1
00:00:00,440 --> 00:00:03,879
all right our speakers so you probably

2
00:00:03,879 --> 00:00:05,400
uh know our next speakers they're no

3
00:00:05,400 --> 00:00:08,160
stranger just St gone over 10 years uh

4
00:00:08,160 --> 00:00:11,280
Jason hadex and gar

5
00:00:11,280 --> 00:00:14,599
Andrews yeah yeah

6
00:00:16,680 --> 00:00:19,320
yeah Jason is the ciso and hacker in

7
00:00:19,320 --> 00:00:23,680
charge of B bu bot

8
00:00:23,680 --> 00:00:26,400
bot the world class adversary emulation

9
00:00:26,400 --> 00:00:28,279
consultancy he's had a distinguished

10
00:00:28,279 --> 00:00:30,000
15year career in cyber security

11
00:00:30,000 --> 00:00:31,840
previously serving as the ceso at

12
00:00:31,840 --> 00:00:34,200
Ubisoft head of trusts security and

13
00:00:34,200 --> 00:00:36,840
operations at bug crowd and much more

14
00:00:36,840 --> 00:00:38,120
gunar is an offensive security

15
00:00:38,120 --> 00:00:40,000
Enthusiast from the Midwest he enjoys

16
00:00:40,000 --> 00:00:42,160
offensive tool development Fitness

17
00:00:42,160 --> 00:00:44,360
adventures and gaming today they're

18
00:00:44,360 --> 00:00:46,879
going to speak on cloud Recon outly

19
00:00:46,879 --> 00:00:49,039
named uh Suite of tools for red teamers

20
00:00:49,039 --> 00:00:50,840
and Bug Hunters to find ephemeral and

21
00:00:50,840 --> 00:00:52,719
development assets and to scan Cloud

22
00:00:52,719 --> 00:00:54,640
providers for hidden Gems by inspecting

23
00:00:54,640 --> 00:00:56,440
SSL certificates let's give a warm

24
00:00:56,440 --> 00:00:58,920
welcome to these

25
00:00:58,920 --> 00:01:01,920
guys

26
00:01:02,160 --> 00:01:05,040
awesome thank you so much so uh my name

27
00:01:05,040 --> 00:01:07,400
is Jason this is Gunner as he said and

28
00:01:07,400 --> 00:01:09,280
um we're going to release a tool today

29
00:01:09,280 --> 00:01:11,119
so the repo is already online on

30
00:01:11,119 --> 00:01:13,320
Gunner's uh GitHub it's called Cloud

31
00:01:13,320 --> 00:01:14,799
Recon we'll show a screenshot at the end

32
00:01:14,799 --> 00:01:15,759
you can grab

33
00:01:15,759 --> 00:01:19,600
it so this is us um Gunner's picture is

34
00:01:19,600 --> 00:01:20,640
way better than

35
00:01:20,640 --> 00:01:23,280
mine obviously I'm surprised he wore

36
00:01:23,280 --> 00:01:25,720
sleeves though

37
00:01:26,000 --> 00:01:29,479
today uh okay so the talk as a red

38
00:01:29,479 --> 00:01:30,560
teamer

39
00:01:30,560 --> 00:01:31,880
uh it's difficult to find an

40
00:01:31,880 --> 00:01:33,680
organization's apps in the cloud if they

41
00:01:33,680 --> 00:01:35,040
are not advertised so this is one

42
00:01:35,040 --> 00:01:37,680
problem you have as a tester uh another

43
00:01:37,680 --> 00:01:39,880
issue is applications are often

44
00:01:39,880 --> 00:01:41,399
developed in the cloud while they're

45
00:01:41,399 --> 00:01:42,920
public on the internet several

46
00:01:42,920 --> 00:01:44,280
organizations have done this kind of

47
00:01:44,280 --> 00:01:46,240
thing and then our third issue is

48
00:01:46,240 --> 00:01:48,119
ephemeral Cloud hosted applications are

49
00:01:48,119 --> 00:01:50,200
sometimes brought online temporarily to

50
00:01:50,200 --> 00:01:52,719
do like one thing for like an hour and

51
00:01:52,719 --> 00:01:54,399
then they go offline and often these

52
00:01:54,399 --> 00:01:57,119
apps are never uh tested for security

53
00:01:57,119 --> 00:01:58,479
vulnerability so we're going to talk

54
00:01:58,479 --> 00:02:00,399
about addressing some of these issues

55
00:02:00,399 --> 00:02:01,320
with the tooling that we're going to

56
00:02:01,320 --> 00:02:02,240
release

57
00:02:02,240 --> 00:02:05,920
today so this is a talk from 2018 44 con

58
00:02:05,920 --> 00:02:09,399
by shubam Shaw and Michael uh gianaris

59
00:02:09,399 --> 00:02:11,360
and it was called Catch Me If You Can

60
00:02:11,360 --> 00:02:13,280
and it was about ephemeral assets and

61
00:02:13,280 --> 00:02:14,239
this is a really good talk if you

62
00:02:14,239 --> 00:02:15,680
haven't seen it but this is one slide

63
00:02:15,680 --> 00:02:18,040
out of shub's talk basically what

64
00:02:18,040 --> 00:02:20,160
happened is in

65
00:02:20,160 --> 00:02:22,879
2017 um they were looking at slack and

66
00:02:22,879 --> 00:02:25,080
they had found all of Slack's domains

67
00:02:25,080 --> 00:02:26,599
right and one was

68
00:02:26,599 --> 00:02:30,519
slack reader.com um but what had

69
00:02:30,519 --> 00:02:32,400
happened is is that they had seen this

70
00:02:32,400 --> 00:02:33,920
in one of their scans and never seen it

71
00:02:33,920 --> 00:02:36,040
again and then they saw it months later

72
00:02:36,040 --> 00:02:37,519
in their scans and never saw it again

73
00:02:37,519 --> 00:02:38,920
this was just subdomain enumeration they

74
00:02:38,920 --> 00:02:41,440
were doing all the time and so by

75
00:02:41,440 --> 00:02:43,319
continually monitoring the cloud

76
00:02:43,319 --> 00:02:44,599
eventually they found out that this

77
