start	end	text
0	3500	Our next talk is going to be starting now.
3520	5940	So the next talk is by Anthony Roussel,
5940	8020	who's going to be talking about Bug Bounty Recon,
8020	10980	bypassing geographic DNS, and Ensembl.
10980	14240	He's a professional .NET developer, hobbyist, hardware dev,
14240	16920	published over 50 Windows phone apps,
16920	18600	spoken at a lot of conferences,
18600	21980	so let's give him a round of applause and get started.
22400	25180	Over to you.
25180	26480	Thank you so much.
26800	29980	Alright, wow, what a great introduction.
30780	34860	Yeah, so this talk is geo-distributed Bug Bounty Recon,
34860	37560	bypassing things like geographic DNS,
37560	41680	and more with this new free open-source tool called Ensembl.
41980	43380	This is me.
43560	45280	My name is Anthony Roussel.
45280	47400	I go by the handle .NET Roussel.
47480	49400	I'm a professional software engineer.
49400	51080	I've been an engineer for about 11 years.
51080	54460	I've worked on various systems, lots of boring stuff,
54460	56640	but mostly in C-sharp and F-sharp,
56640	60200	lots of Python, which I'm sure most of you are familiar with.
60740	63940	If you're interested in more about what I do and what I've done,
63940	67180	you can check out my blog, dotnetroussel.com.
67300	68840	If you want to reach out to me personally,
68840	71180	you can hit me up on Twitter, at dotnetroussel.
71180	74700	And all of the code that I'm going to be presenting today,
74700	76640	I won't actually show you code, so don't worry.
76980	79000	No boring code.
79120	81500	But if you're interested in the tool itself,
81500	85580	it can be found on my GitHub, which is forward slash dotnetroussel.
85580	88540	And the tool is called Ensembl.
89360	92260	All right, so before I get into the tool,
92260	96320	I want to briefly talk about kind of the hacker journey.
96320	99100	You know, like how I got here, how I wrote this tool,
99100	100580	why I wrote this tool.
100620	103680	And I hope that it resonates with some of you,
103680	106140	because I think a lot of us take similar paths.
107580	110580	So early on, when I started engineering,
110580	116440	you know, there were a lot of people that enjoyed security,
116440	118680	but no one really took it serious.
118760	120480	Can I get just a quick show of hands?
120480	121820	How many people here are engineers?
122680	124560	Professionally, yeah. So we got a lot of engineers in here.
124560	126700	Do your companies take security serious?
126700	128520	I mean, hopefully you guys do, because you're here,
128520	130320	or you people do, right?
130460	133840	Okay, so for the people watching later on,
133840	138080	nobody raised their hand that their companies took security serious.
138080	142820	So, like a lot of you, you know, I take security very serious.
142820	145140	I take it serious in my day-to-day job,
145140	146820	but the companies that I've worked for in the past
146820	148740	have not always taken it serious.
148740	151280	Thankfully, I'm at a place now that does take it serious.
151640	153980	But yeah, when I was getting started,
153980	157900	I was confused why these companies didn't take it more serious.
157900	161180	And I started doing some reading,
161180	163220	things like 24 deadly sins.
163220	164300	I actually didn't read that one.
164300	167340	I think it was 10 deadly web sins, or something like that,
167340	168560	when I first started.
169540	172300	And I started poking holes in the applications
172300	174740	that I was working on professionally.
174740	177460	And, man, companies get really mad
177460	179900	when you start rooting their applications
179900	183140	and, like, finding, you know, all types of stuff,
183140	184460	like Stack Overflow.
185900	188460	Yeah, so I started branching out
188460	190420	and getting away from what I was working on
190420	193160	and started doing things like getting into bug bounties
193160	196560	and virtual, like, bone hub, things like that,
196560	197580	hack the box.
198640	202480	But as far as the books that I used to get into it,
202480	204100	I started with the deadly sins
204100	207760	and these hacking books like this, like Violent Python.
208880	210840	And I also did a lot of...
210840	212900	I read a lot of the penetration testing book
212900	215180	and the open source intelligence techniques.
215180	217320	Have you guys... has anybody read any of these?
217320	218460	A lot of these should look familiar.
218460	220320	These are pretty big in the community.
221020	224080	I also, you know, I wasn't going to add these,
224080	226240	but, you know, obviously Kevin Mitnick just passed away.
226500	228800	Unfortunately, a huge loss to the community.
