how to work them.
3382960	3385380	We just have the luxury of being able to do this.
3385380	3388340	And we really want to do some cool research around it.
3388340	3390880	And that's why we kind of reinvented the whole wheel again.
3392160	3393960	And again, most of these old tricks,
3393960	3395120	most of these are old tricks.
3395120	3397000	Nothing is new that I've talked about,
3397000	3399420	but it just shows that it still works
3399420	3402060	against huge megacorps.
3402060	3404320	You know, an example of the heap dump thing
3404320	3407780	that I showed you, someone with malicious intent,
3407780	3409120	that's a goldmine for them, right?
3409120	3410020	It's easy to pivot.
3410020	3411320	You already have credentials.
3411640	3412080	Who knows?
3412080	3413700	We didn't go and test any of these apps
3413700	3414640	that we had access to,
3414640	3416920	but I imagine one or two of them had SSRF
3416920	3418760	or, you know, RC or something on them
3419220	3421020	that could have elevator access.
3421520	3423060	Also, don't just collect assets
3423060	3426340	and spray random word lists at them.
3426340	3429460	I mean, there's nothing wrong with doing that,
3429460	3431500	but the chance of you getting good results
3431980	3434880	is a lot less with a target that you don't understand
3434880	3437300	versus a company that you know what folders
3437300	3438260	and files to look for,
3438260	3440460	what the naming conventions are, and so on.
3440800	3443480	And also, again, the wider you go,
3443480	3445920	the more targets you have to play with.
3446000	3449060	But again, it all comes down to how you process your data.
3450820	3454000	And I see a lot of talks about bug bounties on Twitter,
3454000	3456380	especially every year with DEF CON coming up.
3456860	3459180	I wanna say that most of these bugs that I've talked about
3459180	3461300	are found within the last few months,
3461300	3464720	and there's a good $50,000 worth of bugs in here.
3464960	3466640	So bug bounties, do they pay?
3466640	3467520	Absolutely they pay,
3467520	3469180	but you have to spend extra time
3469180	3471160	to learn about your target's behaviors,
3471160	3472920	how do they operate, what do they do?
3472920	3474920	And you have to find impactful bugs.
3475540	3479440	To keep that in mind, again,
3479440	3481880	bug bounties are about impact, not finding vulnerabilities.
3481880	3483800	So the higher impact you have, the better.
3483800	3487140	And this was a good case for it.
3487520	3489820	I don't have a reason why I put this on here.
3490120	3494020	Obviously the semicolon trick always works.
3494080	3495240	One of the slides that I showed,
3495240	3497400	I said the semicolon path normalization stuff,
3497400	3498480	this is how we did it.
3498700	3500700	But I also wanted to show how important it is
3500700	3503380	to incorporate this in your recon.
3504560	3505860	You can see it from Nafi,
3505860	3507700	there was a CV that came out not too long ago
3507700	3510580	on one of the VPN service providers,
3510580	3513380	and then you can see they're all connected.
3513380	3516300	Now, of course, if you're not doing this right now in 2020,
3516300	3517720	you're probably two years behind.
3518480	3520540	And last but not least, thank you for watching.
3520540	3523160	Thank you for the Red Team Village for having us.
3523280	3526640	And of course, thank you to Ziad, ZLZ, Donut,
3526640	3528920	Tom Nom Nom, Urbysam, and RhinoRider.
3528920	3531020	And if I forget anybody that helped us
3531020	3532600	throughout this research, I apologize,
3532600	3534960	but thank you everybody and thanks for having us.
3535400	3536920	Thanks guys, it's been great.
3537220	3540360	Awesome, thank you so much guys, amazing presentation.
3540700	3542800	Thank you so much for supporting not only DEF CON,
3542800	3544080	but the Red Team Village as well.
3544080	3544960	And as a reminder for...