00:02:44,599 --> 00:02:47,400
application only went online for an hour

78
00:02:47,400 --> 00:02:50,360
a day and it did some API um

79
00:02:50,360 --> 00:02:51,879
Integrations with some other servers in

80
00:02:51,879 --> 00:02:54,560
the cloud and then it went offline and

81
00:02:54,560 --> 00:02:57,040
so by continually scanning the internet

82
00:02:57,040 --> 00:02:59,319
um for the certificate of Slack

83
00:02:59,319 --> 00:03:00,480
reader.com

84
00:03:00,480 --> 00:03:02,599
they were able to pinpoint uh when it

85
00:03:02,599 --> 00:03:06,080
came online scan for that hour it was up

86
00:03:06,080 --> 00:03:07,799
and they found out that it had a doget

87
00:03:07,799 --> 00:03:09,959
directory open to the world so in that

88
00:03:09,959 --> 00:03:13,640
dogit directory was about 1.6 gigs of

89
00:03:13,640 --> 00:03:16,239
source code and contained over 300

90
00:03:16,239 --> 00:03:18,680
hard-coded secrets so this is an example

91
00:03:18,680 --> 00:03:21,920
of an ephemeral asset comes up goes down

92
00:03:21,920 --> 00:03:23,319
um there are many others in this talk

93
00:03:23,319 --> 00:03:25,280
you can kind of check them

94
00:03:25,280 --> 00:03:27,720
out so how do we find these ephemeral

95
00:03:27,720 --> 00:03:30,000
assets um or how do we find you know

96
00:03:30,000 --> 00:03:31,640
like assets at all for a company who has

97
00:03:31,640 --> 00:03:33,879
stuff in the cloud well we use

98
00:03:33,879 --> 00:03:35,879
certificates uh but first we have to

99
00:03:35,879 --> 00:03:37,760
know where to look for the certificates

100
00:03:37,760 --> 00:03:39,840
so this is an example of AWS right so if

101
00:03:39,840 --> 00:03:41,519
you go to the reachability test page you

102
00:03:41,519 --> 00:03:43,080
can see they have listed all of their IP

103
00:03:43,080 --> 00:03:44,480
ranges right and this is public

104
00:03:44,480 --> 00:03:46,560
information every cloud provider has a

105
00:03:46,560 --> 00:03:49,200
list of every IP um that they have on

106
00:03:49,200 --> 00:03:51,080
the internet even the gov spaces right

107
00:03:51,080 --> 00:03:52,959
they're just required to by compliance

108
00:03:52,959 --> 00:03:55,079
law and so you can go here and grab all

109
00:03:55,079 --> 00:03:57,519
these IP ranges so this says this is

110
00:03:57,519 --> 00:03:58,920
everything except for you get to scroll

111
00:03:58,920 --> 00:04:00,200
down a little more this is everything

112
00:04:00,200 --> 00:04:03,680
Amazon owns right so potentially every

113
00:04:03,680 --> 00:04:06,280
site that uses AWS should be somewhere

114
00:04:06,280 --> 00:04:08,360
in one of these IP reges so how do you

115
00:04:08,360 --> 00:04:11,079
find sites of your target inside of

116
00:04:11,079 --> 00:04:14,280
these giant ranges well you look at

117
00:04:14,280 --> 00:04:16,079
certificates so when someone brings a

118
00:04:16,079 --> 00:04:18,079
site online obviously most of the time

119
00:04:18,079 --> 00:04:21,680
they use SSL htps right and so inside of

120
00:04:21,680 --> 00:04:23,440
the certificate there are certificate

121
00:04:23,440 --> 00:04:25,880
attributes which is the CN the sand the

122
00:04:25,880 --> 00:04:28,560
OU and the O and usually they have data

123
00:04:28,560 --> 00:04:30,560
like this so this is s cell.com and you

124
00:04:30,560 --> 00:04:33,280
can see inside of this certificate they

125
00:04:33,280 --> 00:04:35,280
also have references to other DNS names

126
00:04:35,280 --> 00:04:38,160
in the sand section so answers. ssl.com

127
00:04:38,160 --> 00:04:42,680
FAQ ssl.com info links reseller secure

128
00:04:42,680 --> 00:04:46,120
etc etc etc etc so what we have to do is

129
00:04:46,120 --> 00:04:48,400
we have to scan the whole Cloud range

130
00:04:48,400 --> 00:04:51,479
which is not trivial and pull down every

131
00:04:51,479 --> 00:04:53,400
certificate and look in every one of

132
00:04:53,400 --> 00:04:55,600
these fields for our Target to find out

133
00:04:55,600 --> 00:04:58,039
what they have

134
00:04:58,320 --> 00:05:00,639
online so some previous work in this

135
00:05:00,639 --> 00:05:04,160
area Arrow was c um and we loved this

136
00:05:04,160 --> 00:05:06,280
tool um problem is it's not currently

137
00:05:06,280 --> 00:05:09,080
really maintained uh or up to date um

138
00:05:09,080 --> 00:05:10,600
and it didn't fit all of our use cases

139
00:05:10,600 --> 00:05:12,560
we want to be able to do this really

140
00:05:12,560 --> 00:05:14,280
really really quickly to catch those

141
00:05:14,280 --> 00:05:16,720
ephemeral assets with our tool you could

142
00:05:16,720 --> 00:05:18,919
run multiple instances of it and it

143
00:05:18,919 --> 00:05:21,319
could tell you for any one given uh

144
00:05:21,319 --> 00:05:24,800
company um basically you know every 5

145
00:05:24,800 --> 00:05:26,479
minutes if they something pops up on the

146
00:05:26,479 --> 00:05:30,759
Internet so okay other in this area was

147
00:05:30,759 --> 00:05:33,000
uh this hacker group called ker jagger.

