[00:00.000 --> 00:06.000]  All right, so up next we have someone who doesn't need an introduction. He was our moderator for
[00:06.000 --> 00:11.900]  the panel talk that we had in the morning. The CISO and hacker in charge at VoodooBot,
[00:11.900 --> 00:18.720]  Jason Haddix. Along with him, there is Gunnar Andrews and Oliver Gulushi, who would be also
[00:18.720 --> 00:24.840]  joining this particular talk. And the topic that they'll be talking on is Easy EASM,
[00:24.840 --> 00:29.580]  the zero dollar attack surface management tool. So please give it up for Jason Haddix and his team.
[00:35.610 --> 00:40.650]  Okay, so you can obviously see that we changed the slides from Black Hat. We still have the logo in here.
[00:41.230 --> 00:48.150]  So we released this tool at Black Hat a couple days ago at Arsenal. We'll be continuing to work on it,
[00:48.150 --> 00:54.170]  you know, in perpetuity hopefully. And so what you're seeing today is the start of kind of a framework.
[00:54.170 --> 00:55.930]  So let's get into it.
[00:57.840 --> 01:06.060]  Or not. There we go. Okay. So we're in the recon village, right? And so normally in the recon village,
[01:06.060 --> 01:11.640]  or at least I'd probably say 60-40, you know, is probably the breakup. 60% of it is offensive talks
[01:11.640 --> 01:19.540]  and 40% is defensive talks. I would say our tool fits more on the defensive side. So as hackers,
[01:19.540 --> 01:26.580]  we know a workflow called recon. And the idea of recon is to find as many assets of a target as possible.
[01:26.580 --> 01:30.380]  It's either for a bug bounty or red teaming or, you know, hacking them, right?
[01:30.440 --> 01:39.080]  But in the defensive world, you can, through all kinds of happenstance, lose track of your internet-facing assets.
[01:39.080 --> 01:46.720]  Basically, business unit siloing, acquisitions, rogue IT where some, you know, like random development group
[01:46.720 --> 01:51.240]  decides to spin up some cloud infrastructure, or someone decides to take a corporate credit card in marketing
[01:51.240 --> 01:57.100]  and spin up a marketing site or buys a license to a SaaS service that gives them a domain or something like that, right?
[01:57.440 --> 02:03.060]  So through a whole bunch of different types of mismanagement, you can lose track of your internet-facing footprint.
[02:04.860 --> 02:14.440]  Now, hackers have been doing the offensive side for a long, long time. So pre-2015, when I was a red teamer,
[02:14.440 --> 02:20.400]  you would brute force to find somebody's assets, their subdomains. And so the most common tool back in the day
[02:20.400 --> 02:27.180]  was Fierce. Did any of you use Fierce to do brute forcing? One person. Okay. Two people. Okay, cool.
[02:27.320 --> 02:34.000]  The most predominant tool was Fierce. And so what you would do is you would, you know, let's say I had a red team assessment
[02:34.000 --> 02:42.840]  for Cisco.com. Well, I would just try to resolve admin.cisco.com and store.cisco.com and dev.cisco.com.
[02:42.840 --> 02:47.920]  And I would basically throw this huge list and try to resolve all of these things on this list.
[02:47.920 --> 02:51.920]  And if it did resolve, that meant I found it and it goes on my list to hack, right?
[02:52.380 --> 03:00.160]  And then in 2015, there was a big kind of jump towards finding these assets in a different way, finding these subdomains.
[03:00.160 --> 03:06.280]  And so the first tool was SubLister. So SubLister took the idea and kind of inverted it a little bit.
[03:06.280 --> 03:14.480]  Instead of me trying to resolve on a DNS resolver and see if I could find your site, it instead went to all of these sites on the internet.
[03:14.480 --> 03:19.300]  Things like cert.sh and Shodan and all of these other places, search engines.
[03:19.300 --> 03:24.380]  And it would go ask them, have you ever seen anything for .cisco.com?
[03:24.580 --> 03:27.640]  And then that would return and say, yeah, I've seen all of these sites.
[03:27.640 --> 03:32.260]  And there's about 50 places on the internet where you can go and grab this data from.
[03:32.320 --> 03:35.800]  So SubLister was the first one to do this technique in 2015.
[03:36.320 --> 03:42.860]  Then in 2017 and 2018, we had Amass and SubFinder, which are the predominantly used tools today.
[03:42.860 --> 03:46.100]  One is an OWASP project by Jeff Foley, and the other one is Maintained.
[03:46.100 --> 03:51.920]  It was started by Iceman and Michael... what's Michael's last name?
[03:52.060 --> 03:57.320]  Michael Skelton, and then it was taken over by Project Discovery as of recently.