229220	231280	My first DEF CON, DEF CON 22,
231280	232360	I didn't know him personally,
232360	234840	but I did have an opportunity to meet him.
234840	237080	I got him to sign a copy of one of my books.
237080	239080	I was so fortunate. I still have it.
239180	244060	And I have one of those cool laser-cut lockpicks,
244060	245920	lockpick key cards that he had.
245920	248180	So if you don't know who Kevin Mitnick is,
248180	250300	I highly recommend you learn about him.
250300	253400	Learn about his story. He was a huge loss to the community.
253420	255640	But, yeah, those are two great books by him.
255640	258200	He has a bunch of books out. Those are my favorites.
258580	262040	And then, does anybody know what Stuxnet is?
262180	264880	Yeah, a lot of us. We should all know what Stuxnet is.
265020	266520	Countdown to Zero Day.
266860	269680	That one, I'm pretty sure that's about Stuxnet.
269860	273960	And if you're doing any type of bug bounty or red teaming,
273960	277580	you should definitely have the Hacker Playbook in your arsenal.
277580	281080	I had number two and number three.
281340	284020	And I tell you, every single time, I'm doing anything.
284020	285600	That's the first book that comes out.
285600	287780	And it doesn't matter how many times I've done it,
287780	290640	I'm definitely not an expert. I don't want to come across as an expert.
290640	295740	But every single time I start to do a vulnerable virtual machine,
295740	297980	hack the box, a bug bounty, it doesn't matter.
297980	302180	Hacker Playbook comes out and I start going through the tools and going through the motions.
302180	305680	Because a lot of what we do is a methodology.
305680	308660	A lot of what we do is repetitive.
309860	311600	That's going to make sense here in a second.
311700	314240	So here are the tools that we're using.
315160	317180	These should all look familiar to you.
317180	321360	We have Kali Linux, Parrot, then obviously the platforms,
321360	325140	Bugcrown and HackerOne, Hack the Box, Vault and Hub.
325140	326240	These should all be familiar.
326240	328480	If not, dig into these tools.
328480	330060	These are going to be your bread and butter.
331280	337320	So that's the story of how you get into this, how I got into this stuff.
337480	342120	Now I want to talk about you and how you're interacting with bug bounties.
342120	344320	So the bug bounty hunter story.
344500	347420	So the first thing we do when we're looking for a bug bounty
347420	352180	is we head over to something like Bugcrown or HackerOne.
352260	358060	And you find your favorite flavor of whatever bug bounty program you want.
358060	361020	And you pick it and you start reading their description.
361020	364120	You start going through what they want you to find,
364940	367700	what domains they want you to look at, the scope.
367720	372400	The scope of your program that you're going to work on.
373060	376840	So today we're going to look at the Twitter bug bounty.
376860	380400	Has anybody here taken part in the Twitter bug bounty?
380400	382060	Okay, so we've got a few people. Great.
382220	384700	I'd definitely be interested in speaking to you after
384700	389280	and hearing about your experience and seeing if it aligns with this at all.
390660	393360	So if we look at the Twitter bug bounty,
393360	395740	they give us a scope of these domains here.
395740	397060	I think there's seven there.
398860	402400	Now, are we just going to start digging into these seven?
402460	405320	Are you just going to go to Twitter.com and start hammering on it?
405320	407040	Raise your hand. Who's going to do that?
407600	409140	Okay, good. I'm happy nobody raised their hand.
409360	414240	That's probably the least effective way to take part in a bug bounty program.
415100	416940	We have a lot of engineers in here.
416940	420180	Everybody knows that engineers, when we're developing something,
420180	422080	we're developing a golden path.
422080	425280	Even if we don't know we're developing a golden path, we develop a golden path.
425280	429260	A path that we expect all of our users to take.
429720	432220	And the engineers at Twitter, I don't know any of them,
432220	435980	but I guarantee they expect you're going to type in Twitter.com
435980	438260	and that's going to take you to their landing page.
438260	441940	And then you're going to go to the login or to the sign-up.
441940	444600	And then you're going to end up on your Twitter profile.
444640	447500	There's a golden path they expect you to go through.
447500	451240	And I promise you that they have spent millions and millions of dollars
451240	453560	hardening that attack surface.
453700	457120	If you go to Twitter.com today and you get in with admin-admin
457120	459980	or any SQL injection, I will give you my next paycheck.
459980	461740	That is not going to happen, okay?
461820	465220	Those are hardened targets. We don't want those targets.
