1 00:00:00,399 --> 00:00:02,720 oops uh I'm allowed to search through 2 00:00:02,720 --> 00:00:04,880 this data however I want so I can put 3 00:00:04,880 --> 00:00:06,839 you know a keyword in the database and 4 00:00:06,839 --> 00:00:08,160 it gives it to me so it doesn't have to 5 00:00:08,160 --> 00:00:11,400 be a domain name it could be an actual 6 00:00:11,400 --> 00:00:13,400 uh keyword for example I could put U 7 00:00:13,400 --> 00:00:16,119 database Jenkins devops whatever or even 8 00:00:16,119 --> 00:00:17,800 a company like apple I can put that in 9 00:00:17,800 --> 00:00:23,000 there and it gives me data for it so the 10 00:00:23,000 --> 00:00:25,160 two top ports that we found you can see 11 00:00:25,160 --> 00:00:27,760 443 is an obvious one that's the one 12 00:00:27,760 --> 00:00:29,759 that we did by default no matter what 13 00:00:29,759 --> 00:00:32,920 and the second one uh it was 8443 and 14 00:00:32,920 --> 00:00:35,480 you can see there's not a whole lot in 15 00:00:35,480 --> 00:00:37,239 there really and then looking at this 16 00:00:37,239 --> 00:00:39,800 data this is school but there are other 17 00:00:39,800 --> 00:00:42,120 ports that you can look at so oops long 18 00:00:42,120 --> 00:00:44,719 one we did more of them I accident did a 19 00:00:44,719 --> 00:00:47,120 typo there and instead of 443 I put 20 00:00:47,120 --> 00:00:49,480 444 and turns out there is a lot of data 21 00:00:49,480 --> 00:00:52,840 on 444 I'm not sure why I think someone 22 00:00:52,840 --> 00:00:54,719 uh mentioned it's more secure what cuz 23 00:00:54,719 --> 00:00:58,359 it's 444 not 443 I think there's extra 24 00:00:58,359 --> 00:01:01,320 encryption there with the one uh but 25 00:01:01,320 --> 00:01:02,160 yeah there was a lot of stuff 26 00:01:02,160 --> 00:01:03,800 surprisingly on there and some big 27 00:01:03,800 --> 00:01:06,680 corporations actually use 444 uh and 28 00:01:06,680 --> 00:01:10,720 then you can see there's 10 250 6443 all 29 00:01:10,720 --> 00:01:11,720 the way to 30 00:01:11,720 --> 00:01:14,040 8983 we did a lot of different port 31 00:01:14,040 --> 00:01:15,880 numbers but some of these these the ones 32 00:01:15,880 --> 00:01:17,360 that you see on the screen are the ones 33 00:01:17,360 --> 00:01:20,240 that pretty much stayed uh consistently 34 00:01:20,240 --> 00:01:21,680 and then we didn't swap them out because 35 00:01:21,680 --> 00:01:24,479 there was really good data in 36 00:01:24,479 --> 00:01:27,560 there uh oops wrong way and then you 37 00:01:27,560 --> 00:01:29,320 know I'm I'm a statner I like to see 38 00:01:29,320 --> 00:01:30,920 data I this is literally why I do this I 39 00:01:30,920 --> 00:01:32,920 don't do it for hacking purposes I'm 40 00:01:32,920 --> 00:01:34,640 just nosy and I want to know what's on 41 00:01:34,640 --> 00:01:36,840 the internet but also give you like a 42 00:01:36,840 --> 00:01:39,079 you know visual of uh what's on there 43 00:01:39,079 --> 00:01:40,320 you can see there's a lot of government 44 00:01:40,320 --> 00:01:43,240 websites Cloud Dev internal. internal 45 00:01:43,240 --> 00:01:45,719 which is a really cool one actually uh 46 00:01:45,719 --> 00:01:48,040 how many people put dot internal saying 47 00:01:48,040 --> 00:01:49,520 it's dot internal no one's going to see 48 00:01:49,520 --> 00:01:52,920 this thing and uh no I can't um but also 49 00:01:52,920 --> 00:01:55,840 I know dotzip was a a scam by Google for 50 00:01:55,840 --> 00:01:58,159 people like us to buy domains from them 51 00:01:58,159 --> 00:01:59,520 and I want to know how many is on there 52 00:01:59,520 --> 00:02:01,880 and it's it's a small amount of you know 53 00:02:01,880 --> 00:02:03,719 domains on there um but I just want to 54 00:02:03,719 --> 00:02:05,360 put that on there for a joke of it but 55 00:02:05,360 --> 00:02:06,799 yeah you can see that obviously Doom's a 56 00:02:06,799 --> 00:02:09,318 big one but that fourth one internal is 57 00:02:09,318 --> 00:02:10,840 an interesting 58 00:02:10,840 --> 00:02:13,040 one and then you know keywords I said I 59 00:02:13,040 --> 00:02:15,440 could search for any keywords I wanted 60 00:02:15,440 --> 00:02:18,680 Dev juicy stuff sometimes you have your 61 00:02:18,680 --> 00:02:21,280 apis your uat internal get jkin this is 62 00:02:21,280 --> 00:02:22,840 just we threw stuff and see what sticks 63 00:02:22,840 --> 00:02:25,680 to the wall and um those top two are 64 00:02:25,680 --> 00:02:27,239 obviously the big ones API is a really 65 00:02:27,239 --> 00:02:28,319 cool one that we're going to talk about 66 00:02:28,319 --> 00:02:30,519 in a bit but just to show you some of 67 00:02:30,519 --> 00:02:31,560 the cool stuff that we could look 68 00:02:31,560 --> 00:02:34,440 through so this scan has its pros and 69 00:02:34,440 --> 00:02:38,400 has its cons cool it cost us $50 per 70 00:02:38,400 --> 00:02:44,400 scan per Port right so 12 ports $50 it's 71 00:02:44,400 --> 00:02:46,480 a lot of money it looks as I do the math 72 00:02:46,480 --> 00:02:47,879 right I realiz I wasted a lot more money 73 00:02:47,879 --> 00:02:50,440 than I should have on this thing but $50 74 00:02:50,440 --> 00:02:52,080 isn't bad if you're doing 443 if you're 75 00:02:52,080 --> 00:02:53,840 doing a small IP space if you're doing 76 00:02:53,840 --> 00:02:55,959 your company's IP address for example 77 00:02:55,959 --> 00:02:57,200 it's not 78 00:02:57,200 --> 00:03:00,519 bad it's up-to-date data I scan whenever 79 00:03:00,519 --> 00:03:02,760 I want I have the data whenever I want 80 00:03:02,760 --> 00:03:04,840 it so there was times when I was 81 00:03:04,840 --> 00:03:06,480 scanning on a Monday and then scanning 82 00:03:06,480 --> 00:03:08,680 on a Friday just to see what comes and 83 00:03:08,680 --> 00:03:11,239 what goes right then you have uh easily 84 00:03:11,239 --> 00:03:13,120 searchable stuff you can query whatever 85 00:03:13,120 --> 00:03:16,239 you want uh but the cons there it's not 86 00:03:16,239 --> 00:03:17,799 really the searchable data doesn't mean 87 00:03:17,799 --> 00:03:19,840 it's accurate just because the keyword 88 00:03:19,840 --> 00:03:21,720 Apple shows up doesn't mean Apple owns 89 00:03:21,720 --> 00:03:24,280 it right it could be an apple you know 90 00:03:24,280 --> 00:03:26,080 company and produces apples for example 91 00:03:26,080 --> 00:03:28,080 like a farming company uh you