[03:57.320 --> 04:01.980]  Between those two tools, they run in about 70 different internet sources,
[04:01.980 --> 04:08.400]  and they scrape them or pull from their APIs to find more assets for your target in the hacker world.
[04:08.400 --> 04:14.480]  But even though those are the predominant tools, there are now about 10 plus tools that do this out there.
[04:14.480 --> 04:17.820]  And as a recon head, I'm happy to use more than one tool.
[04:17.880 --> 04:25.380]  But for a person on the defensive side, I don't expect them to be at that same level as me.
[04:25.380 --> 04:29.660]  So what we did is we made a tool that is as easy to run as possible,
[04:29.660 --> 04:34.620]  that gets the best output as possible for an organization to do this kind of stuff.
[04:35.520 --> 04:36.800]  Okay.
[04:38.700 --> 04:44.140]  So enterprises realized that there was a need for these tools.
[04:44.140 --> 04:47.280]  A lot of companies wanted to track their assets,
[04:47.280 --> 04:52.180]  and they wanted to be able to do so easily, maybe even visually.
[04:55.070 --> 04:59.010]  So what they decided to do was they took a lot of open source tools,
[04:59.010 --> 05:03.030]  they combined them and maybe modified them a small amount,
[05:03.030 --> 05:06.350]  and then put them into a proprietary wrap,
[05:06.350 --> 05:10.050]  and then charged thousands upon thousands of dollars to use them.
[05:12.070 --> 05:14.130]  So there's a few issues with this.
[05:14.130 --> 05:19.390]  So first you have to think about how much is finding assets continually worth?
[05:19.570 --> 05:22.950]  And then you also have to think about is the data or the visualization,
[05:22.950 --> 05:27.790]  like charts that might be included in the software, how valuable is that?
[05:27.790 --> 05:31.570]  And then is finding these assets even difficult?
[05:33.590 --> 05:40.230]  So our thought is that these programs should be free, easy to use, and open source.
[05:42.810 --> 05:46.570]  So by using a mass and a few tools from projectdiscovery.io,
[05:46.570 --> 05:48.470]  we were able to create EASM.
[05:51.150 --> 05:56.990]  So here you can kind of see a little chart about what the tool does, what it uses,
[05:56.990 --> 05:59.570]  and you can see that it outputs a CSV file.
[05:59.570 --> 06:04.510]  And that CSV file can then be imported into something or used for whatever you want,
[06:04.510 --> 06:08.010]  and it has information about all the domains.
[06:09.270 --> 06:11.550]  All right, now here's a demo.
[06:14.300 --> 06:18.400]  Okay, so the first thing, going back,
[06:19.720 --> 06:23.480]  EASM, as Jason mentioned, is kind of an ongoing project.
[06:23.480 --> 06:24.740]  This is kind of a V1.
[06:24.740 --> 06:28.340]  So the first thing we wanted to hit with V1 is pretty much how everything starts.
[06:28.340 --> 06:31.620]  Which is going to be domains, and then DNS information.
[06:32.140 --> 06:35.520]  And after the demo, we're going to talk about more,
[06:35.520 --> 06:37.620]  and kind of where the roadmap goes from here.
[06:37.720 --> 06:44.000]  So V1 is very small, and it does one thing very well,
[06:44.000 --> 06:45.580]  and there's still a lot more to go.
[06:45.660 --> 06:47.780]  So I'm going to say it again after the demo,
[06:47.780 --> 06:50.840]  but we're releasing the tool, we have already released the tool.
[06:50.940 --> 06:53.640]  If you use it, and there's something you want to be added to the framework,
[06:53.640 --> 06:57.660]  the goal of the project is to put stuff that used to be open source and is open source
[06:57.660 --> 07:01.760]  back into IT's hands to use for free and to use easily.
[07:02.120 --> 07:05.240]  So if there's features you would like to see that we talk about after the demo,
[07:05.240 --> 07:09.940]  we're going to give kind of basically like a roadmap slash things it does now versus can do.
[07:10.240 --> 07:12.480]  Put issues on the GitHub and let us know.
[07:12.540 --> 07:15.880]  This workflow is one of our two run types at the moment.
[07:15.880 --> 07:17.500]  This is basically a fast.
[07:17.500 --> 07:20.820]  Anyone who uses these tools, like Jason said, they're all passive.
[07:20.820 --> 07:23.860]  They run anywhere from a couple seconds to maybe a couple minutes
[07:23.860 --> 07:26.520]  against larger domains, and if you're hitting a lot of APIs.
[07:26.520 --> 07:28.020]  But they don't take that long.
[07:28.280 --> 07:31.420]  There is a complete run time that obviously we can't demo
[07:31.420 --> 07:35.620]  because I have about 20 minutes, and it runs a lot longer than that.