148
00:05:33,000 --> 00:05:37,080
gay um they didn't release any tooling

149
00:05:37,080 --> 00:05:39,039
but they did release this website that

150
00:05:39,039 --> 00:05:40,800
you go and they would scan all SSL

151
00:05:40,800 --> 00:05:42,520
certificates and dump all of the output

152
00:05:42,520 --> 00:05:45,319
of their tooling to these folders and

153
00:05:45,319 --> 00:05:46,639
you could just download the files and

154
00:05:46,639 --> 00:05:49,120
then parse them with grep right and so

155
00:05:49,120 --> 00:05:51,000
this was good some other things in this

156
00:05:51,000 --> 00:05:52,479
area you could think of is showon

157
00:05:52,479 --> 00:05:55,199
handles looking for certificates and so

158
00:05:55,199 --> 00:05:56,840
does cert. SSH but they all have

159
00:05:56,840 --> 00:05:58,160
drawbacks and we'll talk about the

160
00:05:58,160 --> 00:06:00,800
drawbacks kind of at the

161
00:06:00,800 --> 00:06:03,720
end okay so today we're releasing Cloud

162
00:06:03,720 --> 00:06:07,080
Recon the the repo should be up right

163
00:06:07,080 --> 00:06:10,639
mhm repo should be up and I think Gunner

164
00:06:10,639 --> 00:06:12,479
is going to give us a go actually we

165
00:06:12,479 --> 00:06:13,960
have a recorded one and then were we

166
00:06:13,960 --> 00:06:15,560
going to do a live one too yep okay so

167
00:06:15,560 --> 00:06:17,280
we'll do the recorded one first so this

168
00:06:17,280 --> 00:06:19,319
is cloud Recon it's built into three

169
00:06:19,319 --> 00:06:23,319
modules so scrape store and

170
00:06:23,319 --> 00:06:25,840
retrieve and here you can just give it

171
00:06:25,840 --> 00:06:27,520
Cloud Recon

172
00:06:27,520 --> 00:06:31,720
scrape and it'll take an IP uh range or

173
00:06:31,720 --> 00:06:33,639
it'll take a file of

174
00:06:33,639 --> 00:06:38,680
ips so here is uh two um here's two IPS

175
00:06:38,680 --> 00:06:40,160
and you can see we're getting the

176
00:06:40,160 --> 00:06:41,919
certificate metadata from those really

177
00:06:41,919 --> 00:06:43,880
quickly those were hacker 1's

178
00:06:43,880 --> 00:06:46,479
ranges um and now we're going to change

179
00:06:46,479 --> 00:06:49,160
it to store

180
00:06:49,160 --> 00:06:50,960
store we're going to store those in our

181
00:06:50,960 --> 00:06:53,880
DB to keep them for long-term storage so

182
00:06:53,880 --> 00:06:55,080
we can retrieve them later and then

183
00:06:55,080 --> 00:06:56,919
we're going to use retrieve to grab all

184
00:06:56,919 --> 00:06:58,400
the

185
00:06:58,400 --> 00:07:01,400
data

186
00:07:08,000 --> 00:07:11,400
I think yes yes yeah there we go Okay

187
00:07:11,400 --> 00:07:13,919
cool so it stores it in Json output and

188
00:07:13,919 --> 00:07:17,280
um okay so that's the recorded one um do

189
00:07:17,280 --> 00:07:18,560
you want to do a live one real quick we

190
00:07:18,560 --> 00:07:21,800
do a couple absolutely okay so I'm going

191
00:07:21,800 --> 00:07:23,400
you have to pass the mic cuz they can

192
00:07:23,400 --> 00:07:26,039
hear through that yeah okay so uh we're

193
00:07:26,039 --> 00:07:28,520
going to do state.gov as an example um

194
00:07:28,520 --> 00:07:29,879
because why not

195
00:07:29,879 --> 00:07:32,080
um but again this can be done for

196
00:07:32,080 --> 00:07:33,879
anything uh similar to what Jason was

197
00:07:33,879 --> 00:07:35,400
talking about so I actually ran the tool

198
00:07:35,400 --> 00:07:37,360
for this demo last night I ran it

199
00:07:37,360 --> 00:07:40,680
against all of AWS all of gcp all of

200
00:07:40,680 --> 00:07:42,840
azure all of azure gov all of Len Noe

201
00:07:42,840 --> 00:07:44,560
all of digital ocean some of Facebook

202
00:07:44,560 --> 00:07:46,800
and some of open AI space and it ran in

203
00:07:46,800 --> 00:07:49,120
2 hours and 20 minutes on Port

204
00:07:49,120 --> 00:07:53,599
443 on about a $30 digital ocean VPS

205
00:07:53,599 --> 00:07:55,919
okay so um that's the point of the the

206
00:07:55,919 --> 00:07:57,960
scrape the store version where you're

207
00:07:57,960 --> 00:08:00,199
storing it to a local DB obviously you

208
00:08:00,199 --> 00:08:01,560
can't do as much just because of

209
00:08:01,560 --> 00:08:03,720
connection pools to the DB right so you

210
00:08:03,720 --> 00:08:07,479
can't do a million um but the scrape

211
00:08:07,479 --> 00:08:09,759
version you can and again the tool is

212
00:08:09,759 --> 00:08:12,960
built in go so it uses the best memory

213
00:08:12,960 --> 00:08:14,599
management we could possibly do so you

214
00:08:14,599 --> 00:08:16,120
don't need a whole bunch of ram it's all

215
00:08:16,120 --> 00:08:18,120
based on CPU so you can use a CPU

216
00:08:18,120 --> 00:08:21,039
purposed VPS and you can scale it up as

217
00:08:21,039 --> 00:08:23,479
fast as you want to go and you can scan