don't have 92 00:03:28,080 --> 00:03:29,920 any HTTP data because we didn't think 93 00:03:29,920 --> 00:03:32,040 about that we in the last ration that we 94 00:03:32,040 --> 00:03:34,080 did with our last scan we did some of 95 00:03:34,080 --> 00:03:37,239 those but it wasn't what we wanted it 96 00:03:37,239 --> 00:03:39,000 was really hard to par that data it's 97 00:03:39,000 --> 00:03:41,200 very expensive and then you're shooting 98 00:03:41,200 --> 00:03:42,360 in the dark at this point you're just 99 00:03:42,360 --> 00:03:44,879 hoping you find something cool based on 100 00:03:44,879 --> 00:03:47,120 the DNS record right so the keywords in 101 00:03:47,120 --> 00:03:49,080 there you're lucky you find something 102 00:03:49,080 --> 00:03:50,920 cool in there and then there's no V 103 00:03:50,920 --> 00:03:52,519 information we're not scanning for voles 104 00:03:52,519 --> 00:03:55,200 yet so this was the the initial scan 105 00:03:55,200 --> 00:03:57,120 which brings me to my secondary scan and 106 00:03:57,120 --> 00:03:58,439 the secondary part of what I wanted to 107 00:03:58,439 --> 00:04:02,319 do with this project so right now we 108 00:04:02,319 --> 00:04:05,640 have those entries the IP addresses and 109 00:04:05,640 --> 00:04:07,200 then the assets all the ports the 110 00:04:07,200 --> 00:04:09,000 domains and then on the right we want 111 00:04:09,000 --> 00:04:10,680 accurate data we don't want false 112 00:04:10,680 --> 00:04:13,560 positives based on the DNS we don't want 113 00:04:13,560 --> 00:04:15,720 search we want to have searchable data 114 00:04:15,720 --> 00:04:17,399 based on the fields that we care about 115 00:04:17,399 --> 00:04:18,880 so I'll say what I'll show you what 116 00:04:18,880 --> 00:04:21,399 those are and then we want visuals for 117 00:04:21,399 --> 00:04:23,280 this talk we want screenshots and things 118 00:04:23,280 --> 00:04:25,080 and something fun that I can talk about 119 00:04:25,080 --> 00:04:27,360 in this and then maybe we can identify 120 00:04:27,360 --> 00:04:29,400 vulnerabilities or leads that's what I 121 00:04:29,400 --> 00:04:32,160 call them at Mass so I'll I'll explain 122 00:04:32,160 --> 00:04:34,039 what leads are in just about that as 123 00:04:34,039 --> 00:04:37,039 well so the secondary scan looks kind of 124 00:04:37,039 --> 00:04:38,759 like this we're still doing the same 125 00:04:38,759 --> 00:04:40,720 thing except we're flipping the order of 126 00:04:40,720 --> 00:04:44,440 operation now we have our laptop this 127 00:04:44,440 --> 00:04:46,160 the the dev machine that we're using 128 00:04:46,160 --> 00:04:48,960 hits a database pulls data and it gives 129 00:04:48,960 --> 00:04:51,840 it to a crap ton of machines and we have 130 00:04:51,840 --> 00:04:53,680 it scanned that for us so this is one of 131 00:04:53,680 --> 00:04:55,919 the parts that I really struggled with 132 00:04:55,919 --> 00:04:57,120 uh I'm not sure if you guys are familiar 133 00:04:57,120 --> 00:04:59,039 I have a friend of mine NAD who's at 134 00:04:59,039 --> 00:05:00,639 trickest they just started this thing 135 00:05:00,639 --> 00:05:03,240 called trus and they just their entire 136 00:05:03,240 --> 00:05:06,520 Market is they uh distribute tasks enre 137 00:05:06,520 --> 00:05:08,759 you know through a 30 Fleet up machine 138 00:05:08,759 --> 00:05:11,039 40 60 whatever you want it to be and 139 00:05:11,039 --> 00:05:13,039 when you have you know 10 12 15 million 140 00:05:13,039 --> 00:05:15,440 IP addresses eight machines aren't going 141 00:05:15,440 --> 00:05:17,960 to cut it so I went to him I was like 142 00:05:17,960 --> 00:05:19,160 hey I know you guys are doing this could 143 00:05:19,160 --> 00:05:21,560 you help me get some data and uh let me 144 00:05:21,560 --> 00:05:23,800 just distribute this workload through it 145 00:05:23,800 --> 00:05:25,520 the workload we distributed through them 146 00:05:25,520 --> 00:05:26,880 and I think the next slide is going to 147 00:05:26,880 --> 00:05:28,880 show it in a bit but before we do the 148 00:05:28,880 --> 00:05:30,319 workload we wanted to come up with those 149 00:05:30,319 --> 00:05:33,639 example tasks so these are all like 150 00:05:33,639 --> 00:05:35,360 basic data that you need if you need a c 151 00:05:35,360 --> 00:05:36,639 name for it you grab it you want the 152 00:05:36,639 --> 00:05:39,039 title The fave icon hash the location 153 00:05:39,039 --> 00:05:40,800 header where it's going to next if it's 154 00:05:40,800 --> 00:05:42,680 going to be directed somewhere we want 155 00:05:42,680 --> 00:05:45,360 that the web server info status go 156 00:05:45,360 --> 00:05:47,080 takech whatever just run httpx is all 157 00:05:47,080 --> 00:05:48,479 I'm going to say you can do all that 158 00:05:48,479 --> 00:05:51,280 with httpx it does it all for you and 159 00:05:51,280 --> 00:05:53,240 then later we're going to look for 160 00:05:53,240 --> 00:05:55,000 interesting endpoints which we only did 161 00:05:55,000 --> 00:05:57,960 a couple that uh was actually pretty 162 00:05:57,960 --> 00:06:00,360 juicy uh so there there is we cannot 163 00:06:00,360 --> 00:06:02,160 solve our problems with the same 164 00:06:02,160 --> 00:06:04,319 thinking we used to when we created them 165 00:06:04,319 --> 00:06:06,560 so that's why uh I started doing this 166 00:06:06,560 --> 00:06:08,240 the the trickest thing is I I already 167 00:06:08,240 --> 00:06:09,599 have the data but I need it to be 168 00:06:09,599 --> 00:06:12,000 distributed this is just one simple task 169 00:06:12,000 --> 00:06:13,280 should show you what we did it's all the 170 00:06:13,280 --> 00:06:15,120 machines you can see all the nodes it 171 00:06:15,120 --> 00:06:16,759 takes a all it takes the data it goes 172 00:06:16,759 --> 00:06:18,680 through it it splits it and then it 173 00:06:18,680 --> 00:06:20,280 makes an output FS it all through these 174 00:06:20,280 --> 00:06:22,400 machines use a z grab for some other 175 00:06:22,400 --> 00:06:24,560 stuff we pull the data and then back to 176 00:06:24,560 --> 00:06:26,319 a another 177 00:06:26,319 --> 00:06:29,680 source and the pros of that was before 178 00:06:29,680 --> 00:06:32,319 we put stuff into a visual place the 179 00:06:32,319 --> 00:06:34,400 output of what I have in the last task 180 00:06:34,400 --> 00:06:38,199 is a bunch of text files it's greable 181 