[07:35.640 --> 07:39.220]  And that's where you would give it the active side that Jason talked about earlier,
[07:39.220 --> 07:41.760]  as far as giving it a word list, setting up a thread count,
[07:41.760 --> 07:44.680]  putting it out on something, deploying the tool on some kind of hardware,
[07:45.100 --> 07:48.140]  maybe a lot of hardware, and letting it run for a really long time.
[07:48.200 --> 07:50.900]  And that is what you don't see in this workflow,
[07:50.900 --> 07:54.580]  is going to add your active enumeration, your recursive enumeration,
[07:54.580 --> 07:59.820]  permutation scanning, which is basically, if you see admin.cisco.com,
[07:59.820 --> 08:01.880]  it will try staging, it will try dev.
[08:01.880 --> 08:07.020]  If it sees resource-1.cisco.com, it will try resource-2, dash-3, dash whatever.
[08:07.200 --> 08:11.720]  So as you can expect, that will generate a very large list of guesses,
[08:11.720 --> 08:14.620]  but will very much catch a lot of your stuff.
[08:15.020 --> 08:18.780]  So using this from the defensive side, the complete run time
[08:18.780 --> 08:22.860]  will give you more results, most likely, but it will take longer to run,
[08:22.860 --> 08:25.340]  so we can't really demo that side, but I will talk about it.
[08:25.960 --> 08:29.480]  So the first thing about the demo is I will go over here first.
[08:29.640 --> 08:32.560]  This is the output, no matter what the run type, that you will get.
[08:32.940 --> 08:34.700]  I'm kind of sorry about the text.
[08:35.800 --> 08:39.000]  This is just a CSV that you can either add to your risk register database
[08:39.000 --> 08:41.880]  or asset database, whatever it may be, that you can send up the chain
[08:41.880 --> 08:44.640]  to let people know what you guys have on the internet,
[08:44.640 --> 08:47.800]  which is what we believe to be the most important starting point,
[08:47.800 --> 08:49.440]  and then you can grow from there.
[08:49.440 --> 08:52.700]  So this will tell you, after run time,
[08:52.700 --> 08:54.680]  it will tell you obviously the time stamp of when it was ran,
[08:54.680 --> 08:58.940]  ASN data, URL data, titles, HTTP titles, what web server it's running on,
[08:58.940 --> 09:01.480]  the IP it's running on, A records, CNAMES,
[09:01.480 --> 09:04.760]  it uses WAPLizer to fingerprint technologies,
[09:04.760 --> 09:07.820]  you return status code, you return content length,
[09:07.820 --> 09:11.220]  all this kind of stuff. I'm going to talk about the notification.
[09:11.220 --> 09:14.160]  It will send notifications to either Slack or Discord webhooks
[09:14.160 --> 09:15.900]  if you put it in the configuration.
[09:15.900 --> 09:18.520]  Right now, it only will send you notifications
[09:19.240 --> 09:22.560]  of new domains that are found against previous runs,
[09:22.560 --> 09:25.720]  as well as old domains that either were on the internet
[09:25.720 --> 09:27.360]  and are not on the internet anymore.
[09:27.380 --> 09:29.880]  So if people take stuff down, you also get notified,
[09:29.880 --> 09:31.900]  like, hey, I saw this yesterday, I don't see this today.
[09:32.720 --> 09:35.340]  But one of the things that we've already been asked a few times,
[09:35.340 --> 09:38.560]  so I'm just talking about it now, that is on the roadmap,
[09:38.560 --> 09:42.060]  is it is very easily, you can notify against all this stuff.
[09:42.060 --> 09:44.320]  So if a status code changes, you can know about it.
[09:44.320 --> 09:47.100]  If a content length changes, notify. If all of a sudden the technology
[09:47.100 --> 09:49.700]  that that web server is using is totally different,
[09:49.700 --> 09:54.320]  you can get notified about that too. That will be definitely in the next iteration.
[09:54.580 --> 09:57.520]  So no matter whether you use fast or complete,
[09:57.520 --> 10:00.060]  this is what you will get. And this is really the, like,
[10:00.720 --> 10:04.100]  what we're trying to get into defensive teams' hands.
[10:04.320 --> 10:06.540]  This is basically just a tool that you can run
[10:06.540 --> 10:09.100]  as many times as you want to run it. You can cron it,
[10:09.100 --> 10:11.480]  whatever it will be, and you'll just always have an up-to-date list
[10:11.480 --> 10:13.980]  of assets that you have on the Internet, and then information
[10:13.980 --> 10:16.760]  that's nice to know about those assets.