218
00:08:23,479 --> 00:08:25,759
away I I not had an issue scaling it yet

219
00:08:25,759 --> 00:08:28,479
I I put it on a $400 box for a second

220
00:08:28,479 --> 00:08:33,320
and and it goes very fast um so here

221
00:08:33,320 --> 00:08:35,200
again it's just s like a digital ocean

222
00:08:35,200 --> 00:08:37,440
box and all I'm going to do can you make

223
00:08:37,440 --> 00:08:39,519
your text bigger Control Plus or is it

224
00:08:39,519 --> 00:08:42,640
Control Plus on a Mac or maybe apple

225
00:08:42,640 --> 00:08:45,720
plus oh no command plus thought it was

226
00:08:45,720 --> 00:08:47,200
command plus that's what I thought

227
00:08:47,200 --> 00:08:49,720
perfect I need that by the way I know

228
00:08:49,720 --> 00:08:51,360
how to use my computer it's

229
00:08:51,360 --> 00:08:54,440
fine okay so can you hold this for me I

230
00:08:54,440 --> 00:08:56,279
can I will hold it right here okay so

231
00:08:56,279 --> 00:08:59,000
all we're going to do is uh I actually

232
00:08:59,000 --> 00:09:01,000
use use for my ranges is there's

233
00:09:01,000 --> 00:09:02,519
actually a repo I think the guy's name

234
00:09:02,519 --> 00:09:04,160
is Lord Alfred shout out if you happen

235
00:09:04,160 --> 00:09:06,440
to be in the room if not great um but he

236
00:09:06,440 --> 00:09:08,920
keeps a repo of all the cloud ranges up

237
00:09:08,920 --> 00:09:11,800
to date I'm pretty sure daily so I went

238
00:09:11,800 --> 00:09:15,640
into here into IP ranges whoops spelling

239
00:09:15,640 --> 00:09:18,120
and in here there's one called all which

240
00:09:18,120 --> 00:09:19,440
basically just pulls them all together

241
00:09:19,440 --> 00:09:21,279
and like I said yesterday I just used

242
00:09:21,279 --> 00:09:23,079
scrape and just dumped it in a text file

243
00:09:23,079 --> 00:09:27,160
the text file is very big um but you can

244
00:09:27,160 --> 00:09:30,360
still just cat it into GP

245
00:09:30,360 --> 00:09:33,720
and it runs fairly fast and we can do

246
00:09:33,720 --> 00:09:39,760
state gov like that and we dump a lot of

247
00:09:39,760 --> 00:09:43,360
certificate data right so uh the output

248
00:09:43,360 --> 00:09:45,320
from scraping is greable obviously like

249
00:09:45,320 --> 00:09:46,560
all the actual domains are within

250
00:09:46,560 --> 00:09:48,440
brackets and then just uh comma

251
00:09:48,440 --> 00:09:51,320
delimited so you can do grep set O

252
00:09:51,320 --> 00:09:52,880
whatever bash magic you want to do if

253
00:09:52,880 --> 00:09:54,240
you don't want to use the store function

254
00:09:54,240 --> 00:09:55,440
and you just want to run it hyper fast

255
00:09:55,440 --> 00:09:57,640
and GP it uh that's what the scrape

256
00:09:57,640 --> 00:09:59,120
function is basically for it's for if if

257
00:09:59,120 --> 00:10:01,279
you want to scale it up and just go Um

258
00:10:01,279 --> 00:10:03,600
pretty insane but you can do you can

259
00:10:03,600 --> 00:10:05,360
obviously basically do anything cuz it's

260
00:10:05,360 --> 00:10:08,120
it's Text data so you can uh basically

261
00:10:08,120 --> 00:10:10,440
you can look for IPs you can look for

262
00:10:10,440 --> 00:10:11,720
like I said domain strings you can look

263
00:10:11,720 --> 00:10:13,480
for anything like that um the store

264
00:10:13,480 --> 00:10:15,640
function is what we talked about also

265
00:10:15,640 --> 00:10:17,920
grabs the organizational info um and

266
00:10:17,920 --> 00:10:19,240
you're allowed to query that by domains

267
00:10:19,240 --> 00:10:23,480
the scraping is purely IP domain um but

268
00:10:23,480 --> 00:10:26,640
it's very fast so we use state.gov as an

269
00:10:26,640 --> 00:10:29,480
example because uh we were I was demoing

270
00:10:29,480 --> 00:10:32,399
this at RSA this technique and the head

271
00:10:32,399 --> 00:10:34,720
of the White House cyber uh walked by

272
00:10:34,720 --> 00:10:35,800
and she was like are you hacking

273
00:10:35,800 --> 00:10:38,120
state.gov like at RSA and I was like no

274
00:10:38,120 --> 00:10:41,920
it's just Recon doesn't count and um and

275
00:10:41,920 --> 00:10:43,600
so the fir the first thing I did was I

276
00:10:43,600 --> 00:10:45,560
went out to find their networks their

277
00:10:45,560 --> 00:10:47,200
their ASN basically right that's the

278
00:10:47,200 --> 00:10:48,600
first thing I do in bug Bounty or red

279
00:10:48,600 --> 00:10:50,720
team is go look at their ASN and it

280
00:10:50,720 --> 00:10:52,800
pointed to uh I didn't have any data for

281
00:10:52,800 --> 00:10:54,000
them right it didn't tell me their IP

282
00:10:54,000 --> 00:10:55,920
ranges at all and so then I went and did

283
00:10:55,920 --> 00:10:59,120
some other OS and I found out that um

284
00:10:59,120 --> 00:11:00,320
that they store most of their stuff in

285