00:06:38,199 --> 00:06:40,720 better but not good enough yet um but 182 00:06:40,720 --> 00:06:43,319 still no visuals Gable data when you 183 00:06:43,319 --> 00:06:45,840 have like millions of Records it's not 184 00:06:45,840 --> 00:06:47,479 easy to grab you just you just sit there 185 00:06:47,479 --> 00:06:49,039 for hours waiting for it to come back 186 00:06:49,039 --> 00:06:50,400 with a result and sometimes nothing 187 00:06:50,400 --> 00:06:53,199 comes back so you just sat there for 10 188 00:06:53,199 --> 00:06:55,280 minutes uh you play like Warson or 189 00:06:55,280 --> 00:06:56,800 something and nothing still comes back 190 00:06:56,800 --> 00:06:58,039 and you're more pissed off than you were 191 00:06:58,039 --> 00:06:59,400 when you got into the game then there 192 00:06:59,400 --> 00:07:01,000 there is uh no visual 193 00:07:01,000 --> 00:07:04,160 data so the third phase of it is how do 194 00:07:04,160 --> 00:07:06,599 we parse this data how do we make it 195 00:07:06,599 --> 00:07:09,840 look good from Json and gpal stuff to 196 00:07:09,840 --> 00:07:12,280 something better well we introduce elasa 197 00:07:12,280 --> 00:07:14,400 which is just using elastic I've 198 00:07:14,400 --> 00:07:16,080 actually never used elastic for hacking 199 00:07:16,080 --> 00:07:18,919 and like Recon data very interesting 200 00:07:18,919 --> 00:07:21,560 stuff um the cool thing is there's a 201 00:07:21,560 --> 00:07:22,960 tool I think it's released today where 202 00:07:22,960 --> 00:07:25,720 it's going to come out on Monday um we 203 00:07:25,720 --> 00:07:28,879 you have to use this to push any Json 204 00:07:28,879 --> 00:07:31,319 format data you want into elastic so it 205 00:07:31,319 --> 00:07:33,080 doesn't matter what it is as long as 206 00:07:33,080 --> 00:07:35,360 it's valid Json you give it the fields 207 00:07:35,360 --> 00:07:37,639 you push this all into elastic and it 208 00:07:37,639 --> 00:07:39,759 looks gorgeous so right now what we have 209 00:07:39,759 --> 00:07:42,919 done so far is oops we've scanned 210 00:07:42,919 --> 00:07:45,400 everything we now we have a bridge 211 00:07:45,400 --> 00:07:48,879 between the initial scan secondary scan 212 00:07:48,879 --> 00:07:51,599 and then the third one being going into 213 00:07:51,599 --> 00:07:54,280 uh elastic so it's way more searchable 214 00:07:54,280 --> 00:07:55,879 better data and we can actually like 215 00:07:55,879 --> 00:07:58,680 have visuals of things and so on so what 216 00:07:58,680 --> 00:08:00,319 do you start with you start with the web 217 00:08:00,319 --> 00:08:03,159 root uh we just our first scan was we 218 00:08:03,159 --> 00:08:05,960 just hit the web rot just kep HTTP data 219 00:08:05,960 --> 00:08:08,840 title all the things I mentioned and you 220 00:08:08,840 --> 00:08:12,159 store it into uh into elastic and what 221 00:08:12,159 --> 00:08:15,520 we have now is actual searchable data 222 00:08:15,520 --> 00:08:16,960 right because we can run these tasks and 223 00:08:16,960 --> 00:08:19,759 instead of being in a a file format or a 224 00:08:19,759 --> 00:08:21,199 database format that we didn't have 225 00:08:21,199 --> 00:08:23,639 before we have all these inside of it 226 00:08:23,639 --> 00:08:25,400 you can see some of the stack the 227 00:08:25,400 --> 00:08:27,199 technology that's behind some of these 228 00:08:27,199 --> 00:08:30,039 assets if you're in like me you like the 229 00:08:30,039 --> 00:08:31,919 stats this is kind of cool to see you 230 00:08:31,919 --> 00:08:34,159 know Express has so many assets on there 231 00:08:34,159 --> 00:08:36,640 or uh Amazon web services has these and 232 00:08:36,640 --> 00:08:38,000 Eng Genex and so 233 00:08:38,000 --> 00:08:40,719 on then there's also like cool charts 234 00:08:40,719 --> 00:08:42,360 colorful charts that looks a little bit 235 00:08:42,360 --> 00:08:44,680 better this was just cool to see it so 236 00:08:44,680 --> 00:08:47,240 you know what kind of scans to do next 237 00:08:47,240 --> 00:08:48,680 you're not going to scan engine X the 238 00:08:48,680 --> 00:08:50,440 same way you do IIs you're not going to 239 00:08:50,440 --> 00:08:53,279 do express the same way you do a PHP 240 00:08:53,279 --> 00:08:54,760 application and so 241 00:08:54,760 --> 00:08:56,760 on excuse 242 00:08:56,760 --> 00:08:59,240 me so this is kind of what the dashbo 243 00:08:59,240 --> 00:09:01,279 board ended up looking like it changed a 244 00:09:01,279 --> 00:09:03,640 lot of times but it's just this was very 245 00:09:03,640 --> 00:09:05,560 helpful to have it's just when you're 246 00:09:05,560 --> 00:09:07,600 especially if you're a on The Blue Team 247 00:09:07,600 --> 00:09:08,959 side I feel like it helps you a lot to 248 00:09:08,959 --> 00:09:10,399 know what you want to fix what you want 249 00:09:10,399 --> 00:09:12,040 to focus on if your vulnerability comes 250 00:09:12,040 --> 00:09:14,200 you know what those stats look like and 251 00:09:14,200 --> 00:09:17,040 on the offensive side for me when uh 252 00:09:17,040 --> 00:09:19,240 this is a massive project so what I need 253 00:09:19,240 --> 00:09:20,920 to find things that I could just shift 254 00:09:20,920 --> 00:09:22,560 my focus to and say these are the things 255 00:09:22,560 --> 00:09:24,240 I'm going to look at the entire time and 256 00:09:24,240 --> 00:09:27,440 then shift that focus and keep moving it 257 00:09:27,440 --> 00:09:30,200 so now this is what it looks like 258 00:09:30,200 --> 00:09:32,560 uh for this search what I did was we 259 00:09:32,560 --> 00:09:35,920 just looked at the index of root so what 260 00:09:35,920 --> 00:09:38,040 websites are giving us a directory 261 00:09:38,040 --> 00:09:40,640 listing and the cool thing is uh I think 262 00:09:40,640 --> 00:09:41,839 you can't see that you can see that 263 00:09:41,839 --> 00:09:43,959 right there so you can see by size the 264 00:09:43,959 --> 00:09:46,600 length of it what actually may have some 265 00:09:46,600 --> 00:09:49,240 cool data in it because some of those 266 00:09:49,240 --> 00:09:51,440 could be just a default IIs or whatever 267 00:09:51,440 --> 00:09:53,480 that has index of web root but then you 268 00:09:53,480 --> 00:09:55,079 have these giant chunks that actually 269 00:09:55,079 --> 00:09:57,160 have folders and files in them and I 270 00:09:57,160 --> 00:09:58,600 think some of them had