1
00:00:00,000 --> 00:00:03,500
Our next talk is going to be starting now.

2
00:00:03,520 --> 00:00:10,980
So the next talk is by Anthony Roussel, who's going to be talking about Bug Bounty Recon, bypassing geographic DNS, and Ensembl.

3
00:00:10,980 --> 00:00:21,980
He's a professional .NET developer, hobbyist, hardware dev, published over 50 Windows phone apps, spoken at a lot of conferences, so let's give him a round of applause and get started.

4
00:00:22,400 --> 00:00:25,180
Over to you.

5
00:00:25,180 --> 00:00:26,480
Thank you so much.

6
00:00:26,800 --> 00:00:29,980
Alright, wow, what a great introduction.

7
00:00:30,780 --> 00:00:41,680
Yeah, so this talk is geo-distributed Bug Bounty Recon, bypassing things like geographic DNS, and more with this new free open-source tool called Ensembl.

8
00:00:41,980 --> 00:00:43,380
This is me.

9
00:00:43,560 --> 00:00:45,280
My name is Anthony Roussel.

10
00:00:45,280 --> 00:00:47,400
I go by the handle .NET Roussel.

11
00:00:47,480 --> 00:00:49,400
I'm a professional software engineer.

12
00:00:49,400 --> 00:00:51,080
I've been an engineer for about 11 years.

13
00:00:51,080 --> 00:01:00,200
I've worked on various systems, lots of boring stuff, but mostly in C-sharp and F-sharp, lots of Python, which I'm sure most of you are familiar with.

14
00:01:00,740 --> 00:01:07,180
If you're interested in more about what I do and what I've done, you can check out my blog, dotnetroussel.com.

15
00:01:07,300 --> 00:01:11,180
If you want to reach out to me personally, you can hit me up on Twitter, at dotnetroussel.

16
00:01:11,180 --> 00:01:16,640
And all of the code that I'm going to be presenting today, I won't actually show you code, so don't worry.

17
00:01:16,980 --> 00:01:19,000
No boring code.

18
00:01:19,120 --> 00:01:25,580
But if you're interested in the tool itself, it can be found on my GitHub, which is forward slash dotnetroussel.

19
00:01:25,580 --> 00:01:28,540
And the tool is called Ensembl.

20
00:01:29,360 --> 00:01:36,320
All right, so before I get into the tool, I want to briefly talk about kind of the hacker journey.

21
00:01:36,320 --> 00:01:40,580
You know, like how I got here, how I wrote this tool, why I wrote this tool.

22
00:01:40,620 --> 00:01:46,140
And I hope that it resonates with some of you, because I think a lot of us take similar paths.

23
00:01:47,580 --> 00:01:58,680
So early on, when I started engineering, you know, there were a lot of people that enjoyed security, but no one really took it serious.

24
00:01:58,760 --> 00:02:00,480
Can I get just a quick show of hands?

25
00:02:00,480 --> 00:02:01,820
How many people here are engineers?

26
00:02:02,680 --> 00:02:03,280
Professionally, yeah.

27
00:02:03,280 --> 00:02:04,560
So we got a lot of engineers in here.

28
00:02:04,560 --> 00:02:06,700
Do your companies take security serious?

29
00:02:06,700 --> 00:02:10,320
I mean, hopefully you guys do, because you're here, or you people do, right?

30
00:02:10,460 --> 00:02:18,080
Okay, so for the people watching later on, nobody raised their hand that their companies took security serious.

31
00:02:18,080 --> 00:02:22,820
So, like a lot of you, you know, I take security very serious.

32
00:02:22,820 --> 00:02:28,740
I take it serious in my day-to-day job, but the companies that I've worked for in the past have not always taken it serious.

33
00:02:28,740 --> 00:02:31,280
Thankfully, I'm at a place now that does take it serious.

34
00:02:31,640 --> 00:02:37,900
But yeah, when I was getting started, I was confused why these companies didn't take it more serious.

35
00:02:37,900 --> 00:02:43,220
And I started doing some reading, things like 24 deadly sins.

36
00:02:43,220 --> 00:02:44,300
I actually didn't read that one.

37
00:02:44,300 --> 00:02:48,560
I think it was 10 deadly web sins, or something like that, when I first started.

38
00:02:49,540 --> 00:02:54,740
And I started poking holes in the applications that I was working on professionally.

39
00:02:54,740 --> 00:03:04,460
And, man, companies get really mad when you start rooting their applications and, like, finding, you know, all types of stuff, like Stack Overflow.

40
00:03:05,900 --> 00:03:17,580
Yeah, so I started branching out and getting away from what I was working on and started doing things like getting into bug bounties and virtual, like, bone hub, things like that, hack the box.

41
00:03:18,640 --> 00:03:27,760
But as far as the books that I used to get into it, I started with the deadly sins and these hacking books like this, like Violent Python.

42
00:03:28,880 --> 00:03:30,840
And I also did a lot of...

43
00:03:30,840 --> 00:03:35,180
I read a lot of the penetration testing book and the open source intelligence techniques.

44
00:03:35,180 --> 00:03:37,320
Have you guys... has anybody read any of these?

45
00:03:37,320 --> 00:03:38,460
A lot of these should look familiar.

46
00:03:38,460 --> 00:03:40,320
These are pretty big in the community.

47
00:03:41,020 --> 00:03:46,240
I also, you know, I wasn't going to add these, but, you know, obviously Kevin Mitnick just passed away.

48
00:03:46,500 --> 00:03:48,800
Unfortunately, a huge loss to the community.

49
00:03:49,220 --> 00:03:54,840
My first DEF CON, DEF CON 22, I didn't know him personally, but I did have an opportunity to meet him.

50
00:03:54,840 --> 00:03:57,080
I got him to sign a copy of one of my books.

51
00:03:57,080 --> 00:03:58,040
I was so fortunate.

52
00:03:58,040 --> 00:03:59,080
I still have it.

53
00:03:59,180 --> 00:04:05,920
And I have one of those cool laser-cut lockpicks, lockpick key cards that he had.

54
00:04:05,920 --> 00:04:10,300
So if you don't know who Kevin Mitnick is, I highly recommend you learn about him.