00:11:00,320 --> 00:11:01,720
the cloud right so that's my workflow

286
00:11:01,720 --> 00:11:03,320
for a red team or bug Bounty engagement

287
00:11:03,320 --> 00:11:05,399
right check for the ASN information

288
00:11:05,399 --> 00:11:06,920
first if you get IP ranges from that

289
00:11:06,920 --> 00:11:08,720
you're going to port scan all that and

290
00:11:08,720 --> 00:11:11,560
then also check o use some ENT methods

291
00:11:11,560 --> 00:11:12,959
and see if they host anything in the

292
00:11:12,959 --> 00:11:14,600
cloud and then if they do you do this

293
00:11:14,600 --> 00:11:15,839
you find all their stuff in their cloud

294
00:11:15,839 --> 00:11:17,120
and that gives you a complete view of an

295
00:11:17,120 --> 00:11:19,320
organization their owned IP space and

296
00:11:19,320 --> 00:11:20,880
their Cloud IP

297
00:11:20,880 --> 00:11:22,839
space and then we went and presented the

298
00:11:22,839 --> 00:11:23,959
White House and they were like we didn't

299
00:11:23,959 --> 00:11:25,639
know we had a ton of this stuff online

300
00:11:25,639 --> 00:11:29,440
which was kind of scary oh okay this is

301
00:11:29,440 --> 00:11:32,320
you sure so like we talked about um

302
00:11:32,320 --> 00:11:34,920
there are tools out there that either a

303
00:11:34,920 --> 00:11:36,480
do something similar to this or have

304
00:11:36,480 --> 00:11:38,760
similar data especially um the two on

305
00:11:38,760 --> 00:11:40,120
the screen obviously are showan andert

306
00:11:40,120 --> 00:11:42,040
Dosh are some that probably some folks

307
00:11:42,040 --> 00:11:43,600
know about um so we just want to talk

308
00:11:43,600 --> 00:11:45,000
about a few differences we talked about

309
00:11:45,000 --> 00:11:46,279
serero and there are a couple other

310
00:11:46,279 --> 00:11:48,959
tools out there that do it um there are

311
00:11:48,959 --> 00:11:51,120
tools out there that do the same thing

312
00:11:51,120 --> 00:11:53,320
uh this one I've had the most luck with

313
00:11:53,320 --> 00:11:55,800
scaling quite a bit um that that's kind

314
00:11:55,800 --> 00:11:57,160
of especially with the scrape module

315
00:11:57,160 --> 00:11:58,480
that is really what we went for it's

316
00:11:58,480 --> 00:12:00,639
like super large IP ranges like the

317
00:12:00,639 --> 00:12:04,959
cloud very fast very efficiently um and

318
00:12:04,959 --> 00:12:07,000
again like in the video demo you can set

319
00:12:07,000 --> 00:12:08,480
timeouts you can drop the timeout to

320
00:12:08,480 --> 00:12:10,079
like almost none which would speed it up

321
00:12:10,079 --> 00:12:12,519
even more um and all that kind of stuff

322
00:12:12,519 --> 00:12:14,440
but for showan for instance like yes you

323
00:12:14,440 --> 00:12:15,880
can go get certificate information off

324
00:12:15,880 --> 00:12:18,480
showan but again um you're kind of

325
00:12:18,480 --> 00:12:20,480
relying on showan then to figure out how

326
00:12:20,480 --> 00:12:22,720
up toate it is uh and how truthful it is

327
00:12:22,720 --> 00:12:24,560
and all that kind of stuff versus this

328
00:12:24,560 --> 00:12:26,120
basically puts the power in your hands

329
00:12:26,120 --> 00:12:27,279
do you have it as up to date as you

330
00:12:27,279 --> 00:12:29,199
would like and on the specific asss you

331
00:12:29,199 --> 00:12:30,639
would like right so you don't have to

332
00:12:30,639 --> 00:12:31,680
like query showed in you don't have to

333
00:12:31,680 --> 00:12:34,120
pay for an API key you uh go to my

334
00:12:34,120 --> 00:12:35,680
GitHub and you download it and you run

335
00:12:35,680 --> 00:12:36,800
it on whatever you want and then you can

336
00:12:36,800 --> 00:12:39,199
have it um the thing with CSH why we

337
00:12:39,199 --> 00:12:41,839
bring it up is because Cloud Recon does

338
00:12:41,839 --> 00:12:43,760
not care if the certificate is

339
00:12:43,760 --> 00:12:46,680
self-signed if it's trusted or not um

340
00:12:46,680 --> 00:12:49,000
all that kind of stuff CSH grabs out of

341
00:12:49,000 --> 00:12:52,279
certificate authorities we do not um we

342
00:12:52,279 --> 00:12:54,839
don't care who signed it or who wrote it

343
00:12:54,839 --> 00:12:56,600
um all we care about is what's in it so

344
00:12:56,600 --> 00:12:59,079
it pulls everything and you can use use

345
00:12:59,079 --> 00:13:01,959
this uh as in the video there's a-p uh a

346
00:13:01,959 --> 00:13:03,920
port flag so if you want to use other

347
00:13:03,920 --> 00:13:06,000
TLS that you think might also be hosting

348
00:13:06,000 --> 00:13:08,040
TLS shts you can do that anything that

349
00:13:08,040 --> 00:13:10,720
uses TLS it will hit um the other

350
00:13:10,720 --> 00:13:13,000
benefits over some of these other tools

351
00:13:13,000 --> 00:13:14,880
is the likeliness that you get in

352
00:13:14,880 --> 00:13:16,639