like backups in 271 00:09:58,600 --> 00:10:00,959 it and so on on so the content length 272 00:10:00,959 --> 00:10:03,480 also helps you distinguish what's 273 00:10:03,480 --> 00:10:05,959 useless versus what's useful based on 274 00:10:05,959 --> 00:10:08,279 what you're searching for and then you 275 00:10:08,279 --> 00:10:10,240 have things like you can use uh you look 276 00:10:10,240 --> 00:10:12,279 for Apache Flink the cool thing about 277 00:10:12,279 --> 00:10:14,279 Apache Flink is there's no 278 00:10:14,279 --> 00:10:16,040 authentication so if you hit one of 279 00:10:16,040 --> 00:10:19,000 those ports uh you can actually just go 280 00:10:19,000 --> 00:10:21,440 to it and uh just log in and look at all 281 00:10:21,440 --> 00:10:22,800 the builds and the logs that they have 282 00:10:22,800 --> 00:10:25,440 on there uh and there's a scary amount 283 00:10:25,440 --> 00:10:27,519 of them like 37 hits based on the first 284 00:10:27,519 --> 00:10:30,120 one scan that we did based on that one 285 00:10:30,120 --> 00:10:32,640 port that I just looked at then you have 286 00:10:32,640 --> 00:10:35,240 things like OCTA uh if you're not sure 287 00:10:35,240 --> 00:10:36,880 why I'm looking at OCTA is not because I 288 00:10:36,880 --> 00:10:39,240 want to know how many people use octav I 289 00:10:39,240 --> 00:10:41,320 want to know how many of them actually 290 00:10:41,320 --> 00:10:43,959 the final URL keyword is where does it 291 00:10:43,959 --> 00:10:47,839 end up so if this assets ends up in Octa 292 00:10:47,839 --> 00:10:49,839 it's internal there's a reason why it's 293 00:10:49,839 --> 00:10:51,720 behind SS so either a partner or an 294 00:10:51,720 --> 00:10:53,279 internal employee wants to have access 295 00:10:53,279 --> 00:10:57,120 to this and just because there we go and 296 00:10:57,120 --> 00:10:58,519 just because it's behind OCTA doesn't 297 00:10:58,519 --> 00:10:59,639 mean that you can't can't hit things 298 00:10:59,639 --> 00:11:03,519 behind it so do SL ping it opens so now 299 00:11:03,519 --> 00:11:05,519 you do a slash git or you know slash 300 00:11:05,519 --> 00:11:07,920 admin or whatever it is SL login.php 301 00:11:07,920 --> 00:11:10,079 whatever it opens up and you can Brute 302 00:11:10,079 --> 00:11:11,399 Force for it so just because you see an 303 00:11:11,399 --> 00:11:12,720 octop page it doesn't mean that you 304 00:11:12,720 --> 00:11:15,000 can't access things and that's like 9 305 00:11:15,000 --> 00:11:17,480 out of 10 times a lot of hackers give up 306 00:11:17,480 --> 00:11:19,040 so that's another really cool one we can 307 00:11:19,040 --> 00:11:21,120 do it with OCTA One login if a company 308 00:11:21,120 --> 00:11:23,680 has its own page of ss you fingerprint 309 00:11:23,680 --> 00:11:26,920 it and throw it in there and look for 310 00:11:26,920 --> 00:11:29,720 it and then uh this is another example 311 00:11:29,720 --> 00:11:31,440 of it we can just get more specific you 312 00:11:31,440 --> 00:11:35,200 can say I want to find for um this is a 313 00:11:35,200 --> 00:11:38,480 Jango instance that has directory 314 00:11:38,480 --> 00:11:40,600 listing so you can actually see all the 315 00:11:40,600 --> 00:11:42,320 routes for their API for the entire 316 00:11:42,320 --> 00:11:45,160 application by just looking for page not 317 00:11:45,160 --> 00:11:48,800 found at Webroot and then because Apache 318 00:11:48,800 --> 00:11:50,839 and uh AWS love to also do the same 319 00:11:50,839 --> 00:11:53,399 error we just exclude the keywords test 320 00:11:53,399 --> 00:11:55,560 page and Linux and it gives you 321 00:11:55,560 --> 00:11:56,880 something like this and this is actually 322 00:11:56,880 --> 00:11:59,639 a BG boundy program that we found and 323 00:11:59,639 --> 00:12:01,360 you can see I have all the routes for it 324 00:12:01,360 --> 00:12:02,959 there's an API doxs in there that I can 325 00:12:02,959 --> 00:12:05,519 see how the API V1 works that's where 326 00:12:05,519 --> 00:12:08,920 admin is their terms Android isn't there 327 00:12:08,920 --> 00:12:10,639 uh this is very valuable because now 328 00:12:10,639 --> 00:12:12,160 you're not shooting in the dark you know 329 00:12:12,160 --> 00:12:13,639 what to Brute Force for you know what to 330 00:12:13,639 --> 00:12:16,079 do for what to go after and you know 331 00:12:16,079 --> 00:12:17,760 where the API docks are which is even 332 00:12:17,760 --> 00:12:19,279 better so you're not even brute forcing 333 00:12:19,279 --> 00:12:21,680 for anything everything is given to you 334 00:12:21,680 --> 00:12:23,240 by just looking at 335 00:12:23,240 --> 00:12:26,440 this couple other ones this allowed host 336 00:12:26,440 --> 00:12:28,959 gives you the stock trades for Jango uh 337 00:12:28,959 --> 00:12:30,680 I've seen Keys liting these in the past 338 00:12:30,680 --> 00:12:32,360 I'm not sure if it's still the case but 339 00:12:32,360 --> 00:12:33,800 it shouldn't be out there anyways and 340 00:12:33,800 --> 00:12:36,320 that one had 8,000 hits and the one 341 00:12:36,320 --> 00:12:38,240 before it this one had another 10,000 342 00:12:38,240 --> 00:12:40,600 hits so these are just 20,000 leads you 343 00:12:40,600 --> 00:12:43,839 can look at if you are uh going after 344 00:12:43,839 --> 00:12:45,959 you know as a cyber criminal it's really 345 00:12:45,959 --> 00:12:47,480 bad when you're just Mas scanning for 346 00:12:47,480 --> 00:12:49,160 things to maybe do abart or whatever it 347 00:12:49,160 --> 00:12:52,000 is that you wanted to and then yeah this 348 00:12:52,000 --> 00:12:53,920 is one of the better ones uh this this 349 00:12:53,920 --> 00:12:56,120 is the Swagger files because I saw the 350 00:12:56,120 --> 00:12:57,720 API docs in the other one I was like huh 351 00:12:57,720 --> 00:12:59,120 I wonder how many people actually leave 352 00:12:59,120 --> 00:13:02,519 Swagger behind so we hit uh API docks 353 00:13:02,519 --> 00:13:05,880 for uh V1 V2 web rout and then also 354 00:13:05,880 --> 00:13:09,959 Swagger ui. HTML and uh 13,000 came up 355 00:13:09,959 --> 00:13:12,199 oops the other way and then this is the 356 00:13:12,199 --> 00:13:14,959 better one because this is actually 357 00:13:14,959 --> 00:13:18,160 actuator for Java apps so you get a me 358 00:13:18,160 --> 00:13:21,639 heap of the memory dump out of this and 359 00:13:21,639 --> 00:13:23,199 those