465360	467600	What do we want? Does anybody know? Shout it out if you know.
467600	468540	What do we want?
468540	470240	All right, that's okay.
470240	474520	We want the side door, the window that's unlocked and open.
474520	477520	We want the thing that they forgot about.
477520	481740	I want the SSH server that has default credentials.
481740	485160	I want the FTP server that has anonymous login.
485160	490600	I want the dev environment that some intern set up six weeks ago
490600	495720	and nobody noticed that it's public-facing and that it has some critical flaw in it.
495720	497140	Those are the things I want.
497140	500020	A lot of people think those don't exist. They do.
500020	502520	I promise you, these things exist.
502840	504660	I recently found...
504660	508520	Obviously, if you take part in Buck Binders, you know you can't name names.
508780	519460	I recently found an SSH server on a non-standard port with default credentials for a major ISP.
520380	523720	It happens. This is recently. It just happened.
523720	528420	I encourage you to not take the golden path.
528420	531600	That's really the key to being successful with this stuff.
533020	535540	This is where the struggle begins.
535580	538620	Trying to get off the beaten path.
538960	542920	We want to first figure out what our subdomains are.
543000	549760	Actually, there's a CTF going on next door for the Recon Village for doing subdomain enumeration.
549760	552240	I encourage you to try it out.
552240	555900	You'll be using things... This is not a comprehensive list.
555900	561100	There's probably a lot of tools in here, but there's a few tools that you probably use to do subdomain enumeration.
561140	563760	You've got SubFinder, SubLister, Amass.
564060	570680	We're going to take those seven domains that they gave us for our scope, and we're going to put them in there.
570680	573100	We're going to see how many results we get back.
573660	576100	I have the actual number. I did this.
576100	579080	I want to know, except for the people that actually did this program.
579080	584540	Does anybody know how many subdomains I found just off those seven?
585020	586900	Throw out a number. Anybody. Any guesses?
588140	588860	200?
590060	590980	Anybody else?
591900	592880	5,000?
593840	595720	I don't want to hear that guy. I know him.
597220	600660	So I actually did this, and I found...
601180	603340	It took a second for it to load, because there are so many.
603340	608740	1,449 subdomains. It's a ridiculous amount.
608740	612420	Now, what's the problem? Can anybody tell me what the problem is with this number?
612420	615860	Reminder, I did not do anything. I just found the subdomains.
615860	617540	So what's the problem with this?
618260	619220	Anybody?
621020	623580	They're not all active. That's right. You nailed it.
623580	625520	That's exactly it. They are not all active.
625520	631660	So we have to enumerate this massive list now and find which hosts are actually up and active.
632260	636660	Because if we don't, we're going to be running scans against things that are totally dead,
636660	639640	and it's going to be just wasting time, burning time.
639680	643220	So yeah, we need to figure out what hosts are active.
643540	647360	Then we're going to start, after we have our up list, we've got to do our port scans
647360	650060	and figure out what services are running on those hosts.
650340	653360	Then you're really going to start getting nitty-gritty.
653360	656100	You're going to start doing your script scanning with Nmap.
656100	659260	You're going to run your NIC2 against their web servers.
659260	662740	WP scan, everything, right?
662740	667440	And then, obviously, that bullet on there, the Telnet, WebDev, FTP.
667440	672120	I found, once again, it's another bug bounty, so I can't say exactly who,
672120	678340	but there was a government site that actually takes part here at DEF CON quite frequently.
678340	684760	They had an insecure WebDev server, and I was able to start manipulating files on their server.
684760	687260	So this stuff definitely exists.
687940	691220	Get off the golden path. I can't say that enough. That's really important.
692540	699660	So, yeah, this is going to turn into thousands and thousands of requests that we have to make
699660	705500	in order to fully map the attack surface, because that's what we're trying to do with our recon.
705680	708340	We're not actually breaking in anything with recon.
708340	713860	A lot of this is passive until we start getting into actual scanning.
713860	718800	But we're trying to map out the attack surface and figure out where the weakest points are
718800	724300	so that we can start poking at those points and try and win a bounty.
724300	725880	That's what we're here for.
726000	729800	The less time you can spend doing this, the more money you're going to make.
729800	733840	That's really what it comes down to. I think everybody should know that.
734240	740060	So one final thing that you're going to run into as a bug bounty hunter is this thing called GeoDNS.