55
00:04:10,300 --> 00:04:11,560
Learn about his story.

56
00:04:11,560 --> 00:04:13,400
He was a huge loss to the community.

57
00:04:13,420 --> 00:04:15,640
But , yeah, those are two great books by him.

58
00:04:15,640 --> 00:04:16,900
He has a bunch of books out.

59
00:04:16,900 --> 00:04:18,200
Those are my favorites.

60
00:04:18,580 --> 00:04:22,040
And then, does anybody know what Stuxnet is?

61
00:04:22,180 --> 00:04:23,220
Yeah, a lot of us.

62
00:04:23,220 --> 00:04:24,880
We should all know what Stuxnet is.

63
00:04:25,020 --> 00:04:26,520
Countdown to Zero Day.

64
00:04:26,860 --> 00:04:29,680
That one, I'm pretty sure that's about Stuxnet.

65
00:04:29,860 --> 00:04:37,580
And if you're doing any type of bug bounty or red teaming, you should definitely have the Hacker Playbook in your arsenal.

66
00:04:37,580 --> 00:04:41,080
I had number two and number three.

67
00:04:41,340 --> 00:04:44,020
And I tell you, every single time, I'm doing anything.

68
00:04:44,020 --> 00:04:45,600
That's the first book that comes out.

69
00:04:45,600 --> 00:04:49,000
And it doesn't matter how many times I've done it, I'm definitely not an expert.

70
00:04:49,000 --> 00:04:50,640
I don't want to come across as an expert.

71
00:04:50,640 --> 00:04:57,980
But every single time I start to do a vulnerable virtual machine, hack the box, a bug bounty, it doesn't matter.

72
00:04:57,980 --> 00:05:02,180
Hacker Playbook comes out and I start going through the tools and going through the motions.

73
00:05:02,180 --> 00:05:05,680
Because a lot of what we do is a methodology.

74
00:05:05,680 --> 00:05:08,660
A lot of what we do is repetitive.

75
00:05:09,860 --> 00:05:11,600
That's going to make sense here in a second.

76
00:05:11,700 --> 00:05:14,240
So here are the tools that we're using.

77
00:05:15,160 --> 00:05:17,180
These should all look familiar to you.

78
00:05:17,180 --> 00:05:25,140
We have Kali Linux, Parrot, then obviously the platforms, Bugcrown and HackerOne, Hack the Box, Vault and Hub.

79
00:05:25,140 --> 00:05:26,240
These should all be familiar.

80
00:05:26,240 --> 00:05:28,480
If not, dig into these tools.

81
00:05:28,480 --> 00:05:30,060
These are going to be your bread and butter.

82
00:05:31,280 --> 00:05:37,320
So that's the story of how you get into this, how I got into this stuff.

83
00:05:37,480 --> 00:05:42,120
Now I want to talk about you and how you're interacting with bug bounties.

84
00:05:42,120 --> 00:05:44,320
So the bug bounty hunter story.

85
00:05:44,500 --> 00:05:52,180
So the first thing we do when we're looking for a bug bounty is we head over to something like Bugcrown or HackerOne.

86
00:05:52,260 --> 00:05:58,060
And you find your favorite flavor of whatever bug bounty program you want.

87
00:05:58,060 --> 00:06:01,020
And you pick it and you start reading their description.

88
00:06:01,020 --> 00:06:07,700
You start going through what they want you to find, what domains they want you to look at, the scope.

89
00:06:07,720 --> 00:06:12,400
The scope of your program that you're going to work on.

90
00:06:13,060 --> 00:06:16,840
So today we're going to look at the Twitter bug bounty.

91
00:06:16,860 --> 00:06:20,400
Has anybody here taken part in the Twitter bug bounty?

92
00:06:20,400 --> 00:06:21,400
Okay, so we've got a few people.

93
00:06:21,400 --> 00:06:22,060
Great.

94
00:06:22,220 --> 00:06:29,280
I'd definitely be interested in speaking to you after and hearing about your experience and seeing if it aligns with this at all.

95
00:06:30,660 --> 00:06:35,740
So if we look at the Twitter bug bounty, they give us a scope of these domains here.

96
00:06:35,740 --> 00:06:37,060
I think there's seven there.

97
00:06:38,860 --> 00:06:42,400
Now, are we just going to start digging into these seven?

98
00:06:42,460 --> 00:06:45,320
Are you just going to go to Twitter.com and start hammering on it?

99
00:06:45,320 --> 00:06:45,980
Raise your hand.

100
00:06:45,980 --> 00:06:47,040
Who's going to do that?

101
00:06:47,600 --> 00:06:48,120
Okay, good.

102
00:06:48,120 --> 00:06:49,140
I'm happy nobody raised their hand.

103
00:06:49,360 --> 00:06:54,240
That's probably the least effective way to take part in a bug bounty program.

104
00:06:55,100 --> 00:06:56,940
We have a lot of engineers in here.

105
00:06:56,940 --> 00:07:02,080
Everybody knows that engineers, when we're developing something, we're developing a golden path.

106
00:07:02,080 --> 00:07:05,280
Even if we don't know we're developing a golden path, we develop a golden path.

107
00:07:05,280 --> 00:07:09,260
A path that we expect all of our users to take.

108
00:07:09,720 --> 00:07:18,260
And the engineers at Twitter, I don't know any of them, but I guarantee they expect you're going to type in Twitter.com and that's going to take you to their landing page.

109
00:07:18,260 --> 00:07:21,940
And then you're going to go to the login or to the sign-up.

110
00:07:21,940 --> 00:07:24,600
And then you're going to end up on your Twitter profile.

111
00:07:24,640 --> 00:07:27,500
There's a golden path they expect you to go through.

112
00:07:27,500 --> 00:07:33,560
And I promise you that they have spent millions and millions of dollars hardening that attack surface.

113
00:07:33,700 --> 00:07:39,980
If you go to Twitter.com today and you get in with admin-admin or any SQL injection, I will give you my next paycheck.

114
00:07:39,980 --> 00:07:41,740
That is not going to happen, okay?

115
00:07:41,820 --> 00:07:43,660
Those are hardened targets.