actually have credentials inside 360 00:13:23,199 --> 00:13:26,360 of them uh we owned Apple two years ago 361 00:13:26,360 --> 00:13:28,040 entirely the same way there's a block 362 00:13:28,040 --> 00:13:30,639 post out there with Sam Curry um there 363 00:13:30,639 --> 00:13:32,720 was actual credentials in there and we 364 00:13:32,720 --> 00:13:35,160 had access to people. apple.com which is 365 00:13:35,160 --> 00:13:36,800 their HR site for people that work at 366 00:13:36,800 --> 00:13:39,839 app one again so this is scary that you 367 00:13:39,839 --> 00:13:42,480 know with 40 hits came up the the first 368 00:13:42,480 --> 00:13:44,440 time we scanned it and you know all 369 00:13:44,440 --> 00:13:46,639 those have data inside of them as 370 00:13:46,639 --> 00:13:48,959 well all right now let's talk about some 371 00:13:48,959 --> 00:13:50,720 example vulnerabilities I think we have 372 00:13:50,720 --> 00:13:52,880 enough time to go through really quickly 373 00:13:52,880 --> 00:13:55,240 uh these are just so the things that I 374 00:13:55,240 --> 00:13:57,680 showed you is all the scans are what do 375 00:13:57,680 --> 00:14:00,199 we look for how do we fingerprint for it 376 00:14:00,199 --> 00:14:02,160 just a Rex if this keyword or this 377 00:14:02,160 --> 00:14:04,759 pattern shows up for this endpoint it 378 00:14:04,759 --> 00:14:06,639 means it exists I want to take a look at 379 00:14:06,639 --> 00:14:09,720 it I tag it as that asset so Swagger is 380 00:14:09,720 --> 00:14:12,160 tagged as Swagger actuator is tagged as 381 00:14:12,160 --> 00:14:14,160 actuator so on you just search for it 382 00:14:14,160 --> 00:14:15,399 and shows 383 00:14:15,399 --> 00:14:17,600 up so the first one this is actually one 384 00:14:17,600 --> 00:14:18,759 of my favorite 385 00:14:18,759 --> 00:14:21,759 bugs uh I'm trying to describe this 386 00:14:21,759 --> 00:14:23,759 company without giving this name they're 387 00:14:23,759 --> 00:14:27,399 a giant Game Dev site not a gaming 388 00:14:27,399 --> 00:14:29,360 company but they help you develop 389 00:14:29,360 --> 00:14:33,040 games and um what we did uh so from the 390 00:14:33,040 --> 00:14:34,959 first initial scan the one that I showed 391 00:14:34,959 --> 00:14:37,560 very first all I did was I searched for 392 00:14:37,560 --> 00:14:39,440 anything that has the word git in it so 393 00:14:39,440 --> 00:14:41,959 GitHub and gitlab is covered in that and 394 00:14:41,959 --> 00:14:43,199 it doesn't matter what's behind it and 395 00:14:43,199 --> 00:14:45,000 what's after it so as long as it has the 396 00:14:45,000 --> 00:14:47,360 word key the keyword get in there and 397 00:14:47,360 --> 00:14:50,120 the company name in that order it's 398 00:14:50,120 --> 00:14:51,560 going to leak or it's going to give me 399 00:14:51,560 --> 00:14:53,720 the data for so we get this beautiful 400 00:14:53,720 --> 00:14:56,440 thing it says the IP address there is 401 00:14:56,440 --> 00:14:58,320 the domain name and you can see 402 00:14:58,320 --> 00:15:01,040 sometimes it says company domain2.com 403 00:15:01,040 --> 00:15:02,680 could be included in that pattern 404 00:15:02,680 --> 00:15:04,079 because we're just looking for that 405 00:15:04,079 --> 00:15:05,240 company name and 406 00:15:05,240 --> 00:15:08,079 not. and then get La get La get La no 407 00:15:08,079 --> 00:15:09,680 matter where it's at it's showing up 408 00:15:09,680 --> 00:15:11,639 right 409 00:15:11,639 --> 00:15:14,040 well the problem number one was that I 410 00:15:14,040 --> 00:15:16,440 could not access these directly through 411 00:15:16,440 --> 00:15:18,680 the DNS like the the record that we have 412 00:15:18,680 --> 00:15:21,480 for it but if you actually got the list 413 00:15:21,480 --> 00:15:23,120 of all those domains and all those IP 414 00:15:23,120 --> 00:15:24,360 addresses and just fit them to each 415 00:15:24,360 --> 00:15:26,839 other in a loop so you put the host 416 00:15:26,839 --> 00:15:29,040 header set to The Domain that you pulled 417 00:15:29,040 --> 00:15:31,160 and you to you go through all those IP 418 00:15:31,160 --> 00:15:32,759 addresses you get a hit and you are 419 00:15:32,759 --> 00:15:35,880 presented with a login but turns out you 420 00:15:35,880 --> 00:15:39,800 can actually hit SL explore and people 421 00:15:39,800 --> 00:15:42,680 forget to make their projects private so 422 00:15:42,680 --> 00:15:44,000 you can actually see the build 423 00:15:44,000 --> 00:15:46,480 information for entirely and when you do 424 00:15:46,480 --> 00:15:48,920 find that uh you can go to the project 425 00:15:48,920 --> 00:15:51,040 the job and the job ID and there is the 426 00:15:51,040 --> 00:15:54,040 entire build for that uh company's token 427 00:15:54,040 --> 00:15:55,920 in there that gave us access to the 428 00:15:55,920 --> 00:15:58,639 entire gitlab instance uh so if you just 429 00:15:58,639 --> 00:15:59,800 because you see a login page doesn't 430 00:15:59,800 --> 00:16:01,399 mean anything if you go look and see 431 00:16:01,399 --> 00:16:03,519 what this application is supposed to 432 00:16:03,519 --> 00:16:06,120 look like so if you're not familiar with 433 00:16:06,120 --> 00:16:08,600 gitlab look at what G lab looks like if 434 00:16:08,600 --> 00:16:11,880 you go to SL explore that works J has an 435 00:16:11,880 --> 00:16:13,839 endpoint Confluence has an 436 00:16:13,839 --> 00:16:16,440 endpoint um Nexus has one all of them 437 00:16:16,440 --> 00:16:18,839 have one they always leak info if it's 438 00:16:18,839 --> 00:16:20,959 not properly 439 00:16:20,959 --> 00:16:22,839 configured and yeah if you see right 440 00:16:22,839 --> 00:16:25,560 there I hit API V4 projects I gave it 441 00:16:25,560 --> 00:16:27,759 the token and it just gave me a entire 442 00:16:27,759 --> 00:16:30,040 list of their projects and I could just 443 00:16:30,040 --> 00:16:31,360 commit whatever I wanted to and do 444 00:16:31,360 --> 00:16:33,959 whatever as I please and uh would have 445 00:16:33,959 --> 00:16:36,759 been a fun little proof of 446 00:16:36,759 --> 00:16:38,759 concept the next one I want to kind of 447 00:16:38,759 --> 00:16:41,839 show is the the API specs you find API 448 00:16:41,839 --> 00:16:44,560 documentation what do you do next uh API 449 00:16:44,560 --> 00:16:46,480 docs AR usually a vulnerability on their 450 00:16:46,480 --> 