[10:17.640 --> 10:20.980]  So I'm going to do the worst and attempt a live demo.
[10:22.520 --> 10:23.500]  Really quick.
[10:26.100 --> 10:27.080]  So basically,
[10:27.080 --> 10:30.100]  what we're going to do is I have a
[10:30.900 --> 10:32.760]  configuration file.
[10:32.760 --> 10:36.100]  And this is all the configuration file is. So again, we tried to keep it,
[10:36.100 --> 10:38.740]  we tried to keep it very small, very easy to understand.
[10:38.740 --> 10:41.440]  It's on the repo. You can just copy and paste it right in, fill it in.
[10:41.680 --> 10:45.140]  The first chunk there is your domains. So that's where you list your root domains.
[10:46.100 --> 10:47.180]  Word of warning.
[10:47.580 --> 10:50.140]  The tool is written in Go, and it will spin up a Go routine
[10:50.140 --> 10:53.440]  for each domain that you put in here. If you are a big organization
[10:53.440 --> 10:57.100]  with thousands of root domains, you will probably have to batch it.
[10:57.200 --> 11:00.280]  Because the passive APIs that you're hitting on the back end
[11:00.280 --> 11:02.740]  with these tools do not like being brute-forced,
[11:02.740 --> 11:06.780]  and they won't fail. They will quietly fail and stop giving you results.
[11:07.040 --> 11:08.660]  So all of a sudden, you'll get like one domain.
[11:09.860 --> 11:13.060]  So just a word of warning, if you're going over like 15 or 20 root domains,
[11:13.060 --> 11:14.780]  you'll probably have to batch it up.
[11:15.660 --> 11:17.680]  Just because it's not necessarily for our tool,
[11:17.680 --> 11:19.980]  but it's because of the APIs that it's using in the back end.
[11:20.200 --> 11:22.960]  But you put in your root domains in a list, and then the next two lines
[11:22.960 --> 11:25.860]  are your Slack and Discord webhooks. If you have a webhook for your Slack channel,
[11:25.860 --> 11:28.440]  or you have a webhook for a Discord channel, you put it in there.
[11:28.440 --> 11:31.640]  Again, right now, it will notify for any new and old domains.
[11:31.860 --> 11:34.620]  But the rest of the notification stuff will be there soon.
[11:35.060 --> 11:37.200]  The run type is what I talked about. It's either fast
[11:37.200 --> 11:40.540]  for passive enumeration, or complete for both passive and active.
[11:40.540 --> 11:44.480]  The complete one will run longer, depending on what hardware you're on.
[11:44.620 --> 11:47.320]  The last two lines are only for the complete, obviously.
[11:47.320 --> 11:50.140]  So if you're doing complete, you'll want to put in a word list.
[11:50.140 --> 11:53.240]  That word list will be basically what you're going to guess and try and brute-force against.
[11:53.240 --> 11:55.520]  And again, it will do that recursively. So if it finds a domain,
[11:55.520 --> 11:59.400]  it will then recursively start that word list, so it will take a while.
[11:59.740 --> 12:02.180]  But you will obviously find more stuff.
[12:02.720 --> 12:05.460]  Once it runs passive and active enumeration,
[12:05.460 --> 12:07.380]  it will then take everything that it's found,
[12:07.380 --> 12:09.540]  and done the permutation scanning against it,
[12:09.540 --> 12:12.360]  which will create an even longer list of possibilities.
[12:13.000 --> 12:17.660]  So the active run type is very, very thorough,
[12:17.660 --> 12:19.560]  but runs longer.
[12:20.020 --> 12:22.920]  And then, of course, the threads are there for the tools
[12:22.920 --> 12:24.500]  that are doing the active enumeration.
[12:24.600 --> 12:28.020]  If you are running it on a very hefty box, and you want to crank up the threads,
[12:28.020 --> 12:30.620]  that's what that's there for. If you're running it on a tiny box,
[12:30.620 --> 12:33.620]  and you want to let it run for a couple days and do its thing, that's great.
[12:33.620 --> 12:37.020]  You can just tone it down, and it will run fine on whatever you want to run it on.
[12:37.720 --> 12:40.380]  There is no flags for the tool. There's no anything.
[12:40.380 --> 12:45.940]  You need a Linux box, and you need go 1.19 or greater.
[12:46.700 --> 12:47.920]  And that's all you do.
[12:48.200 --> 12:50.440]  There's instructions on the GitHub,
[12:50.440 --> 12:53.380]  which I will show at the end, to go install it.
[12:53.480 --> 12:55.520]  It lands as a binary on your machine.
[12:56.180 --> 13:00.760]  All you do is run the tool.
[13:01.180 --> 13:05.700]  The other caveat is, as you see, I've ran it before, so it says all needed tools are installed.