740060	744500	This is not a trick question. Does anybody know what GeoDNS is? It's in the name.
745080	748780	You know what it is. If you don't know what it is, that's fine.
748780	751840	It's not a security mechanism by any means.
753720	757200	GeoDNS improves the user experience in some cases.
757200	765300	It'll help if you're in Germany or you're in Australia and you're trying to pull up Google.com.
765300	767960	You don't want to have to connect to San Francisco.
767960	773380	You want a server that's close to you to resolve. That way your experience is fast.
773380	781020	There's also some other reasons for GeoDNS, like laws, where data can be stored and can't be stored, things like that.
781100	783260	There's a lot of reasons for GeoDNS.
784260	788340	It's great for everybody. There's nothing wrong with GeoDNS. It's great for everybody.
788460	796120	You as a bug bounty hunter, however, this is horrible because this means you're missing everything else.
796120	807220	If there's a company that has GeoDNS enabled and you're in Alberta or Illinois or whatever, and you're making requests,
807220	809700	you're going to get the servers here in North America.
809700	812580	You're not going to get the ones in Germany. You're not going to get the ones in France.
812580	815680	You're not going to get the ones in Sweden or Australia or Africa.
815840	822340	You're going to get the ones here, and your whole bug bounty is going to be against the American servers,
822340	824180	which I promise you are probably pretty hard.
824180	829100	So we want to see those other servers. We want to get around GeoDNS.
829260	833840	And that's kind of what this diagram right here is what I ripped off from Microsoft.
834500	840140	I'm pretty sure this is like the Azure GeoDNS system, what they have set up. It's not important.
841300	845300	So how do we do that? There are lots of ways that we can get around GeoDNS.
846100	852300	I'm going to show you the ways that exist, and then I'm going to show you the way that I created, and I'm hoping that you like it.
852300	859520	So we adapt and overcome. Very simple. VPNs and proxies. That would be our way to get around it.
860260	865780	The problem with VPNs and proxies, though, especially when you're talking about a global company,
865780	871560	one that has servers all over the world, is that you're going to have to maintain a VPN in every region,
871560	874440	and you're going to have to maintain proxies in every region.
874440	878660	You're going to have to have these set up, and then you're going to have to manually switch between them,
878660	881760	unless you're good enough to script switching between them.
881760	885740	And then you're going to have to manually rerun all these commands in every region.
886660	893180	And as a lot of your engineers, we know when you have to do things repetitively by hand, it is error-prone.
894360	897240	Constantly, you're going to have bugs. You're going to miss things.
898020	904260	It's very repetitive. You're spending a lot of time at the keyboard instead of getting outside and enjoying the sun.
904840	909820	I know a lot of us don't enjoy the sun, but for those of you that like to get outside and enjoy the sun,
909820	912960	you're missing out on that because you're spending it at the keyboard.
914780	916900	And that's where Ensembl comes in.
918080	923580	Ensembl is a new tool. It's a new platform that I created. I spent about a year and a half writing it.
923580	929200	If you look at the code and you know Python, it'll be apparent that I crammed it out in a year and a half.
930540	933800	But it's a new tool. It's open source. It's totally free.
933800	942360	And what it does is it allows you to set up a globally distributed cluster of machines, of agents,
942360	949280	that report back to a web portal, a masternode, that you can distribute commands across. It's very easy.
949500	956340	This program will let you take... so for example, I'm doing the bug bounty next door for the subdomains.
956340	961980	There was like... is anybody else doing that CTF? The subdomain CTF for the Recon Village?
961980	969680	Okay, so since you're not doing it, I'll tell you. There's 15,000 domains in a Word file that they're giving out.
969680	974680	And you have to figure out how many subdomains you can find, right? And whoever comes up with the most wins.
974700	976960	I'm pretty sure those are the rules, right? Something like that?
976980	985260	So everyone over there is over there hammering on their keyboards right now, trying to crank out as many subdomains as they can.
985360	991020	I opened up... I actually have a cluster running right now. I opened it up. I took those 15,000 subdomains.
991020	998540	I dropped it in here. It distributed it across my cluster. And I'm actually competing in the CTF right now while I'm giving this talk.
998840	1005040	And it's not doing it one at a time. It's doing all of them at once. Simultaneously.
1005680	1010320	And all I'll have to do, when it's done, when the jobs are done, it'll pop up a notification.
1010320	1015500	It'll say, hey, your work is done. I go into the job output. Grab all the results.