00:16:48,880 own but if you look at these specs and 451 00:16:48,880 --> 00:16:50,519 you understand what the API does and 452 00:16:50,519 --> 00:16:51,759 what it's not supposed to do and you can 453 00:16:51,759 --> 00:16:55,199 kind of break it uh for the purposes of 454 00:16:55,199 --> 00:16:57,480 oops uh this presentation I had to 455 00:16:57,480 --> 00:16:59,240 change a lot of the endp points so the 456 00:16:59,240 --> 00:17:01,199 if the company shows up here and they 457 00:17:01,199 --> 00:17:02,360 see the talk they don't understand it 458 00:17:02,360 --> 00:17:04,559 was theirs so I've shifted it a little 459 00:17:04,559 --> 00:17:08,400 bit but I showed this earlier where I 460 00:17:08,400 --> 00:17:09,919 look for Swagger and you know I go 461 00:17:09,919 --> 00:17:12,439 through all this data I find a domain 462 00:17:12,439 --> 00:17:15,439 that I wanted to for this company I see 463 00:17:15,439 --> 00:17:17,240 that domain is not accessible directly 464 00:17:17,240 --> 00:17:19,359 we already know how to bypass that 465 00:17:19,359 --> 00:17:21,959 there's API docs that help us understand 466 00:17:21,959 --> 00:17:25,160 the application better but we do need a 467 00:17:25,160 --> 00:17:27,240 vulnerability though I I don't have 468 00:17:27,240 --> 00:17:29,960 anything just yet well it turns out this 469 00:17:29,960 --> 00:17:32,280 two interesting endpoints uh it's under 470 00:17:32,280 --> 00:17:33,960 or you can make your own organization 471 00:17:33,960 --> 00:17:36,120 without being authenticated and under 472 00:17:36,120 --> 00:17:37,720 that organization you can hear uh you 473 00:17:37,720 --> 00:17:39,679 can actually create web Hooks and web 474 00:17:39,679 --> 00:17:41,720 hooks if you're not familiar with them 475 00:17:41,720 --> 00:17:43,320 um they will do automation tasks you can 476 00:17:43,320 --> 00:17:44,720 have it hit a data source from the 477 00:17:44,720 --> 00:17:47,000 server it grabs data and then whatever 478 00:17:47,000 --> 00:17:48,919 that's supposed to do for that product 479 00:17:48,919 --> 00:17:51,080 it does it with that data it's a hook 480 00:17:51,080 --> 00:17:52,720 pretty much into your organization or 481 00:17:52,720 --> 00:17:55,000 your data or your third party 482 00:17:55,000 --> 00:17:58,000 services so what do you do you create 483 00:17:58,000 --> 00:17:59,559 those to both of them I create an 484 00:17:59,559 --> 00:18:01,679 organization it allows me to do a web 485 00:18:01,679 --> 00:18:04,240 hook but there's a few problems there 486 00:18:04,240 --> 00:18:05,799 one is that it requires to have the 487 00:18:05,799 --> 00:18:08,320 company domain name in the string so I 488 00:18:08,320 --> 00:18:10,679 could and what I had to do for that was 489 00:18:10,679 --> 00:18:12,440 company name.com 490 00:18:12,440 --> 00:18:14,440 mydomain.com and point that into 491 00:18:14,440 --> 00:18:16,919 whatever I wanted it to so I can bypass 492 00:18:16,919 --> 00:18:19,320 that uh restriction but I wasn't able to 493 00:18:19,320 --> 00:18:20,799 read any local files and if you're 494 00:18:20,799 --> 00:18:22,559 familiar with ssrf service side request 495 00:18:22,559 --> 00:18:24,640 forer it allows you to pretty much 496 00:18:24,640 --> 00:18:27,919 browse uh files on that machine or also 497 00:18:27,919 --> 00:18:30,240 access sites on that machine's internal 498 00:18:30,240 --> 00:18:32,159 Network so if it has access to something 499 00:18:32,159 --> 00:18:34,799 internal you can qu for it a lot of 500 00:18:34,799 --> 00:18:36,799 times people on the when they're doing 501 00:18:36,799 --> 00:18:38,760 ssrf on the cloud there's a metadata 502 00:18:38,760 --> 00:18:41,080 instance you can hit that gives you keys 503 00:18:41,080 --> 00:18:43,240 for that machine so you get AWS secrets 504 00:18:43,240 --> 00:18:45,720 and IDs for it and you can log into it 505 00:18:45,720 --> 00:18:47,640 that was not the case in here 506 00:18:47,640 --> 00:18:49,600 unfortunately but I do know I have an 507 00:18:49,600 --> 00:18:51,600 ssrf because I can hit Local Host on 508 00:18:51,600 --> 00:18:52,960 that machine so I can pull the Local 509 00:18:52,960 --> 00:18:54,720 Host page of that machine 510 00:18:54,720 --> 00:18:57,799 internally and I couldn't find anything 511 00:18:57,799 --> 00:18:59,559 but I have a database I have a database 512 00:18:59,559 --> 00:19:02,200 of domains one mine being included and 513 00:19:02,200 --> 00:19:04,200 then second one being things that I have 514 00:19:04,200 --> 00:19:06,400 found from things like start.sh and show 515 00:19:06,400 --> 00:19:08,600 in and so on so I have a list of these 516 00:19:08,600 --> 00:19:10,320 domains uh you can see there's a bunch 517 00:19:10,320 --> 00:19:13,080 of these subdomains that are under Corp 518 00:19:13,080 --> 00:19:15,679 that I cannot access based on IP address 519 00:19:15,679 --> 00:19:18,760 or even based on the DNS square that I 520 00:19:18,760 --> 00:19:21,320 have but what I can do is feed it 521 00:19:21,320 --> 00:19:22,760 through that whip hook and see what 522 00:19:22,760 --> 00:19:24,640 comes back for each of them I had a list 523 00:19:24,640 --> 00:19:26,520 of it fit it to it through burp suite 524 00:19:26,520 --> 00:19:27,880 and then I see one of them actually 525 00:19:27,880 --> 00:19:32,159 comes back with a 302 error and the sub 526 00:19:32,159 --> 00:19:35,000 name being CFG doesn't give me any uh 527 00:19:35,000 --> 00:19:37,320 hints of what it is but what I do see is 528 00:19:37,320 --> 00:19:39,840 that there is an artifactory coming back 529 00:19:39,840 --> 00:19:42,320 which is an entire source code base of 530 00:19:42,320 --> 00:19:44,159 everything they had so that keyword 531 00:19:44,159 --> 00:19:46,720 right there it gives me just a in you 532 00:19:46,720 --> 00:19:48,679 know the initial oh shoot there is 533 00:19:48,679 --> 00:19:51,400 something here I can access and you can 534 00:19:51,400 --> 00:19:52,880 actually do the same thing you can get a 535 00:19:52,880 --> 00:19:56,320 web hook give it that URL hit repository 536 00:19:56,320 --> 00:19:57,400 and it gives you a list of the 537 00:19:57,400 --> 00:19:59,600 repositories uh right off the bat so 538 00:19:59,600 --> 00:20:01,200 those are the two examples that I could 539 00:20:01,200 --> 00:20:03,120 come up with that was I think it was to 