[13:06.140 --> 13:09.260]  You don't have to install all the tools that it's running in the backend.
[13:09.420 --> 13:11.360]  It will go look for them on its first run.
[13:11.360 --> 13:14.000]  If it doesn't have them, it will download them all for you,
[13:14.000 --> 13:17.560]  and put them where it wants to see them, and then do the rest of it.
[13:17.920 --> 13:21.400]  There's not a laundry list of go get this, and this, and this.
[13:21.400 --> 13:24.920]  It will just download the tool and run it, and it will download the tools for you.
[13:25.220 --> 13:27.940]  And then, basically, what it's showing on the screen is just what it's doing.
[13:27.940 --> 13:31.420]  So we put in HackerOne because, obviously, people are floating around that kind of know that one.
[13:32.780 --> 13:34.340]  This is just the fast run.
[13:34.420 --> 13:37.580]  So, again, depending on the size of the domain,
[13:37.580 --> 13:40.000]  and the answers from the APIs and whatnot,
[13:40.000 --> 13:44.420]  it will run anywhere from a couple seconds to maybe 10 minutes, if it's something huge.
[13:44.700 --> 13:46.320]  When you see it's done,
[13:46.320 --> 13:49.380]  just in case someone out there wanted to grab all the domains,
[13:49.380 --> 13:51.480]  even the ones that aren't resolving,
[13:51.480 --> 13:54.340]  it will output the domains here in a second,
[13:54.340 --> 13:56.840]  to a big bracketed list.
[13:57.320 --> 14:00.820]  Those are not technically resolved and on the internet yet,
[14:00.820 --> 14:03.300]  but if you want to grep the output, or sed, or awk,
[14:03.300 --> 14:05.440]  or whatever bash tool you want to use,
[14:05.440 --> 14:09.640]  and grab stuff in between the brackets for every domain that came back from the APIs,
[14:09.640 --> 14:12.420]  you can do that, and it will allow you to do that.
[14:12.420 --> 14:15.060]  And then it will basically save it to the new CSV,
[14:15.060 --> 14:16.480]  and you'll have an updated CSV.
[14:18.440 --> 14:22.320]  I'm actually not sure why it's running so long, to be honest.
[14:22.620 --> 14:26.440]  Again, that's the curse of the live demo, obviously.
[14:26.440 --> 14:29.680]  But, again, no matter what version you run...
[14:29.680 --> 14:30.280]  There we go.
[14:30.280 --> 14:32.560]  Okay, see, I just had to coax it a little bit.
[14:32.640 --> 14:35.400]  So the stuff in the brackets, again, is the stuff that hasn't been resolved yet,
[14:35.400 --> 14:37.860]  but if you want to capture it and save it, that's okay.
[14:37.860 --> 14:40.660]  And then it says, like, checking which domains are live and generating your CSV.
[14:40.940 --> 14:44.120]  And in here you'll see it just names it EZSM.CSV.
[14:44.320 --> 14:45.700]  And that's it.
[14:45.740 --> 14:49.080]  So that's the tool right now. Again, we're not quite done yet,
[14:49.080 --> 14:51.640]  because Jason's going to talk about a little bit of the roadmap,
[14:51.640 --> 14:52.980]  and kind of what it does and what it doesn't do.
[14:55.760 --> 14:57.660]  So let's redo this.
[15:01.900 --> 15:02.540]  Cool.
[15:03.660 --> 15:06.720]  All right, so I'm going to go forward a few slides, because I kind of misordered them.
[15:07.100 --> 15:13.440]  Okay, so this is a commercial attack surface management platform that's sold today.
[15:13.440 --> 15:16.920]  You can see that it gives you IP and asset information.
[15:16.920 --> 15:20.420]  It gives you a nice little map, and it breaks down kind of where the hosting is.
[15:20.500 --> 15:24.300]  And it does a little bit of, like, vulnerability scanning on top of what it...
[15:24.300 --> 15:25.940]  But it's not much more than what we give you right now.
[15:25.940 --> 15:29.500]  In fact, our CSV gives you back all of this information and more.
[15:29.560 --> 15:32.360]  Anyone want to take a guess at how much this platform costs?
[15:33.820 --> 15:34.680]  What did you say?
[15:35.560 --> 15:37.360]  $165,000.
[15:42.580 --> 15:43.380]  $165,000.
[15:45.820 --> 15:47.360]  $165,000.
[15:47.640 --> 15:48.240]  $165,000.
[15:48.240 --> 15:49.640]  A year.
[15:50.500 --> 15:51.240]  A year.
[15:51.840 --> 15:53.660]  Subscription, correct.