116
00:07:43,660 --> 00:07:45,220
We don't want those targets.

117
00:07:45,360 --> 00:07:46,240
What do we want?

118
00:07:46,240 --> 00:07:46,820
Does anybody know?

119
00:07:46,820 --> 00:07:47,600
Shout it out if you know.

120
00:07:47,600 --> 00:07:48,540
What do we want?

121
00:07:48,540 --> 00:07:50,240
All right, that's okay.

122
00:07:50,240 --> 00:07:54,520
We want the side door, the window that's unlocked and open.

123
00:07:54,520 --> 00:07:57,520
We want the thing that they forgot about.

124
00:07:57,520 --> 00:08:01,740
I want the SSH server that has default credentials.

125
00:08:01,740 --> 00:08:05,160
I want the FTP server that has anonymous login.

126
00:08:05,160 --> 00:08:15,720
I want the dev environment that some intern set up six weeks ago and nobody noticed that it's public-facing and that it has some critical flaw in it.

127
00:08:15,720 --> 00:08:17,140
Those are the things I want.

128
00:08:17,140 --> 00:08:19,420
A lot of people think those don't exist.

129
00:08:19,420 --> 00:08:20,020
They do.

130
00:08:20,020 --> 00:08:22,520
I promise you, these things exist.

131
00:08:22,840 --> 00:08:24,660
I recently found...

132
00:08:24,660 --> 00:08:28,520
Obviously, if you take part in Buck Binders, you know you can't name names.

133
00:08:28,780 --> 00:08:39,460
I recently found an SSH server on a non-standard port with default credentials for a major ISP.

134
00:08:40,380 --> 00:08:41,560
It happens.

135
00:08:41,560 --> 00:08:42,480
This is recently.

136
00:08:42,480 --> 00:08:43,720
It just happened.

137
00:08:43,720 --> 00:08:48,420
I encourage you to not take the golden path.

138
00:08:48,420 --> 00:08:51,600
That's really the key to being successful with this stuff.

139
00:08:53,020 --> 00:08:55,540
This is where the struggle begins.

140
00:08:55,580 --> 00:08:58,620
Trying to get off the beaten path.

141
00:08:58,960 --> 00:09:02,920
We want to first figure out what our subdomains are.

142
00:09:03,000 --> 00:09:09,760
Actually, there's a CTF going on next door for the Recon Village for doing subdomain enumeration.

143
00:09:09,760 --> 00:09:12,240
I encourage you to try it out.

144
00:09:12,240 --> 00:09:15,900
You'll be using things... This is not a comprehensive list.

145
00:09:15,900 --> 00:09:21,100
There's probably a lot of tools in here, but there's a few tools that you probably use to do subdomain enumeration.

146
00:09:21,140 --> 00:09:23,760
You've got SubFinder, SubLister, Amass.

147
00:09:24,060 --> 00:09:30,680
We're going to take those seven domains that they gave us for our scope, and we're going to put them in there.

148
00:09:30,680 --> 00:09:33,100
We're going to see how many results we get back.

149
00:09:33,660 --> 00:09:35,160
I have the actual number.

150
00:09:35,160 --> 00:09:36,100
I did this.

151
00:09:36,100 --> 00:09:39,080
I want to know, except for the people that actually did this program.

152
00:09:39,080 --> 00:09:44,540
Does anybody know how many subdomains I found just off those seven?

153
00:09:45,020 --> 00:09:45,720
Throw out a number.

154
00:09:45,720 --> 00:09:46,100
Anybody.

155
00:09:46,100 --> 00:09:46,900
Any guesses?

156
00:09:48,140 --> 00:09:48,860
200?

157
00:09:50,060 --> 00:09:50,980
Anybody else?

158
00:09:51,900 --> 00:09:52,880
5,000?

159
00:09:53,840 --> 00:09:54,940
I don't want to hear that guy.

160
00:09:54,940 --> 00:09:55,720
I know him.

161
00:09:57,220 --> 00:10:00,660
So I actually did this, and I found...

162
00:10:01,180 --> 00:10:03,340
It took a second for it to load, because there are so many.

163
00:10:03,340 --> 00:10:06,720
1,449 subdomains.

164
00:10:06,720 --> 00:10:08,740
It's a ridiculous amount.

165
00:10:08,740 --> 00:10:10,520
Now, what's the problem?

166
00:10:10,520 --> 00:10:12,420
Can anybody tell me what the problem is with this number?

167
00:10:12,420 --> 00:10:14,020
Reminder, I did not do anything.

168
00:10:14,020 --> 00:10:15,860
I just found the subdomains.

169
00:10:15,860 --> 00:10:17,540
So what's the problem with this?

170
00:10:18,260 --> 00:10:19,220
Anybody?

171
00:10:21,020 --> 00:10:22,300
They're not all active.

172
00:10:22,300 --> 00:10:22,920
That's right.

173
00:10:22,920 --> 00:10:23,580
You nailed it.

174
00:10:23,580 --> 00:10:24,420
That's exactly it.

175
00:10:24,420 --> 00:10:25,520
They are not all active.

176
00:10:25,520 --> 00:10:31,660
So we have to enumerate this massive list now and find which hosts are actually up and active.

177
00:10:32,260 --> 00:10:39,640
Because if we don't, we're going to be running scans against things that are totally dead, and it's going to be just wasting time, burning time.

178
00:10:39,680 --> 00:10:43,220
So yeah, we need to figure out what hosts are active.

179
00:10:43,540 --> 00:10:50,060
Then we're going to start, after we have our up list, we've got to do our port scans and figure out what services are running on those hosts.

180
00:10:50,340 --> 00:10:53,360
Then you're really going to start getting nitty-gritty.

181
00:10:53,360 --> 00:10:56,100
You're going to start doing your script scanning with Nmap.

182
00:10:56,100 --> 00:10:59,260
You're going to run your NIC2 against their web servers.

183
00:10:59,260 --> 00:11:02,740
WP scan, everything, right?

184
00:11:02,740 --> 00:11:07,440
And then, obviously, that bullet on there, the Telnet, WebDev, FTP.