1015500	1020700	And I'll probably run them through a unique filter, like a sort unique or something like that.
1020700	1024440	Make sure I don't waste your guys' time having to dig through finding unique ones.
1024440	1029680	But I'm going to find a lot of them. I'm probably going to get a place pretty high on the list. I'm hoping. We'll see.
1029840	1032820	But that's essentially the long and short of what Ensembl is.
1032820	1041300	It allows you to take commands, take huge amounts of targets, and distribute this workload evenly across your cluster.
1041300	1047180	It also allows you to bypass things like geodns. That's what this diagram is here.
1047340	1051520	On the far left here, this is you. You're the user.
1051860	1055820	And you have a command you want to run and some targets you want to run it against.
1056760	1060000	You issue that command to the director, which is your masternode.
1060000	1062060	You do that through the web portal here.
1062460	1066140	And the masternode says, OK, how do we want to do this?
1066140	1070620	Do we want to do it in a load-balanced fashion, which is what I'm doing with the subdomains over there?
1070620	1077520	I said, do it in a load-balanced fashion, which means it's going to take all the targets and break them up across my cluster.
1077980	1087380	Or you can do it in a way where it runs the same exact command against the same exact targets in every region,
1087380	1089820	which is how you bypass things like geodns.
1089820	1092060	And that's what this diagram is showing here.
1092060	1095080	So in this diagram, we're running a command.
1095080	1098020	The director issues it across the entire cluster.
1098020	1106720	And each of these agents in the cluster are going to reach out to the geodns traffic manager, which we don't control.
1106720	1109580	That's somebody else that's controlling that.
1109580	1117820	Each of these agents are going to reach out to the geodns traffic manager, and they're going to say, hey, resolve this domain for me.
1117900	1127480	And the traffic manager is going to say, OK, well, if you're in North America, South America, or Central America, you guys are all going to go to this server over here, right?
1127480	1136260	However, if you're in Asia or Europe or Africa, you actually each get your own server that you're going to.
1136300	1139880	And it's going to run these commands against each of these servers.
1139880	1148460	Now, if you're a bug bounty hunter and you're not doing this, you're only going to get that one server in your region, and you're going to miss the rest of them.
1148480	1152860	So this is opening up the attack surface for you to find more things.
1152860	1159560	And I guarantee you that there are servers out there in other regions that are part of bug bounty programs that nobody has seen.
1159640	1161440	I guarantee you.
1163520	1167660	So here's an example of the workspaces.
1167660	1171620	So I have it set up so you can actually run multiple bug bounty programs at once.
1171620	1180180	I actually have a couple of bug bounty programs in my live cluster right now, and the CTF is not interfering with them because I have it in a different workspace.
1180180	1193300	So if you're running a Twitter bug bounty and a SpaceX bug bounty and a Google bug bounty, you can do all of those, have all of the results separated, and be able to parse through them easily.
1193300	1195440	So that's what the workspaces are.
1195820	1201320	Here's an example of the... and don't worry if you can't read this. I actually have a video that I'm going to show at the end.
1201320	1203740	It's a very short three-minute video of it actually working.
1204240	1211220	This is the agents page. It shows you your active agents and their health status, the last time they checked in, how many jobs they're running.
1211220	1215480	You can drill into the agents. That map in the front was actually where the agents are positioned.
1215620	1226280	So this is actually my cluster right here. I have one in southern Australia, one in southern India, I think that's Germany, or yeah, I don't know, one of those European countries, and then one in Toronto.
1226640	1231280	But you can have as many nodes on the cluster as you want. It's up to you.
1231860	1236520	Ideally, you would have one in every region of the world, on every continent, maybe a couple countries.
1237960	1240860	But yeah, so that's what this is. This is the agents that are alive.
1241180	1245900	And then you can drill into it and see their health status, their CPU usage, their memory consumption.
1246280	1249100	You can restart the agent, all types of stuff.
1250960	1254540	So it gets better. I feel like I'm selling this to you, but it gets better.
1254540	1262180	Not only do you have all the capabilities that I've talked about, but you also have the ability to schedule these jobs.
1262220	1272700	So another big problem that bug bounty hunters run into is they do all their recon at the beginning, and then they spend the rest of the bug bounty doing what?
1272700	1276720	Trying to poke at it, right? They never run their recon again. They run it once.
1276720	1279660	However, companies don't exist in a vacuum.
1279660	1291300	There's always going to be intern schmuckatelli out there who's setting up some stupid service that's public facing that gives you access behind their application firewall.