540 00:20:03,120 --> 00:20:05,000 bring the whole presentation together to 541 00:20:05,000 --> 00:20:07,000 show hey you can look for API docs and 542 00:20:07,000 --> 00:20:09,120 leads and then use them later but also 543 00:20:09,120 --> 00:20:11,240 they valuable with the value of having a 544 00:20:11,240 --> 00:20:14,080 good data set of your own while you also 545 00:20:14,080 --> 00:20:16,039 use things like SE dat s and all these 546 00:20:16,039 --> 00:20:17,520 open source tools that are out there as 547 00:20:17,520 --> 00:20:21,440 well so Lessons Learned uh data is king 548 00:20:21,440 --> 00:20:24,080 So if you as an organization it's really 549 00:20:24,080 --> 00:20:25,760 good to have your own data I think where 550 00:20:25,760 --> 00:20:28,360 you can scan when you want and you can 551 00:20:28,360 --> 00:20:30,960 scan it tailored to your company 552 00:20:30,960 --> 00:20:33,440 obviously as a bug bounty hunter or a 553 00:20:33,440 --> 00:20:35,799 pentester this is very expensive you're 554 00:20:35,799 --> 00:20:37,760 not going to do $50 scans when you're 555 00:20:37,760 --> 00:20:39,760 getting you know 50 75 an hour as a 556 00:20:39,760 --> 00:20:41,840 junior pentester it's really not worth 557 00:20:41,840 --> 00:20:43,960 it you can use showan you can use SES 558 00:20:43,960 --> 00:20:45,320 you can use 559 00:20:45,320 --> 00:20:48,640 3sh uh it is very messy and expensive I 560 00:20:48,640 --> 00:20:51,120 think we did uh I don't know eight or 561 00:20:51,120 --> 00:20:53,720 nine scans for this talk and it it's 562 00:20:53,720 --> 00:20:55,919 just a mess so if it wasn't for Tanner 563 00:20:55,919 --> 00:20:57,480 doing the initial scanning stuff and 564 00:20:57,480 --> 00:20:59,039 then the not g giving me access to their 565 00:20:59,039 --> 00:21:00,840 product and their infrastructure and 566 00:21:00,840 --> 00:21:02,080 their platform it would have been very 567 00:21:02,080 --> 00:21:05,120 hard uh the task distribution is very 568 00:21:05,120 --> 00:21:06,799 hard without good engineering I'm glad I 569 00:21:06,799 --> 00:21:08,200 could use I can hook him to their 570 00:21:08,200 --> 00:21:09,679 infrastructure and have them distribute 571 00:21:09,679 --> 00:21:11,720 their workload but there are tools out 572 00:21:11,720 --> 00:21:13,559 there that do this kind of stuff um 573 00:21:13,559 --> 00:21:15,679 there's aium that's open source also out 574 00:21:15,679 --> 00:21:19,679 there that you can use uh Ben uh pry I 575 00:21:19,679 --> 00:21:21,000 think is how you say his name I always 576 00:21:21,000 --> 00:21:22,919 buture his name and he gets mad but 577 00:21:22,919 --> 00:21:25,880 that's how he has a really good tool um 578 00:21:25,880 --> 00:21:28,360 yeah asked for help and then honestly 579 00:21:28,360 --> 00:21:29,600 you don't need to scan every day at some 580 00:21:29,600 --> 00:21:31,200 point I did like three scan four scans a 581 00:21:31,200 --> 00:21:32,520 week I don't know why I scann on a 582 00:21:32,520 --> 00:21:34,840 Saturday at one point uh it's not worth 583 00:21:34,840 --> 00:21:36,360 it there's nothing that goes up I don't 584 00:21:36,360 --> 00:21:37,480 think people are pushing code on 585 00:21:37,480 --> 00:21:38,880 Saturday at least 586 00:21:38,880 --> 00:21:41,039 externally uh for security teams I think 587 00:21:41,039 --> 00:21:43,120 assets are't locked in usually uh just 588 00:21:43,120 --> 00:21:45,000 because the DNS record is not accessible 589 00:21:45,000 --> 00:21:46,279 directly doesn't mean that you can't hit 590 00:21:46,279 --> 00:21:48,760 it with IP address the amount of 591 00:21:48,760 --> 00:21:50,760 companies I've have owned based on just 592 00:21:50,760 --> 00:21:53,039 that one sentence is really scary 593 00:21:53,039 --> 00:21:55,080 because they think because you know 594 00:21:55,080 --> 00:21:57,400 corp. site.com isn't accessible through 595 00:21:57,400 --> 00:21:59,559 the record you just can't access the IP 596 00:21:59,559 --> 00:22:03,000 address and that's really not the case 597 00:22:03,000 --> 00:22:06,200 um do do you have great ASM platforms 598 00:22:06,200 --> 00:22:08,080 that do things but have a call to action 599 00:22:08,080 --> 00:22:09,400 or have a plan of what you're going to 600 00:22:09,400 --> 00:22:11,440 do with that data I don't think there is 601 00:22:11,440 --> 00:22:14,919 a good enough or big enough uh company 602 00:22:14,919 --> 00:22:17,159 out there or sorry I want to say there's 603 00:22:17,159 --> 00:22:19,279 a good solution out there that says what 604 00:22:19,279 --> 00:22:21,240 to do next with the data because it's 605 00:22:21,240 --> 00:22:23,279 not a same model fits every company 606 00:22:23,279 --> 00:22:25,520 every company's approach is different 607 00:22:25,520 --> 00:22:26,720 their products are different you can't 608 00:22:26,720 --> 00:22:28,840 come up with one uh I I would love to 609 00:22:28,840 --> 00:22:30,440 see a company that says we figured it 610 00:22:30,440 --> 00:22:32,520 out they've all figured out how to give 611 00:22:32,520 --> 00:22:34,320 security thingsam data but no one can 612 00:22:34,320 --> 00:22:36,120 come up with a good plan because every 613 00:22:36,120 --> 00:22:37,720 company should be specific to their 614 00:22:37,720 --> 00:22:39,760 Network and their infrastructure and 615 00:22:39,760 --> 00:22:41,760 what they 616 00:22:41,760 --> 00:22:44,360 do and yeah that's it I I wanted to keep 617 00:22:44,360 --> 00:22:46,320 some time for questions if you guys have 618 00:22:46,320 --> 00:22:48,159 any questions I'll be happy to answer 619 00:22:48,159 --> 00:22:50,039 them otherwise thanks for coming to the 620 00:22:50,039 --> 00:22:51,559 talk and uh I appreciate you guys and 621 00:22:51,559 --> 00:22:54,270 hope El to the next 622 00:22:54,270 --> 00:22:56,960 [Applause] 623 00:22:56,960 --> 00:22:59,960 one 624 00:23:02,120 --> 00:23:06,440 yes and and repeat the question so got 625 00:23:06,440 --> 00:23:09,360 it for your uh keyword searches that you 626 00:23:09,360 --> 00:23:12,520 were doing um how did you go about 627 00:23:12,520 --> 00:23:13,960 collecting all that information did you 628 00:23:13,960 --> 00:23:16,799 go through um extract all the details 629 00:23:16,799 --> 00:23:19,120 from certificates and then um scrape the 630 00:23:19,120 --> 00:23:22,600 sites or so for