[15:55.740 --> 15:56.940]  I'll answer questions.
[15:56.940 --> 16:01.860]  Anyway, so this is pretty basic, and you're still paying a lot for it.
[16:01.860 --> 16:08.880]  Now, better platforms in external attack surface management, we did research on all of them.
[16:08.880 --> 16:10.760]  Every single one in the space.
[16:11.080 --> 16:13.840]  And this is kind of how they break out what they do.
[16:13.840 --> 16:23.760]  And what started to happen in the attack surface management game, or industry, is that it's not enough anymore just to give you subdomains and assets, right?
[16:23.760 --> 16:26.880]  They can't justify those costs anymore.
[16:26.880 --> 16:34.620]  They have to add vulnerability scanning, and they have to add esoteric methods of discovering different things that are not assets.
[16:34.620 --> 16:39.300]  And then they also have started to rope in threat intel into their packages as well.
[16:39.300 --> 16:43.780]  So vulnerability scanning, service discovery, and risk, basically.
[16:43.780 --> 16:47.640]  And cleanup false positives. Yes, correct.
[16:47.680 --> 16:54.880]  Now, we are at Recon Village, which is put on by a really great external asset management company called Red Hunt.
[16:55.360 --> 16:57.060]  I think they're one of the best in the game.
[16:57.060 --> 16:58.800]  This is not a dig against anyone.
[16:58.880 --> 17:03.480]  This is just what the industry is doing, and you might need something like Red Hunt, right?
[17:03.480 --> 17:05.960]  So I'm not digging on any company or anything like that.
[17:05.960 --> 17:09.780]  I'm just saying that this is what all of the tools in the industry do right now.
[17:09.780 --> 17:11.820]  So they do subdomains, which we already do.
[17:11.820 --> 17:13.020]  They do SaaS, which we already do.
[17:13.020 --> 17:18.080]  They also look for typosquatted domains, because often typosquatted domains are being used against you for phishing.
[17:18.320 --> 17:21.100]  They look for parent and sister companies and acquisitions.
[17:21.340 --> 17:24.100]  In the service discovery category, they look for Docker hubs.
[17:24.100 --> 17:30.960]  So Docker hubs where your organization might have committed private code publicly to Docker hub on accident.
[17:30.980 --> 17:32.420]  They're looking at artifactory.
[17:32.420 --> 17:34.220]  They're looking for login pages.
[17:34.240 --> 17:37.120]  They're looking for social media pages for your executives and employees.
[17:37.120 --> 17:39.180]  They're looking for all of your cloud stuff.
[17:39.180 --> 17:43.400]  They're looking for any page that's behind SSO to tell you that these are login pages.
[17:43.400 --> 17:51.860]  They're looking at GitHub, not just for your organization, but for code that appears in repos that looks to be yours and has your domain referenced in it.
[17:51.860 --> 17:53.280]  They're looking for your mobile apps.
[17:53.280 --> 17:55.080]  They're looking for your cloud storage objects.
[17:55.080 --> 17:59.280]  They're looking for remote administration protocols, and they're looking for database ports.
[17:59.640 --> 18:07.740]  In risk discovery, they're looking for partners that you work with in the supply chain that are tangentially related to you via different methods.
[18:07.740 --> 18:16.020]  They're trying to tell you if a site has old copyright or trademarks inside of them, because that indicates that a site hasn't been updated in a while, so it might have a security vulnerability.
[18:16.220 --> 18:19.020]  They're looking at pages that have no CSS or a default page.
[18:19.020 --> 18:20.740]  They're looking for expired certificates.
[18:20.740 --> 18:23.200]  They're looking for leaked API keys in JavaScript.
[18:23.200 --> 18:27.760]  They're looking for subdomain takeovers, and they're doing library scanning of JavaScript libraries.
[18:30.720 --> 18:34.500]  They're also moving kind of into the threat install game, which comes in levels.
[18:34.500 --> 18:46.960]  At the top of the levels is source code, looking at GitHub and GitLab for credentials you might have hard-coded into your repo, or your developers might have accidentally posted into their private repos, but publicly.
[18:47.100 --> 18:48.880]  They're also looking at public breach data.
[18:48.880 --> 18:54.220]  This is the same thing if you're a red-teamer, if you've ever used de-hashed or something like that.
[18:54.220 --> 19:03.160]  They're looking at this data and trying to show you that there's credentials for your domain available as part of that very widely available dataset.
[19:03.320 --> 19:08.500]  The top-tier echelon of some of them are doing really hardcore threat install now.
[19:08.500 --> 19:14.840]  The hardcore threat install is looking at things like ransomware-as-a-service sales of data for your company.
[19:14.840 --> 19:18.880]  This is stuff like LockBit. LockBit is a marketplace for hackers.