1291300	1297220	There's always going to be that way. So if you only run your recon one time, you're going to miss when he does that or she does that.
1297600	1303480	What you can do with Ensemble is you can schedule these jobs to run daily, weekly, monthly.
1303480	1306980	You can also schedule them to run at a specific date and time.
1306980	1315640	So if you are working hand in hand with a company and you don't want to blast their environment during peak hours, you can set your scans up to run at 2 a.m.
1315640	1322460	And then you can go to bed, your scans will run, and the results will be there in the morning when you wake up and you can do your analysis.
1323340	1328540	So that's one feature I really love. I use this quite a bit. It's really nice.
1328940	1334660	This is an example of how we create a job. And you'll see this in the video once again. Don't worry if you can't read it.
1335500	1341280	I have some command templates built in. You're able to add your own command templates if there's commands that you like to run frequently.
1341920	1347760	But you have the ability to put your own commands in here. You don't even need a template. You can just fill in the command however you want.
1348080	1352240	And then you can schedule it to run however you want, daily, weekly, monthly.
1352680	1356240	You can decide if you want it to be load balanced or however.
1356680	1361080	And then down here you put in your... down at the bottom you put in whatever targets you want.
1361080	1368960	So what I did was I ran SubFinder. I'm sure you guys have heard of SubFinder. That's a subdomain enumeration tool.
1369140	1373780	I put SubFinder in there as my command. I said run it as a load balanced command.
1373780	1379480	And then I took those 15,000 domains that they have in their CTF and I dropped it in the target list and I hit go.
1379560	1385280	And then I came in here to give this talk. And now that is running and I don't have to do anything.
1385960	1390060	I can get away from the keyboard. Well, this is supposed to be a video. I have a video I'll show you here in a second.
1390620	1394060	I can get away from the keyboard and not have to worry.
1395100	1398900	Alright, so let's take a look at the video here. I have it already queued up.
1400140	1406000	So, everything is secure. Oh, hang on. At DEF CON, don't want to say that.
1406320	1409720	I, to the best of my ability, everything is secure. So...
1411900	1413400	We'll just start with that.
1413400	1421640	So, when you start your Ensemble Director, a new certificate and key, PEM, are all generated specifically to your environment.
1421640	1426920	So, there's no shared certificates or anything. As well as a symmetric key.
1426920	1431760	So, even the symmetric key is generated. So, the cluster is encrypted.
1431760	1436760	The traffic between the Director and all of your nodes is encrypted with a shared key.
1436820	1438540	And you'll see that here in a second.
1438540	1441200	So, let's go ahead and log into the site.
1443280	1445420	Super secret credentials there.
1445900	1451000	And then, here's the dashboard. And the dashboard shows where your agents are in the world, where they're distributed.
1451220	1455260	And when they go offline, the dots will disappear. And when they come online, they'll appear.
1455780	1461640	Here's where you can set up your workspace. It's very easy to switch between workspaces.
1462020	1465200	Here's your active agents and drilling into it.
1465980	1470980	You can also see what processes are running. So, if something's hanging, you can go in and issue a command to kill it.
1471840	1475500	So, this is the jobs page. This is the scheduled jobs.
1475500	1476820	I'm going to slow down a little bit.
1477280	1480700	Okay, so here's the scheduled job. This is the scheduled job that ran.
1480700	1483160	Oh, I buried the lead. I didn't even tell you the best part.
1483160	1484660	So, the scheduled jobs.
1485540	1489500	It's great that we can schedule these jobs to run daily, weekly, monthly.
1489600	1494540	But, what good is it if I have an output of like 10,000 lines?
1494540	1498980	This will actually tell you if lines change between scans.
1498980	1505760	So, if you run a scan daily and a new service, a new port opens up or whatever, it's going to show up in your output.
1507060	1510780	And I think I have an example of that coming up here in a second.
1512860	1516300	So, yeah, you can see it's actually saying, hey, look, right here.
1516320	1521120	It's probably hard for you to see, but it'll put where the lines have changed.
1521120	1525200	Where there's IPs that have changed or new ports that have opened up.
1526460	1529100	It's really great. I love working with this tool.
1529880	1532920	So, this is an example of creating a new command.
1532980	1535960	It's just a simple ping. We're going to ping twitter.com.
1535960	1541160	I have four agents in this cluster, so you'll see four notifications pop up that the jobs have started.