185
00:11:07,440 --> 00:11:18,340
I found, once again, it's another bug bounty, so I can't say exactly who, but there was a government site that actually takes part here at DEF CON quite frequently.

186
00:11:18,340 --> 00:11:24,760
They had an insecure WebDev server, and I was able to start manipulating files on their server.

187
00:11:24,760 --> 00:11:27,260
So this stuff definitely exists.

188
00:11:27,940 --> 00:11:29,200
Get off the golden path.

189
00:11:29,200 --> 00:11:30,060
I can't say that enough.

190
00:11:30,060 --> 00:11:31,220
That's really important.

191
00:11:32,540 --> 00:11:45,500
So, yeah, this is going to turn into thousands and thousands of requests that we have to make in order to fully map the attack surface, because that's what we're trying to do with our recon.

192
00:11:45,680 --> 00:11:48,340
We're not actually breaking in anything with recon.

193
00:11:48,340 --> 00:11:53,860
A lot of this is passive until we start getting into actual scanning.

194
00:11:53,860 --> 00:12:04,300
But we're trying to map out the attack surface and figure out where the weakest points are so that we can start poking at those points and try and win a bounty.

195
00:12:04,300 --> 00:12:05,880
That's what we're here for.

196
00:12:06,000 --> 00:12:09,800
The less time you can spend doing this, the more money you're going to make.

197
00:12:09,800 --> 00:12:11,480
That's really what it comes down to.

198
00:12:11,480 --> 00:12:13,840
I think everybody should know that.

199
00:12:14,240 --> 00:12:20,060
So one final thing that you're going to run into as a bug bounty hunter is this thing called GeoDNS.

200
00:12:20,060 --> 00:12:21,660
This is not a trick question.

201
00:12:21,660 --> 00:12:23,380
Does anybody know what GeoDNS is?

202
00:12:23,380 --> 00:12:24,500
It's in the name.

203
00:12:25,080 --> 00:12:26,040
You know what it is.

204
00:12:26,040 --> 00:12:28,780
If you don't know what it is, that's fine.

205
00:12:28,780 --> 00:12:31,840
It's not a security mechanism by any means.

206
00:12:33,720 --> 00:12:37,200
GeoDNS improves the user experience in some cases.

207
00:12:37,200 --> 00:12:45,300
It'll help if you're in Germany or you're in Australia and you're trying to pull up Google.com.

208
00:12:45,300 --> 00:12:47,960
You don't want to have to connect to San Francisco.

209
00:12:47,960 --> 00:12:51,640
You want a server that's close to you to resolve.

210
00:12:51,640 --> 00:12:53,380
That way your experience is fast.

211
00:12:53,380 --> 00:13:01,020
There's also some other reasons for GeoDNS, like laws, where data can be stored and can't be stored, things like that.

212
00:13:01,100 --> 00:13:03,260
There's a lot of reasons for GeoDNS.

213
00:13:04,260 --> 00:13:05,700
It's great for everybody.

214
00:13:05,700 --> 00:13:07,240
There's nothing wrong with GeoDNS.

215
00:13:07,240 --> 00:13:08,340
It's great for everybody.

216
00:13:08,460 --> 00:13:16,120
You as a bug bounty hunter, however, this is horrible because this means you're missing everything else.

217
00:13:16,120 --> 00:13:29,700
If there's a company that has GeoDNS enabled and you're in Alberta or Illinois or whatever, and you're making requests, you're going to get the servers here in North America.

218
00:13:29,700 --> 00:13:31,180
You're not going to get the ones in Germany.

219
00:13:31,180 --> 00:13:32,580
You're not going to get the ones in France.

220
00:13:32,580 --> 00:13:35,680
You're not going to get the ones in Sweden or Australia or Africa.

221
00:13:35,840 --> 00:13:44,180
You're going to get the ones here, and your whole bug bounty is going to be against the American servers, which I promise you are probably pretty hard.

222
00:13:44,180 --> 00:13:47,480
So we want to see those other servers.

223
00:13:47,480 --> 00:13:49,100
We want to get around GeoDNS.

224
00:13:49,260 --> 00:13:53,840
And that's kind of what this diagram right here is what I ripped off from Microsoft.

225
00:13:54,500 --> 00:13:59,140
I'm pretty sure this is like the Azure GeoDNS system, what they have set up.

226
00:13:59,140 --> 00:14:00,140
It's not important.

227
00:14:01,300 --> 00:14:02,600
So how do we do that?

228
00:14:02,600 --> 00:14:05,300
There are lots of ways that we can get around GeoDNS.

229
00:14:06,100 --> 00:14:12,300
I'm going to show you the ways that exist, and then I'm going to show you the way that I created, and I'm hoping that you like it.

230
00:14:12,300 --> 00:14:14,460
So we adapt and overcome.

231
00:14:15,320 --> 00:14:16,260
Very simple.

232
00:14:16,340 --> 00:14:17,440
VPNs and proxies.

233
00:14:17,440 --> 00:14:19,520
That would be our way to get around it.

234
00:14:20,260 --> 00:14:34,440
The problem with VPNs and proxies, though, especially when you're talking about a global company, one that has servers all over the world, is that you're going to have to maintain a VPN in every region, and you're going to have to maintain proxies in every region.

235
00:14:34,440 --> 00:14:41,760
You're going to have to have these set up, and then you're going to have to manually switch between them, unless you're good enough to script switching between them.

236
00:14:41,760 --> 00:14:45,740
And then you're going to have to manually rerun all these commands in every region.

237
00:14:46,660 --> 00:14:53,180
And as a lot of your engineers, we know when you have to do things repetitively by hand, it is error-prone.

238
00:14:54,360 --> 00:14:55,760
Constantly, you're going to have bugs.

239
00:14:55,760 --> 00:14:57,240
You're going to miss things.

240
00:14:58,020 --> 00:14:59,160
It's very repetitive.

241
00:14:59,160 --> 00:15:04,260
You're spending a lot of time at the keyboard instead of getting outside and enjoying the sun.

242
00:15:04,840 --> 00:15:12,960
I know a lot of us don't enjoy the sun, but for those of you that like to get outside and enjoy the sun, you're missing out on that because you're spending it at the keyboard.