[19:18.880 --> 19:23.800]  One part of the marketplace hacks things, the other part makes the malware, the LockBit malware.
[19:23.800 --> 19:28.120]  They work together and they share money when people pay out ransoms.
[19:28.120 --> 19:34.340]  But if someone doesn't pay out the ransom and they don't uninstall the ransomware from LockBit, those data breaches get leaked on the web.
[19:34.340 --> 19:40.560]  But they're kept private for about a month, two months, depending on how close they are to ransom sale.
[19:40.560 --> 19:48.140]  And so some of the attack surface management vendors have snitches in those chats with those hackers and are able to see,
[19:48.140 --> 19:55.140]  oh, there's this company's information already available inside of... usually it's a Discord channel or a Telegram channel.
[19:55.620 --> 19:59.680]  The highest tier is the Discord and Telegram monitoring channels.
[20:00.600 --> 20:07.480]  Actually, most ransomware-as-a-service actually happens on websites, forums still, so like Russian Market and stuff like that.
[20:07.480 --> 20:13.460]  More of the private-private sales are on Discord and Telegram, and so some of them will get to monitoring those as well.
[20:13.460 --> 20:17.040]  So these are the upper echelons of some of the external attack surface management.
[20:17.040 --> 20:21.100]  But you can see it's not attack surface management anymore, it's threat intel. This is stuff that's in threat intel.
[20:21.520 --> 20:25.480]  So you can see right now we started with the green checkmarks.
[20:25.740 --> 20:30.420]  But pretty much everything on this slide we can do with open source tools. It's all hacker stuff.
[20:30.420 --> 20:37.680]  And, I mean, the thing that pisses me off is that all of these tools, all of these methods, right,
[20:37.680 --> 20:40.240]  they were born out of the bug bounty and hacker community.
[20:40.340 --> 20:45.940]  And then these big companies came out and they released these tools they're charging hundreds of thousands of dollars for.
[20:45.940 --> 20:47.460]  And these tools are still online.
[20:47.540 --> 20:50.920]  And so our plan is to make this tool as easy to run as possible,
[20:50.920 --> 20:55.640]  but to give you guys the power to do all of these things over the roadmap of maybe a year.
[20:56.340 --> 20:59.760]  And give you an output that's digestible for IT people.
[21:03.250 --> 21:05.810]  That's it. We can take questions.
[21:14.030 --> 21:15.690]  Any questions?
[21:16.350 --> 21:17.630]  Yes.
[21:28.790 --> 21:39.470]  The question is, is this like some of the recon tooling, like bbot or recon for the win and some stuff like that?
[21:39.630 --> 21:42.110]  It is. It's very similar.
[21:43.790 --> 21:45.390]  It's our version of it.
[21:45.650 --> 21:53.370]  In some cases, it's tuned automatically so that IT people who aren't hackers can just run one command to do it.
[21:53.470 --> 21:57.310]  So, like, if you wanted to use it as a bug bounty hunter or red teamer, you can.
[21:57.430 --> 22:00.250]  And it'll notify you. The notify stuff is really, really cool, right?
[22:00.250 --> 22:04.690]  If you have a beefy box, you can just be scanning the internet constantly for a domain.
[22:04.690 --> 22:06.890]  And when a new one pops up, you can go hack it.
[22:07.150 --> 22:09.170]  But that's not the purpose, right?
[22:09.170 --> 22:15.730]  We have a whole other recon pipeline that's quick and fancy and does all of the crazy techniques and stuff.
[22:15.730 --> 22:17.230]  That's not the point of this tool.
[22:17.230 --> 22:18.830]  This is the everyman's tool.
[22:18.890 --> 22:20.650]  One command to go.
[22:22.190 --> 22:23.310]  Yes, sir.
[22:24.330 --> 22:26.330]  Yes, we can put the repo back up.
[22:28.090 --> 22:28.710]  Yep.
[22:30.210 --> 22:31.270]  It is.
[22:31.270 --> 22:34.510]  Golden CyberSec with a zero.
[22:35.970 --> 22:37.990]  With a zero, golden.
[22:38.390 --> 22:40.710]  And EZESAM.
[22:41.850 --> 22:42.950]  Question, yes.
[22:47.700 --> 22:50.420]  It is only on internet sites right now.
[22:50.620 --> 23:02.040]  If you would have come to our Cloud Village talk, though, we have another tool called Cloud Recon that scans SSL certificates that actually works on internal asset discovery as well.
[23:02.040 --> 23:05.440]  No, it's another repo on the same tag, though.
[23:05.440 --> 23:06.720]  Golden CyberSec.
[23:06.720 --> 23:07.780]  We just did the talk.