1541320	1544500	And then you'll see the trickle in that the jobs have completed.
1545180	1546660	It's all asynchronous.
1548140	1554100	One thing I want to get working, a feature that I plan on implementing later this year, is I want push notifications.
1554100	1556440	So, if you have it on your phone, it'll just buzz.
1557580	1559020	There's the jobs.
1560980	1562020	Good question.
1562020	1568700	So, what you would do is you would find your favorite flavor of VPS provider, Azure AWS.
1568700	1570880	I'm using DigitalOcean in this case.
1571020	1574540	And you would create your server with them.
1574540	1577880	And then you just pull down my repo, and there's one command you run.
1577880	1579560	And it just sets it up for you.
1579560	1581960	All the installation instructions...
1581960	1588000	So, if you don't have Python installed, I have all the instructions to get Python configured.
1588000	1594720	And all that stuff is in there, going from nothing, plain vanilla Linux environment to having it running.
1594840	1598140	But I think it's like six commands total to get it up and running.
1600120	1601140	Good question.
1601140	1603020	I do have a Dockerfile in there.
1603020	1604460	Do not use it. It's not ready yet.
1604460	1607280	I accidentally checked it in. It's not done yet.
1607280	1609160	But ideally, that's what I want.
1609160	1614880	I want to have a Dockerfile for the director and a Dockerfile for the agents.
1614880	1618900	So, all you have to do is literally just give the Dockerfile to your VPS and be like,
1618900	1621200	Go set this machine up for me. And it does it.
1621200	1622860	I just ran out of time, honestly.
1622860	1625800	So, I'll have the Dockerfile up here shortly.
1626080	1627940	Or, it is open source.
1627940	1631220	I'm encouraging people to give me a hand with it.
1631220	1636480	If you want to take part in this project, feel free to create your own Dockerfile and create a pull request.
1636480	1638120	I'll add it in. No problem.
1639160	1640240	Almost done.
1640300	1642320	This is the event stream here.
1642920	1644960	I know it kind of looks like ish.
1645360	1647380	A lot of this I crammed in at the last minute.
1647380	1650880	But this is the stream of events that have happened on the server.
1650880	1657340	So, if you're kind of confused of if an agent goes offline or if a command is run or not, you can come in here and view it.
1659440	1661660	And then, what do we have left here?
1667710	1669990	That's going to show how to schedule a job. We'll skip past that.
1670270	1672110	It's pretty simple to schedule a job.
1672110	1675510	You just come in here and select when you want it to run.
1675510	1679510	This one is actually supposed to run now, seven minutes ago.
1679510	1681430	So, my cluster probably just ran this.
1681490	1689190	I set it up to run on the 11th of August at 5.40 p.m. against Twitter.
1689190	1691410	So, that one actually should have just executed.
1693010	1695430	And then, what do we have? There it is right there.
1695430	1697110	It shows that it's scheduled.
1698710	1700870	And then, finally, these are the settings.
1700870	1705690	So, up here, I'll show you up here at the top of the settings when it gets there.
1708820	1719180	So, up here at the top of the settings, when you start your Ensemble Director, it will generate your private shared key for you here.
1719180	1723660	And this is actually the command you're going to run on your agent machine.
1723660	1725980	So, you pull down the code on your agent machine.
1725980	1728000	You run this command in the directory.
1728840	1731200	Everything gets hooked up automatically for you.
1731200	1732500	You don't have to do anything else.
1733400	1734740	It's pretty straightforward.
1736380	1737720	Not a ton of settings in here.
1737720	1739160	You have the ability to change your password and stuff.
1739160	1742200	But down here, this is where you would edit your command templates.
1742540	1748820	So, if you have your own favorite tools and your own favorite commands that you want to run, you can easily add them in here.
1748820	1750600	And then, they'll be available in your create job.
1750600	1753520	And you can just blast them off whenever you want.
1753520	1755580	Or if you don't like the ones I put in here, you can delete them.
1757760	1760360	That's pretty much it for the demo.
1761400	1768760	Everything, like I said, is available on my github, dotnetrussell.com.
1768760	1770500	The tool is called Ensembl.
1770500	1772600	It's free and open source and available now.
1772600	1778440	And I encourage, like I said, anybody that wants to take part in helping me develop this, please do.
1778440	1780460	I'm happy to have you as a contributor.
1780760	1782580	And that's all I got. Thank you.
1782580	1783520	Thank you.