243
00:15:14,780 --> 00:15:16,900
And that's where Ensembl comes in.

244
00:15:18,080 --> 00:15:20,620
Ensembl is a new tool.

245
00:15:20,620 --> 00:15:22,240
It's a new platform that I created.

246
00:15:22,240 --> 00:15:23,580
I spent about a year and a half writing it.

247
00:15:23,580 --> 00:15:29,200
If you look at the code and you know Python, it'll be apparent that I crammed it out in a year and a half.

248
00:15:30,540 --> 00:15:31,980
But it's a new tool.

249
00:15:31,980 --> 00:15:32,680
It's open source.

250
00:15:32,680 --> 00:15:33,800
It's totally free.

251
00:15:33,800 --> 00:15:47,900
And what it does is it allows you to set up a globally distributed cluster of machines, of agents, that report back to a web portal, a masternode, that you can distribute commands across.

252
00:15:47,900 --> 00:15:49,280
It's very easy.

253
00:15:49,500 --> 00:15:56,340
This program will let you take... so for example, I'm doing the bug bounty next door for the subdomains.

254
00:15:56,340 --> 00:15:59,000
There was like... is anybody else doing that CTF?

255
00:15:59,280 --> 00:16:01,980
The subdomain CTF for the Recon Village?

256
00:16:01,980 --> 00:16:04,800
Okay, so since you're not doing it, I'll tell you.

257
00:16:04,840 --> 00:16:09,680
There's 15,000 domains in a Word file that they're giving out.

258
00:16:09,680 --> 00:16:12,980
And you have to figure out how many subdomains you can find, right?

259
00:16:12,980 --> 00:16:14,680
And whoever comes up with the most wins.

260
00:16:14,700 --> 00:16:16,000
I'm pretty sure those are the rules, right?

261
00:16:16,000 --> 00:16:16,960
Something like that?

262
00:16:16,980 --> 00:16:25,260
So everyone over there is over there hammering on their keyboards right now, trying to crank out as many subdomains as they can.

263
00:16:25,360 --> 00:16:27,760
I opened up... I actually have a cluster running right now.

264
00:16:27,760 --> 00:16:28,740
I opened it up.

265
00:16:28,740 --> 00:16:31,020
I took those 15,000 subdomains.

266
00:16:31,020 --> 00:16:32,300
I dropped it in here.

267
00:16:32,300 --> 00:16:34,540
It distributed it across my cluster.

268
00:16:34,540 --> 00:16:38,540
And I'm actually competing in the CTF right now while I'm giving this talk.

269
00:16:38,840 --> 00:16:41,220
And it's not doing it one at a time.

270
00:16:41,220 --> 00:16:43,700
It's doing all of them at once.

271
00:16:44,240 --> 00:16:45,040
Simultaneously.

272
00:16:45,680 --> 00:16:50,320
And all I'll have to do, when it's done, when the jobs are done, it'll pop up a notification.

273
00:16:50,320 --> 00:16:52,040
It'll say, hey, your work is done.

274
00:16:52,040 --> 00:16:53,800
I go into the job output.

275
00:16:53,940 --> 00:16:55,500
Grab all the results.

276
00:16:55,500 --> 00:17:00,700
And I'll probably run them through a unique filter, like a sort unique or something like that.

277
00:17:00,700 --> 00:17:04,440
Make sure I don't waste your guys' time having to dig through finding unique ones.

278
00:17:04,440 --> 00:17:06,340
But I'm going to find a lot of them.

279
00:17:06,340 --> 00:17:08,200
I'm probably going to get a place pretty high on the list.

280
00:17:08,200 --> 00:17:08,780
I'm hoping.

281
00:17:08,780 --> 00:17:09,680
We'll see.

282
00:17:09,840 --> 00:17:12,820
But that's essentially the long and short of what Ensembl is.

283
00:17:12,820 --> 00:17:21,300
It allows you to take commands, take huge amounts of targets, and distribute this workload evenly across your cluster.

284
00:17:21,300 --> 00:17:25,160
It also allows you to bypass things like geodns.

285
00:17:25,300 --> 00:17:27,180
That's what this diagram is here.

286
00:17:27,340 --> 00:17:30,480
On the far left here, this is you.

287
00:17:30,480 --> 00:17:31,520
You're the user.

288
00:17:31,860 --> 00:17:35,820
And you have a command you want to run and some targets you want to run it against.

289
00:17:36,760 --> 00:17:40,000
You issue that command to the director, which is your masternode.

290
00:17:40,000 --> 00:17:42,060
You do that through the web portal here.

291
00:17:42,460 --> 00:17:46,140
And the masternode says, OK, how do we want to do this?

292
00:17:46,140 --> 00:17:50,620
Do we want to do it in a load-balanced fashion, which is what I'm doing with the subdomains over there?

293
00:17:50,620 --> 00:17:57,520
I said, do it in a load-balanced fashion, which means it's going to take all the targets and break them up across my cluster.

294
00:17:57,980 --> 00:18:09,820
Or you can do it in a way where it runs the same exact command against the same exact targets in every region, which is how you bypass things like geodns.

295
00:18:09,820 --> 00:18:12,060
And that's what this diagram is showing here.

296
00:18:12,060 --> 00:18:15,080
So in this diagram, we're running a command.

297
00:18:15,080 --> 00:18:18,020
The director issues it across the entire cluster.

298
00:18:18,020 --> 00:18:26,720
And each of these agents in the cluster are going to reach out to the geodns traffic manager, which we don't control.

299
00:18:26,720 --> 00:18:29,580
That's somebody else that's controlling that.

300
00:18:29,580 --> 00:18:37,820
Each of these agents are going to reach out to the geodns traffic manager, and they're going to say, hey, resolve this domain for me.

301
00:18:37,900 --> 00:18:47,480
And the traffic manager is going to say, OK, well, if you're in North America, South America, or Central America, you guys are all going to go to this server over here, right?

302
00:18:47,480 --> 00:18:56,260
However, if you're in Asia or Europe or Africa, you actually each get your own server that you're going to.

303
00:18:56,300 --> 00:18:59,880
And it's going to run these commands against each of these servers.