trouble for Port scanning everyone's

353
00:13:16,639 --> 00:13:19,440
crap uh is very low because all it is is

354
00:13:19,440 --> 00:13:21,399
a TLS handshake you are not actually

355
00:13:21,399 --> 00:13:23,360
Port scanning you are sending someone a

356
00:13:23,360 --> 00:13:25,680
TLS handshake and if TLS is not on that

357
00:13:25,680 --> 00:13:27,600
Port whether it's down or whether it's

358
00:13:27,600 --> 00:13:29,160
running a different service the packet

359
00:13:29,160 --> 00:13:31,079
is just dropped you are not connecting

360
00:13:31,079 --> 00:13:33,160
to someone's Port unless there's a TLS

361
00:13:33,160 --> 00:13:34,680
handshake to be had in which case you're

362
00:13:34,680 --> 00:13:36,480
doing the TLs handshake getting the

363
00:13:36,480 --> 00:13:38,760
certificate back disconnecting and and

364
00:13:38,760 --> 00:13:40,959
going about your weight right so it's

365
00:13:40,959 --> 00:13:43,279
very fast it's very efficient and as far

366
00:13:43,279 --> 00:13:45,800
as like intrusive Recon goes is very

367
00:13:45,800 --> 00:13:47,560
lightweight so that's some of the

368
00:13:47,560 --> 00:13:48,800
benefits over some of the other stuff

369
00:13:48,800 --> 00:13:52,199
you might see out there um

370
00:13:52,199 --> 00:13:54,320
yeah so one of the things that we had

371
00:13:54,320 --> 00:13:55,680
was uh as part of the red team

372
00:13:55,680 --> 00:13:57,279
engagements I'm a part of we used ker

373
00:13:57,279 --> 00:13:59,040
Jagger which was kind of the most up

374
00:13:59,040 --> 00:14:01,160
to-date repo of this certificate data

375
00:14:01,160 --> 00:14:02,079
there used to be another one called

376
00:14:02,079 --> 00:14:04,399
buffer

377
00:14:27,680 --> 00:14:30,360
overflow.com power on my own box I don't

378
00:14:30,360 --> 00:14:32,680
want anyone to take it away from me um

379
00:14:32,680 --> 00:14:34,440
and this is the fastest thing I've ever

380
00:14:34,440 --> 00:14:36,839
seen as far as it goes for this method

381
00:14:36,839 --> 00:14:39,040
so um we tried to put a lot of work into

382
00:14:39,040 --> 00:14:41,040
that we also there was uh do we want to

383
00:14:41,040 --> 00:14:43,480
talk about the thing where um where uh

384
00:14:43,480 --> 00:14:44,720
sometimes you have to multip multiple

385
00:14:44,720 --> 00:14:46,519
request SSL to actually like see that

386
00:14:46,519 --> 00:14:52,000
it's up oh yeah so so some things like

387
00:14:52,000 --> 00:14:55,360
to uh basically disappear and reappear

388
00:14:55,360 --> 00:14:57,800
um similar to the ephemeral assets

389
00:14:57,800 --> 00:15:00,040
conversation having the power to scan in

390
00:15:00,040 --> 00:15:01,920
your own thing um and having the power

391
00:15:01,920 --> 00:15:03,800
to set timeouts and stuff like that

392
00:15:03,800 --> 00:15:05,320
there are some things that you may have

393
00:15:05,320 --> 00:15:06,959
to wait 3 seconds for instead of two or

394
00:15:06,959 --> 00:15:08,480
one for the handshake to actually

395
00:15:08,480 --> 00:15:10,959
complete right some of the other tooling

396
00:15:10,959 --> 00:15:12,959
stuff that uses like either some like

397
00:15:12,959 --> 00:15:15,000
weird or like slower version of TLS or

398
00:15:15,000 --> 00:15:16,360
it's just like running slow or that you

399
00:15:16,360 --> 00:15:18,360
know there's a lot of Route hops will

400
00:15:18,360 --> 00:15:20,279
either not show up or be false negatives

401
00:15:20,279 --> 00:15:22,399
or that kind of thing so the tool really

402
00:15:22,399 --> 00:15:23,839
allows you depending on what you're

403
00:15:23,839 --> 00:15:25,519
scanning and the infrastructure you're

404
00:15:25,519 --> 00:15:27,360
scanning and how wide you're scanning

405
00:15:27,360 --> 00:15:29,120
you can either be very th

406
00:15:29,120 --> 00:15:31,399
or you can be very fast or you can mix

407
00:15:31,399 --> 00:15:33,680
and match um cuz you're going to see a

408
00:15:33,680 --> 00:15:35,000
lot of different stuff out there that

409
00:15:35,000 --> 00:15:38,279
reacts very differently um and this

410
00:15:38,279 --> 00:15:39,560
allows you to catch as much of that as

411
00:15:39,560 --> 00:15:41,440
possible where some of the other stuff

412
00:15:41,440 --> 00:15:43,279
uh you just kind of assume um the other

413
00:15:43,279 --> 00:15:44,680
big thing too that I that I forgot to

414
00:15:44,680 --> 00:15:46,639
mention it was my turn with the mic is

415
00:15:46,639 --> 00:15:48,440
uh giving this to you means that if

416
00:15:48,440 --> 00:15:50,279
showan suddenly goes off the internet

417
00:15:50,279 --> 00:15:53,639
tomorrow uh you know hope is not lost

418
00:15:53,639 --> 00:15:55,319
type of a thing that's kind of the goal

419
00:15:55,319 --> 00:15:57,000
of putting this on your box like Jason

420