[23:07.780 --> 23:08.780]  We ran over here.
[23:09.000 --> 23:10.660]  So that one is Cloud Recon.
[23:10.660 --> 23:12.660]  I highly suggest you watch the video when that comes out.
[23:12.660 --> 23:14.140]  That's the best tool we've made all year.
[23:15.780 --> 23:16.820]  Yes, sir.
[23:19.120 --> 23:19.840]  Yeah.
[23:27.080 --> 23:27.880]  Yes.
[23:30.180 --> 23:32.240]  That was our whole talk.
[23:32.700 --> 23:33.680]  This one.
[23:34.260 --> 23:34.960]  Watch.
[23:34.960 --> 23:35.780]  I'll show you.
[23:35.840 --> 23:36.480]  I swear.
[23:36.480 --> 23:36.780]  I did it.
[23:36.780 --> 23:37.760]  We just did it.
[23:38.060 --> 23:40.920]  We talked about ephemeral assets is what we call them.
[23:40.920 --> 23:41.680]  These are issues.
[23:41.680 --> 23:44.020]  These are three issues related to the one you just said.
[23:44.020 --> 23:48.940]  We talked about a vulnerability that happened in Slack because of this.
[23:48.940 --> 23:50.260]  And it was a giant bounty.
[23:50.260 --> 23:52.200]  Over 300 secrets disclosed.
[23:52.220 --> 24:09.420]  And we built a tool that basically you can point at any IP, including the cloud ranges, and it will, in under an hour, no, under an hour or over an hour, you can scan every IP in every cloud range in just over two hours.
[24:12.120 --> 24:13.940]  Anyway, that's a different talk, though.
[24:14.520 --> 24:16.520]  Any questions about this talk?
[24:17.500 --> 24:18.080]  Yes.
[24:20.280 --> 24:20.720]  Yes.
[24:20.720 --> 24:23.000]  We plan to support more outputs than just the CSV.
[24:23.000 --> 24:27.240]  The CSV is what most IT people want, though, in the beginning.
[24:27.240 --> 24:30.580]  Because it's like, oh, I just want something to work with.
[24:30.840 --> 24:35.140]  Eventually we will get to a pretty ghetto GUI like this because it's not that hard to do.
[24:35.540 --> 24:38.220]  This actually doesn't do much for you more than the CSV.
[24:38.220 --> 24:39.220]  We have more data than this.
[24:39.220 --> 24:42.100]  But yes, we plan to, for sure.
[24:42.100 --> 24:43.540]  Yes.
[24:47.400 --> 24:49.340]  We do not.
[24:49.340 --> 24:50.800]  Yeah, are you offering?
[24:51.780 --> 24:55.220]  I am open to bribes, badges, challenge coins.
[25:12.360 --> 25:18.020]  So if you're one feature away from thinking this is the coolest thing since life's red, let us know.
[25:19.780 --> 25:21.100]  Other questions?
[25:21.100 --> 25:21.780]  We good?
[25:21.780 --> 25:22.780]  Yes, sir.
[25:27.720 --> 25:32.040]  I am not aware of another OWASP program called Secure Go Box now.
[25:48.320 --> 25:49.400]  Yep.
[25:54.340 --> 25:55.160]  Yep.
[25:56.140 --> 25:57.940]  That sounds really cool.
[25:59.760 --> 26:00.560]  Yes.
[26:04.300 --> 26:09.340]  Yeah, so I'm very familiar with tools that abstract the tool configuration.
[26:09.340 --> 26:12.560]  So the guy who runs Trickist is probably one of the better ones.
[26:12.560 --> 26:15.780]  He is a for-pay tool, but it's not that expensive.
[26:15.780 --> 26:20.560]  And I've used Trickist before, which seems like a similar concept, where you just drag and drop modules.
[26:20.560 --> 26:22.820]  And it's like, okay, what am I going to do with this output?
[26:23.100 --> 26:25.280]  Yeah, that's if you're a recon head, though.
[26:25.280 --> 26:28.000]  This is more for an IT person.
[26:28.000 --> 26:30.000]  I don't think that they're going to go...
[26:33.160 --> 26:34.880]  Okay. Yeah, yeah, for sure.
[26:35.540 --> 26:37.180]  Yeah. Yeah.
[26:37.400 --> 26:38.520]  Yeah, that would be great.
[26:38.560 --> 26:40.500]  I mean, if they're going to put it in there, that would be great.
[26:40.720 --> 26:41.640]  Absolutely do that.
[26:42.620 --> 26:43.440]  Are we good?
[26:45.480 --> 26:46.140]  We're over?
[26:46.620 --> 26:47.900]  Okay, we're done. Thank you, guys.