304
00:18:59,880 --> 00:19:08,460
Now, if you're a bug bounty hunter and you're not doing this, you're only going to get that one server in your region, and you're going to miss the rest of them.

305
00:19:08,480 --> 00:19:12,860
So this is opening up the attack surface for you to find more things.

306
00:19:12,860 --> 00:19:19,560
And I guarantee you that there are servers out there in other regions that are part of bug bounty programs that nobody has seen.

307
00:19:19,640 --> 00:19:21,440
I guarantee you.

308
00:19:23,520 --> 00:19:27,660
So here's an example of the workspaces.

309
00:19:27,660 --> 00:19:31,620
So I have it set up so you can actually run multiple bug bounty programs at once.

310
00:19:31,620 --> 00:19:40,180
I actually have a couple of bug bounty programs in my live cluster right now, and the CTF is not interfering with them because I have it in a different workspace.

311
00:19:40,180 --> 00:19:53,300
So if you're running a Twitter bug bounty and a SpaceX bug bounty and a Google bug bounty, you can do all of those, have all of the results separated, and be able to parse through them easily.

312
00:19:53,300 --> 00:19:55,440
So that's what the workspaces are.

313
00:19:55,820 --> 00:19:59,320
Here's an example of the... and don't worry if you can't read this.

314
00:19:59,320 --> 00:20:01,320
I actually have a video that I'm going to show at the end.

315
00:20:01,320 --> 00:20:03,740
It's a very short three-minute video of it actually working.

316
00:20:04,240 --> 00:20:06,040
This is the agents page.

317
00:20:06,040 --> 00:20:11,220
It shows you your active agents and their health status, the last time they checked in, how many jobs they're running.

318
00:20:11,220 --> 00:20:12,720
You can drill into the agents.

319
00:20:12,720 --> 00:20:15,480
That map in the front was actually where the agents are positioned.

320
00:20:15,620 --> 00:20:17,620
So this is actually my cluster right here.

321
00:20:17,620 --> 00:20:26,280
I have one in southern Australia, one in southern India, I think that's Germany, or yeah, I don't know, one of those European countries, and then one in Toronto.

322
00:20:26,640 --> 00:20:30,020
But you can have as many nodes on the cluster as you want.

323
00:20:30,020 --> 00:20:31,280
It's up to you.

324
00:20:31,860 --> 00:20:36,520
Ideally, you would have one in every region of the world, on every continent, maybe a couple countries.

325
00:20:37,960 --> 00:20:39,240
But yeah, so that's what this is.

326
00:20:39,240 --> 00:20:40,860
This is the agents that are alive.

327
00:20:41,180 --> 00:20:45,900
And then you can drill into it and see their health status, their CPU usage, their memory consumption.

328
00:20:46,280 --> 00:20:49,100
You can restart the agent, all types of stuff.

329
00:20:50,960 --> 00:20:52,080
So it gets better.

330
00:20:52,080 --> 00:20:54,540
I feel like I'm selling this to you, but it gets better.

331
00:20:54,540 --> 00:21:02,180
Not only do you have all the capabilities that I've talked about, but you also have the ability to schedule these jobs.

332
00:21:02,220 --> 00:21:12,700
So another big problem that bug bounty hunters run into is they do all their recon at the beginning, and then they spend the rest of the bug bounty doing what?

333
00:21:12,700 --> 00:21:14,040
Trying to poke at it, right?

334
00:21:14,040 --> 00:21:15,560
They never run their recon again.

335
00:21:15,560 --> 00:21:16,720
They run it once.

336
00:21:16,720 --> 00:21:19,660
However, companies don't exist in a vacuum.

337
00:21:19,660 --> 00:21:31,300
There's always going to be intern schmuckatelli out there who's setting up some stupid service that's public facing that gives you access behind their application firewall.

338
00:21:31,300 --> 00:21:32,300
There's always going to be that way.

339
00:21:32,300 --> 00:21:37,220
So if you only run your recon one time, you're going to miss when he does that or she does that.

340
00:21:37,600 --> 00:21:43,480
What you can do with Ensemble is you can schedule these jobs to run daily, weekly, monthly.

341
00:21:43,480 --> 00:21:46,980
You can also schedule them to run at a specific date and time.

342
00:21:46,980 --> 00:21:55,640
So if you are working hand in hand with a company and you don't want to blast their environment during peak hours, you can set your scans up to run at 2 a.m.

343
00:21:55,640 --> 00:22:02,460
And then you can go to bed, your scans will run, and the results will be there in the morning when you wake up and you can do your analysis.

344
00:22:03,340 --> 00:22:05,560
So that's one feature I really love.

345
00:22:05,560 --> 00:22:07,240
I use this quite a bit.

346
00:22:07,320 --> 00:22:08,540
It's really nice.

347
00:22:08,940 --> 00:22:11,720
This is an example of how we create a job.

348
00:22:11,980 --> 00:22:13,340
And you'll see this in the video once again.

349
00:22:13,340 --> 00:22:14,660
Don't worry if you can't read it.

350
00:22:15,500 --> 00:22:17,340
I have some command templates built in.

351
00:22:17,340 --> 00:22:21,280
You're able to add your own command templates if there's commands that you like to run frequently.

352
00:22:21,920 --> 00:22:24,060
But you have the ability to put your own commands in here.

353
00:22:24,060 --> 00:22:25,060
You don't even need a template.

354
00:22:25,060 --> 00:22:27,760
You can just fill in the command however you want.

355
00:22:28,080 --> 00:22:32,240
And then you can schedule it to run however you want, daily, weekly, monthly.

356
00:22:32,680 --> 00:22:36,240
You can decide if you want it to be load balanced or however.

357
00:22:36,680 --> 00:22:41,080
And then down here you put in your... down at the bottom you put in whatever targets you want.

358
00:22:41,080 --> 00:22:44,700
So what I did was I ran SubFinder.

359
00:22:45,360 --> 00:22:46,880
I'm sure you guys have heard of SubFinder.

360
00:22:46,880 --> 00:22:48,960
That's a subdomain enumeration tool.