00:15:57,000 --> 00:15:58,600
said is now you don't have to rely on

421
00:15:58,600 --> 00:16:00,160
someone else's stuff whether it's right

422
00:16:00,160 --> 00:16:01,279
whether it accidentally goes away

423
00:16:01,279 --> 00:16:02,759
whether they go down whatever it may be

424
00:16:02,759 --> 00:16:05,680
so yeah one more use case is if you're

425
00:16:05,680 --> 00:16:07,279
on if you're on an internal pentest so

426
00:16:07,279 --> 00:16:08,839
you can give it ranges right and so if

427
00:16:08,839 --> 00:16:10,279
you're on an internal pentest and you

428
00:16:10,279 --> 00:16:13,000
want to find all of the websites that

429
00:16:13,000 --> 00:16:14,759
use SSL in an internal Network you give

430
00:16:14,759 --> 00:16:17,160
it your clients internal ranges and

431
00:16:17,160 --> 00:16:18,959
it'll go find that without doing a port

432
00:16:18,959 --> 00:16:21,800
scan not many of them are monitoring at

433
00:16:21,800 --> 00:16:25,240
the sock level just SSL connections uh

434
00:16:25,240 --> 00:16:27,040
they're monitoring full port scans with

435
00:16:27,040 --> 00:16:28,560
all their tools but this bypasses a lot

436
00:16:28,560 --> 00:16:31,680
lot of that type of stuff so cool well

437
00:16:31,680 --> 00:16:33,440
it was pretty short um you guys want to

438
00:16:33,440 --> 00:16:34,800
run some domains anybody want a domain

439
00:16:34,800 --> 00:16:36,759
we can run it

440
00:16:36,759 --> 00:16:39,160
against oh I had a question oh yes

441
00:16:39,160 --> 00:16:41,680
question yes uh uh sorry you already

442
00:16:41,680 --> 00:16:43,480
covered this but is it only connecting

443
00:16:43,480 --> 00:16:46,120
on 443 can you you can specify which

444
00:16:46,120 --> 00:16:48,279
Port yeah so 8443

445
00:16:48,279 --> 00:16:51,399
443 4333 what you know whatever some

446
00:16:51,399 --> 00:16:54,720
wonky Port somebody's doing for uh SSL

447
00:16:54,720 --> 00:16:56,759
yes uh quick question you guys are

448
00:16:56,759 --> 00:16:59,839
scanning IPS correct how are you guys

449
00:16:59,839 --> 00:17:02,519
approaching identifying ephemeral assets

450
00:17:02,519 --> 00:17:05,919
that are behind like a reverse proxy um

451
00:17:05,919 --> 00:17:08,599
like specific like sub or something can

452
00:17:08,599 --> 00:17:11,000
you repeat the question oh repeat we

453
00:17:11,000 --> 00:17:12,439
have to repeat the questions I can

454
00:17:12,439 --> 00:17:15,359
answer that to yeah so you're asking if

455
00:17:15,359 --> 00:17:17,640
I'm correct how we are identifying

456
00:17:17,640 --> 00:17:19,000
ephemeral assets that may be behind

457
00:17:19,000 --> 00:17:21,199
Reverse proxies by just scanning IPS

458
00:17:21,199 --> 00:17:23,760
yeah so that is part of it is because a

459
00:17:23,760 --> 00:17:25,520
lot of times those reverse proxies in

460
00:17:25,520 --> 00:17:27,000
the subject alternative names of the

461
00:17:27,000 --> 00:17:29,039
certificate will have the domain of the

462
00:17:29,039 --> 00:17:31,080
Dom they're proxying for so that's

463
00:17:31,080 --> 00:17:33,240
normally how you would catch those um

464
00:17:33,240 --> 00:17:34,840
that's basically what it would have to

465
00:17:34,840 --> 00:17:36,440
do right CU it's only parsing

466
00:17:36,440 --> 00:17:38,360
certificate data so if you hit a reverse

467
00:17:38,360 --> 00:17:40,760
proxy that's reverse proxying for some

468
00:17:40,760 --> 00:17:42,440
ephemeral asset or just any type of

469
00:17:42,440 --> 00:17:45,720
asset um sometimes those domains do come

470
00:17:45,720 --> 00:17:47,880
bundled into the certificate with it and

471
00:17:47,880 --> 00:17:49,960
that's how you would catch it um I've

472
00:17:49,960 --> 00:17:51,760
looked through it if you want to run it

473
00:17:51,760 --> 00:17:54,720
yourself and type in like internal uh

474
00:17:54,720 --> 00:17:57,640
you find a lot of interesting stuff yeah

475
00:17:57,640 --> 00:18:00,480
a lot of times come will also uh they

476
00:18:00,480 --> 00:18:02,520
will also bundle one CT for like

477
00:18:02,520 --> 00:18:04,440
internal and external assets and just

478
00:18:04,440 --> 00:18:06,880
sign it once and so like he said like

479
00:18:06,880 --> 00:18:09,120
you can you can grep for internal and

480
00:18:09,120 --> 00:18:11,440
your Target's name or you know like

481
00:18:11,440 --> 00:18:12,760
there's just a lot of stuff even in the

482
00:18:12,760 --> 00:18:14,080
example we just did I think we saw a

483
00:18:14,080 --> 00:18:15,679
couple Dev like state.gov stuff there

484
00:18:15,679 --> 00:18:17,320
was a couple Dev sites and stuff in that

485
00:18:17,320 --> 00:18:20,919
list so um

486
00:18:20,919 --> 00:18:25,240
yeah what's wrong put the URL slide oh

487
00:18:25,240 --> 00:18:29,039
the URL Slide the wait which one

488
00:18:29,039 --> 00:18:32,000