the keywords that I was 631 00:23:22,600 --> 00:23:24,559 going after like how did I come up with 632 00:23:24,559 --> 00:23:27,039 the keywords honestly just the the 633 00:23:27,039 --> 00:23:29,400 amount of it's time I've wasted looking 634 00:23:29,400 --> 00:23:31,840 at the data a lot of it also it's going 635 00:23:31,840 --> 00:23:33,400 back to one like if you work on an 636 00:23:33,400 --> 00:23:35,440 organization what are some how do you 637 00:23:35,440 --> 00:23:36,919 name your applications right a lot of 638 00:23:36,919 --> 00:23:38,520 companies are very simple it's always 639 00:23:38,520 --> 00:23:42,200 like something. api. something.com it's 640 00:23:42,200 --> 00:23:44,880 uh uat whatever it's just coming up with 641 00:23:44,880 --> 00:23:47,200 those keywords there's two ways you can 642 00:23:47,200 --> 00:23:49,320 do keywords though one is based on the 643 00:23:49,320 --> 00:23:51,799 asset type so you want internal assets 644 00:23:51,799 --> 00:23:53,960 Dev assets instances what a devops 645 00:23:53,960 --> 00:23:56,600 assets CI those keywords that give you 646 00:23:56,600 --> 00:23:58,720 the the uh inv environment you can find 647 00:23:58,720 --> 00:24:00,640 or the permutations you can find right 648 00:24:00,640 --> 00:24:02,760 the second key wording is the tools that 649 00:24:02,760 --> 00:24:04,120 you want to find you want to look for 650 00:24:04,120 --> 00:24:06,880 Nexus Jenkin Cabana all of those right 651 00:24:06,880 --> 00:24:08,360 you can also do it that way so it just 652 00:24:08,360 --> 00:24:10,640 comes down to what you want to look for 653 00:24:10,640 --> 00:24:13,440 uh the there's also a bunch of um 654 00:24:13,440 --> 00:24:16,200 directory brute forcing files that are 655 00:24:16,200 --> 00:24:17,400 out there that are a really good place 656 00:24:17,400 --> 00:24:19,480 to look at and just get ideas like I 657 00:24:19,480 --> 00:24:20,679 scroll through them I'm like oh nice 658 00:24:20,679 --> 00:24:21,919 there's you know this keyword that I 659 00:24:21,919 --> 00:24:23,679 never thought it was like SL green for 660 00:24:23,679 --> 00:24:26,480 some company it's that's their uat I 661 00:24:26,480 --> 00:24:27,520 found that I was like oh there's a lot 662 00:24:27,520 --> 00:24:30,159 of I put green one green two in there so 663 00:24:30,159 --> 00:24:31,679 it's just looking at the data and then 664 00:24:31,679 --> 00:24:34,840 just coming up with you on as 665 00:24:40,480 --> 00:24:43,480 well cool awesome oh one more how long 666 00:24:43,480 --> 00:24:45,559 it takes to scan 667 00:24:45,559 --> 00:24:50,000 the amount of those IP address uh the IP 668 00:24:50,000 --> 00:24:52,960 addresses took me all the 12 IP 669 00:24:52,960 --> 00:24:55,080 addresses took about 6 hours I want to 670 00:24:55,080 --> 00:24:57,480 say I would honestly do them lasting 671 00:24:57,480 --> 00:24:59,480 before I go to bed and I would check on 672 00:24:59,480 --> 00:25:00,799 at first thing in the morning so I can 673 00:25:00,799 --> 00:25:02,039 kill the server so I don't have to pay 674 00:25:02,039 --> 00:25:03,399 for him they're very I think they were 675 00:25:03,399 --> 00:25:06,320 like $800 a month so I'm paying hourly 676 00:25:06,320 --> 00:25:08,320 they get just add up so last thing 677 00:25:08,320 --> 00:25:10,039 before I go to bed first thing before I 678 00:25:10,039 --> 00:25:11,640 go to you know I wake up in the morning 679 00:25:11,640 --> 00:25:12,880 just to kill it the data is in the 680 00:25:12,880 --> 00:25:14,159 database so killing the service didn't 681 00:25:14,159 --> 00:25:16,399 hurt 682 00:25:17,039 --> 00:25:20,679 me was there a I guess an obvious volume 683 00:25:20,679 --> 00:25:25,720 for more AWS more asual or more I think 684 00:25:25,720 --> 00:25:27,880 uh I want to say AWS was the biggest and 685 00:25:27,880 --> 00:25:31,640 then gcp and Azure were pretty 686 00:25:32,360 --> 00:25:34,480 close I may have gone that wrong I just 687 00:25:34,480 --> 00:25:35,480 got to look at it again but I want to 688 00:25:35,480 --> 00:25:36,760 say one of them was higher than the 689 00:25:36,760 --> 00:25:38,200 other two were very very 690 00:25:38,200 --> 00:25:42,279 close I saw one more hand over here 691 00:25:42,279 --> 00:25:44,200 somewhere you find some of the clouds 692 00:25:44,200 --> 00:25:48,480 are more default insecure um you knows 693 00:25:48,480 --> 00:25:50,720 maybe has better security by default or 694 00:25:50,720 --> 00:25:53,320 has that by default or cloud is a better 695 00:25:53,320 --> 00:25:55,159 Target uh the question is which cloud 696 00:25:55,159 --> 00:25:57,360 provider has more like they're less 697 00:25:57,360 --> 00:26:00,960 secur I think it's not a problem of the 698 00:26:00,960 --> 00:26:02,880 the uh the cloud service provider it's 699 00:26:02,880 --> 00:26:04,480 the company that screws up with their 700 00:26:04,480 --> 00:26:06,679 application and then they get owned but 701 00:26:06,679 --> 00:26:09,360 I do know um ad has done a lot to 702 00:26:09,360 --> 00:26:11,760 protect their metadata stuff uh but I 703 00:26:11,760 --> 00:26:13,159 still they think sometimes they fall 704 00:26:13,159 --> 00:26:14,799 short a little bit but it's not again 705 00:26:14,799 --> 00:26:17,080 it's not up to them they can do all the 706 00:26:17,080 --> 00:26:18,640 securing in the world but if someone 707 00:26:18,640 --> 00:26:20,520 owns your box have RC it doesn't matter 708 00:26:20,520 --> 00:26:22,559 at this point right yeah the providers 709 00:26:22,559 --> 00:26:24,200 yeah so just the provider doesn't really 710 00:26:24,200 --> 00:26:26,279 matter but um yeah I haven't seen a 711 00:26:26,279 --> 00:26:27,279 difference between the three to be 712 00:26:27,279 --> 00:26:29,360 honest 713 00:26:29,360 --> 00:26:30,640 I think there are more resources on 714 00:26:30,640 --> 00:26:32,640 hacking AWS than anything else though 715 00:26:32,640 --> 00:26:33,799 that's 716 00:26:33,799 --> 00:26:35,960 true so maybe put down your security 717 00:26:35,960 --> 00:26:37,720 practices like avoid AWS with the 718 00:26:37,720 --> 00:26:40,880 documentation on the hacking 719 00:26:43,039 --> 00:26:45,559 stuff any more 720 00:26:45,559 --> 00:26:47,640 questions cool then I'll give this back 721 00:26:47,640 --> 00:26:49,159 to the uh 722 00:26:49,159 --> 00:26:52,159 organizers