361
00:22:49,140 --> 00:22:51,380
I put SubFinder in there as my command.

362
00:22:51,460 --> 00:22:53,780
I said run it as a load balanced command.

363
00:22:53,780 --> 00:22:59,480
And then I took those 15,000 domains that they have in their CTF and I dropped it in the target list and I hit go.

364
00:22:59,560 --> 00:23:01,260
And then I came in here to give this talk.

365
00:23:01,400 --> 00:23:05,280
And now that is running and I don't have to do anything.

366
00:23:05,960 --> 00:23:07,500
I can get away from the keyboard.

367
00:23:07,680 --> 00:23:08,660
Well, this is supposed to be a video.

368
00:23:08,660 --> 00:23:10,060
I have a video I'll show you here in a second.

369
00:23:10,620 --> 00:23:14,060
I can get away from the keyboard and not have to worry.

370
00:23:15,100 --> 00:23:17,540
Alright, so let's take a look at the video here.

371
00:23:17,540 --> 00:23:18,900
I have it already queued up.

372
00:23:20,140 --> 00:23:22,740
So, everything is secure.

373
00:23:22,940 --> 00:23:24,200
Oh, hang on.

374
00:23:24,200 --> 00:23:26,000
At DEF CON, don't want to say that.

375
00:23:26,320 --> 00:23:29,120
I, to the best of my ability, everything is secure.

376
00:23:29,320 --> 00:23:29,720
So...

377
00:23:31,900 --> 00:23:33,400
We'll just start with that.

378
00:23:33,400 --> 00:23:41,640
So, when you start your Ensemble Director, a new certificate and key, PEM, are all generated specifically to your environment.

379
00:23:41,640 --> 00:23:44,700
So, there's no shared certificates or anything.

380
00:23:44,700 --> 00:23:46,920
As well as a symmetric key.

381
00:23:46,920 --> 00:23:49,220
So, even the symmetric key is generated.

382
00:23:49,220 --> 00:23:51,760
So, the cluster is encrypted.

383
00:23:51,760 --> 00:23:56,760
The traffic between the Director and all of your nodes is encrypted with a shared key.

384
00:23:56,820 --> 00:23:58,540
And you'll see that here in a second.

385
00:23:58,540 --> 00:24:01,200
So, let's go ahead and log into the site.

386
00:24:03,280 --> 00:24:05,420
Super secret credentials there.

387
00:24:05,900 --> 00:24:07,400
And then, here's the dashboard.

388
00:24:07,400 --> 00:24:11,000
And the dashboard shows where your agents are in the world, where they're distributed.

389
00:24:11,220 --> 00:24:13,720
And when they go offline, the dots will disappear.

390
00:24:13,720 --> 00:24:15,260
And when they come online, they'll appear.

391
00:24:15,780 --> 00:24:18,240
Here's where you can set up your workspace.

392
00:24:18,240 --> 00:24:21,640
It's very easy to switch between workspaces.

393
00:24:22,020 --> 00:24:25,200
Here's your active agents and drilling into it.

394
00:24:25,980 --> 00:24:27,920
You can also see what processes are running.

395
00:24:27,920 --> 00:24:30,980
So, if something's hanging, you can go in and issue a command to kill it.

396
00:24:31,840 --> 00:24:33,940
So, this is the jobs page.

397
00:24:34,040 --> 00:24:35,500
This is the scheduled jobs.

398
00:24:35,500 --> 00:24:36,820
I'm going to slow down a little bit.

399
00:24:37,280 --> 00:24:38,980
Okay, so here's the scheduled job.

400
00:24:38,980 --> 00:24:40,700
This is the scheduled job that ran.

401
00:24:40,700 --> 00:24:42,000
Oh, I buried the lead.

402
00:24:42,000 --> 00:24:43,160
I didn't even tell you the best part.

403
00:24:43,160 --> 00:24:44,660
So, the scheduled jobs.

404
00:24:45,540 --> 00:24:49,500
It's great that we can schedule these jobs to run daily, weekly, monthly.

405
00:24:49,600 --> 00:24:54,540
But, what good is it if I have an output of like 10,000 lines?

406
00:24:54,540 --> 00:24:58,980
This will actually tell you if lines change between scans.

407
00:24:58,980 --> 00:25:05,760
So, if you run a scan daily and a new service, a new port opens up or whatever, it's going to show up in your output.

408
00:25:07,060 --> 00:25:10,780
And I think I have an example of that coming up here in a second.

409
00:25:12,860 --> 00:25:16,300
So, yeah, you can see it's actually saying, hey, look, right here.

410
00:25:16,320 --> 00:25:21,120
It's probably hard for you to see, but it'll put where the lines have changed.

411
00:25:21,120 --> 00:25:25,200
Where there's IPs that have changed or new ports that have opened up.

412
00:25:26,460 --> 00:25:27,640
It's really great.

413
00:25:27,640 --> 00:25:29,100
I love working with this tool.

414
00:25:29,880 --> 00:25:32,920
So, this is an example of creating a new command.

415
00:25:32,980 --> 00:25:34,260
It's just a simple ping.

416
00:25:34,260 --> 00:25:35,960
We're going to ping twitter.com.

417
00:25:35,960 --> 00:25:41,160
I have four agents in this cluster, so you'll see four notifications pop up that the jobs have started.

418
00:25:41,320 --> 00:25:44,500
And then you'll see the trickle in that the jobs have completed.

419
00:25:45,180 --> 00:25:46,660
It's all asynchronous.

420
00:25:48,140 --> 00:25:54,100
One thing I want to get working, a feature that I plan on implementing later this year, is I want push notifications.

421
00:25:54,100 --> 00:25:56,440
So, if you have it on your phone, it'll just buzz.

422
00:25:57,580 --> 00:25:59,020
There's the jobs.

423
00:26:00,980 --> 00:26:02,020
Good question.

424
00:26:02,020 --> 00:26:08,700
So, what you would do is you would find your favorite flavor of VPS provider, Azure AWS.

425
00:26:08,700 --> 00:26:10,880
I'm using DigitalOcean in this case.

426
00:26:11,020 --> 00:26:14,540
And you would create your server with them.