which side the oh I yeah yeah go to the

489
00:18:32,000 --> 00:18:33,280
repo yeah I was going to say I was going

490
00:18:33,280 --> 00:18:36,240
to pull up the repo yep question I think

491
00:18:36,240 --> 00:18:37,799
there's one back there yeah yeah that

492
00:18:37,799 --> 00:18:38,919
was actually my question there's a

493
00:18:38,919 --> 00:18:40,919
couple Cloud Recon tools on get which

494
00:18:40,919 --> 00:18:42,679
one specific yeah this is called Cloud

495
00:18:42,679 --> 00:18:46,640
Recon and we will go to the repo right

496
00:18:47,960 --> 00:18:50,000
now sorry we have a bunch of tools we're

497
00:18:50,000 --> 00:18:53,280
releasing today but we can't read there

498
00:18:53,280 --> 00:18:57,400
so it is uh golden SEC uh you you can't

499
00:18:57,400 --> 00:19:01,080
make the yeah there's Cloud Recon

500
00:19:01,080 --> 00:19:05,080
so any other questions yes this sir um

501
00:19:05,080 --> 00:19:07,799
so adding to the the question about

502
00:19:07,799 --> 00:19:09,679
finding things behind reverse proxies

503
00:19:09,679 --> 00:19:12,240
could this be used to also identify

504
00:19:12,240 --> 00:19:14,919
origin servers on cloud

505
00:19:14,919 --> 00:19:17,159
absolutely sometimes they sign their

506
00:19:17,159 --> 00:19:19,039
origin server with theer and then put it

507
00:19:19,039 --> 00:19:21,120
in the sand and then you're like oh why

508
00:19:21,120 --> 00:19:23,000
does that say origin and then you just

509
00:19:23,000 --> 00:19:24,720
go directly to it or if it's virtually

510
00:19:24,720 --> 00:19:26,240
hosted somehow you you add the host

511
00:19:26,240 --> 00:19:27,720
header and you visit it and you can find

512
00:19:27,720 --> 00:19:30,039
the origin of bypass all wafts basically

513
00:19:30,039 --> 00:19:31,720
that saves me so much time yes it's

514
00:19:31,720 --> 00:19:33,480
amazing it's it's how I exploit most SQL

515
00:19:33,480 --> 00:19:36,480
injection so yeah question yes so are

516
00:19:36,480 --> 00:19:38,320
you able to avoid like rate limiting and

517
00:19:38,320 --> 00:19:40,200
things like that from AWS as a whole

518
00:19:40,200 --> 00:19:42,600
because you're only hitting correct the

519
00:19:42,600 --> 00:19:43,799
the question was are we able to avoid

520
00:19:43,799 --> 00:19:45,320
rate limiting because we're only doing

521
00:19:45,320 --> 00:19:47,240
the SSL connection yes we are I have a

522
00:19:47,240 --> 00:19:49,559
good answer for and he's got more so

523
00:19:49,559 --> 00:19:51,960
when I ran it last night um again it

524
00:19:51,960 --> 00:19:53,440
finished in like a little over two hours

525
00:19:53,440 --> 00:19:55,320
for all that stuff uh I didn't use over

526
00:19:55,320 --> 00:19:57,480
800 megabits per second of network

527
00:19:57,480 --> 00:20:01,640
traffic um which is pretty low nowadays

528
00:20:01,640 --> 00:20:03,320
um so yeah you normally don't it doesn't

529
00:20:03,320 --> 00:20:04,799
blow anybody up it doesn't even blow

530
00:20:04,799 --> 00:20:06,320
like it is literally something if you

531
00:20:06,320 --> 00:20:07,520
did have a bunch of Hardware sitting in

532
00:20:07,520 --> 00:20:09,320
your house like your ISP won't even hate

533
00:20:09,320 --> 00:20:11,360
you um you would you would like really

534
00:20:11,360 --> 00:20:13,360
have to try

535
00:20:13,360 --> 00:20:15,640
hard uh the other thing is that uh with

536
00:20:15,640 --> 00:20:17,679
a single run you can do it in 2 hours if

537
00:20:17,679 --> 00:20:19,799
you're running concurrently this tool

538
00:20:19,799 --> 00:20:21,360
and you break up the IP ranges a little

539
00:20:21,360 --> 00:20:23,919
bit to each box you could have a fleet

540
00:20:23,919 --> 00:20:26,320
of servers running Cloud Recon and

541
00:20:26,320 --> 00:20:28,559
literally tell you about your Target

542
00:20:28,559 --> 00:20:30,960
every 1 minute that uh it brings new

543
00:20:30,960 --> 00:20:33,280
stuff online um and it's not that

544
00:20:33,280 --> 00:20:35,640
expensive

545
00:20:35,640 --> 00:20:38,240
so any other

546
00:20:38,240 --> 00:20:41,240
questions

547
00:20:43,679 --> 00:20:45,960
yes is Sni

548
00:20:45,960 --> 00:20:51,440
supported um yes I believe it is yes uh

549
00:20:51,440 --> 00:20:53,559
come talk to me after um we we based

550
00:20:53,559 --> 00:20:55,280
some of the code off of C which was was

551
00:20:55,280 --> 00:20:57,760
handling SS s so um come talk to me

552
00:20:57,760 --> 00:20:59,280
after

553
00:20:59,280 --> 00:21:00,320
I'll give you a more detailed

554
00:21:00,320 --> 00:21:02,280
explanation so guess question behind

555
00:21:02,280 --> 00:21:03,400
that gentleman there was one back there

556
00:21:03,400 --> 00:21:06,360
you no okay good anyone

557
00:21:06,360 --> 00:21:10,879
else great thank you thank you so

558
00:21:12,679 --> 00:21:15,679
much