427
00:26:14,540 --> 00:26:17,880
And then you just pull down my repo, and there's one command you run.

428
00:26:17,880 --> 00:26:19,560
And it just sets it up for you.

429
00:26:19,560 --> 00:26:21,960
All the installation instructions...

430
00:26:21,960 --> 00:26:28,000
So, if you don't have Python installed, I have all the instructions to get Python configured.

431
00:26:28,000 --> 00:26:34,720
And all that stuff is in there, going from nothing, plain vanilla Linux environment to having it running.

432
00:26:34,840 --> 00:26:38,140
But I think it's like six commands total to get it up and running.

433
00:26:40,120 --> 00:26:41,140
Good question.

434
00:26:41,140 --> 00:26:43,020
I do have a Dockerfile in there.

435
00:26:43,020 --> 00:26:43,720
Do not use it.

436
00:26:43,720 --> 00:26:44,460
It's not ready yet.

437
00:26:44,460 --> 00:26:45,700
I accidentally checked it in.

438
00:26:45,700 --> 00:26:47,280
It's not done yet.

439
00:26:47,280 --> 00:26:49,160
But ideally, that's what I want.

440
00:26:49,160 --> 00:26:54,880
I want to have a Dockerfile for the director and a Dockerfile for the agents.

441
00:26:54,880 --> 00:27:00,460
So, all you have to do is literally just give the Dockerfile to your VPS and be like, Go set this machine up for me.

442
00:27:00,460 --> 00:27:01,200
And it does it.

443
00:27:01,200 --> 00:27:02,860
I just ran out of time, honestly.

444
00:27:02,860 --> 00:27:05,800
So, I'll have the Dockerfile up here shortly.

445
00:27:06,080 --> 00:27:07,940
Or, it is open source.

446
00:27:07,940 --> 00:27:11,220
I'm encouraging people to give me a hand with it.

447
00:27:11,220 --> 00:27:16,480
If you want to take part in this project, feel free to create your own Dockerfile and create a pull request.

448
00:27:16,480 --> 00:27:17,300
I'll add it in.

449
00:27:17,300 --> 00:27:18,120
No problem.

450
00:27:19,160 --> 00:27:20,240
Almost done.

451
00:27:20,300 --> 00:27:22,320
This is the event stream here.

452
00:27:22,920 --> 00:27:24,960
I know it kind of looks like ish.

453
00:27:25,360 --> 00:27:27,380
A lot of this I crammed in at the last minute.

454
00:27:27,380 --> 00:27:30,880
But this is the stream of events that have happened on the server.

455
00:27:30,880 --> 00:27:37,340
So, if you're kind of confused of if an agent goes offline or if a command is run or not, you can come in here and view it.

456
00:27:39,440 --> 00:27:41,660
And then, what do we have left here?

457
00:27:47,710 --> 00:27:49,190
That's going to show how to schedule a job.

458
00:27:49,190 --> 00:27:49,990
We'll skip past that.

459
00:27:50,270 --> 00:27:52,110
It's pretty simple to schedule a job.

460
00:27:52,110 --> 00:27:55,510
You just come in here and select when you want it to run.

461
00:27:55,510 --> 00:27:59,510
This one is actually supposed to run now, seven minutes ago.

462
00:27:59,510 --> 00:28:01,430
So, my cluster probably just ran this.

463
00:28:01,490 --> 00:28:06,990
I set it up to run on the 11th of August at 5.40 p.m.

464
00:28:08,170 --> 00:28:09,190
against Twitter.

465
00:28:09,190 --> 00:28:11,410
So , that one actually should have just executed.

466
00:28:13,010 --> 00:28:14,570
And then, what do we have?

467
00:28:14,570 --> 00:28:15,430
There it is right there.

468
00:28:15,430 --> 00:28:17,110
It shows that it's scheduled.

469
00:28:18,710 --> 00:28:20,870
And then, finally, these are the settings.

470
00:28:20,870 --> 00:28:25,690
So, up here, I'll show you up here at the top of the settings when it gets there.

471
00:28:28,820 --> 00:28:39,180
So, up here at the top of the settings, when you start your Ensemble Director, it will generate your private shared key for you here.

472
00:28:39,180 --> 00:28:43,660
And this is actually the command you're going to run on your agent machine.

473
00:28:43,660 --> 00:28:45,980
So, you pull down the code on your agent machine.

474
00:28:45,980 --> 00:28:48,000
You run this command in the directory.

475
00:28:48,840 --> 00:28:51,200
Everything gets hooked up automatically for you.

476
00:28:51,200 --> 00:28:52,500
You don't have to do anything else.

477
00:28:53,400 --> 00:28:54,740
It's pretty straightforward.

478
00:28:56,380 --> 00:28:57,720
Not a ton of settings in here.

479
00:28:57,720 --> 00:28:59,160
You have the ability to change your password and stuff.

480
00:28:59,160 --> 00:29:02,200
But down here, this is where you would edit your command templates.

481
00:29:02,540 --> 00:29:08,820
So, if you have your own favorite tools and your own favorite commands that you want to run, you can easily add them in here.

482
00:29:08,820 --> 00:29:10,600
And then, they'll be available in your create job.

483
00:29:10,600 --> 00:29:13,520
And you can just blast them off whenever you want.

484
00:29:13,520 --> 00:29:15,580
Or if you don't like the ones I put in here, you can delete them.

485
00:29:17,760 --> 00:29:20,360
That's pretty much it for the demo.

486
00:29:21,400 --> 00:29:28,760
Everything, like I said, is available on my github, dotnetrussell.com.

487
00:29:28,760 --> 00:29:30,500
The tool is called Ensembl.

488
00:29:30,500 --> 00:29:32,600
It's free and open source and available now.

489
00:29:32,600 --> 00:29:38,440
And I encourage, like I said, anybody that wants to take part in helping me develop this, please do.

490
00:29:38,440 --> 00:29:40,460
I'm happy to have you as a contributor.

491
00:29:40,760 --> 00:29:41,800
And that's all I got.

492
00:29:41,800 --> 00:29:42,580
Thank you.

493
00:29:42,580 --> 00:29:43,520
Thank you.