1
00:00:00,000 --> 00:00:14,320
All right, so we are ready with our next speaker, Jeff Foley, who's going to be speaking about unlocking the power of OWASP AMAS, introducing the open asset management model tool for comprehensive attract surface mapping.

2
00:00:14,520 --> 00:00:24,460
About him, he's a VP for research at Xerofox, founder and leader of the famous OWASP AMAS flagship project.

3
00:00:24,460 --> 00:00:26,980
He's also been a speaker at Recon Village previously.

4
00:00:26,980 --> 00:00:28,720
So let's give him a round of applause.

5
00:00:36,260 --> 00:00:38,120
All right, can everyone hear me?

6
00:00:38,840 --> 00:00:39,640
Great.

7
00:00:40,760 --> 00:00:42,580
All right, yeah, real quick.

8
00:00:42,640 --> 00:00:44,860
How many people here have already used AMAS before?

9
00:00:44,860 --> 00:00:45,620
I'm just curious.

10
00:00:45,940 --> 00:00:47,000
All right, look at that.

11
00:00:47,000 --> 00:00:47,700
Look at all those hands.

12
00:00:47,700 --> 00:00:48,440
I love it.

13
00:00:48,900 --> 00:00:53,860
All right, so we've got some great things to share with you, though, this year.

14
00:00:55,020 --> 00:01:02,200
But getting started, how many people just feel like they want to take more control over the Recon process, right?

15
00:01:02,200 --> 00:01:19,220
I personally have been seeing so many of these scripts that are showing the sequential process of seed a tool, take the output data, clean it up, put it into a text file, do it, you know, take that, seed another tool.

16
00:01:19,220 --> 00:01:22,440
It's like, it's a mess, right?

17
00:01:22,620 --> 00:01:24,920
You're probably losing a lot of the data.

18
00:01:25,220 --> 00:01:33,600
It doesn't seem very organized or well-managed, and I just feel like, hasn't Recon grown up, right?

19
00:01:33,600 --> 00:01:35,460
Like, aren't we more mature than this?

20
00:01:35,460 --> 00:01:43,340
I feel like we definitely have gotten to a point where we deserve more control, more management, more organization around what we're doing.

21
00:01:43,340 --> 00:01:44,360
Does anyone disagree with me?

22
00:01:44,360 --> 00:01:46,840
Or how many people would love to see this happen?

23
00:01:47,880 --> 00:01:48,580
All right, we good?

24
00:01:48,580 --> 00:01:49,660
Good, good, good.

25
00:01:50,020 --> 00:01:52,700
All right, so that's what I want to talk about today.

26
00:01:53,340 --> 00:02:01,740
But real quick, I guess I'm... she already did such a great job introducing me, so I guess I don't need to say too much about myself.

27
00:02:01,740 --> 00:02:05,920
But yes, I'm the project leader for Wasp Amass.

28
00:02:05,920 --> 00:02:07,620
I'm also on the project committee.

29
00:02:08,060 --> 00:02:10,940
Wonderful organization that is here for you.

30
00:02:10,940 --> 00:02:17,240
We are trying to empower more people everywhere when it comes to security.

31
00:02:17,900 --> 00:02:20,600
I've been doing this kind of work for a very long time.

32
00:02:20,900 --> 00:02:29,800
I learned a lot of it on this bottom bullet, where you can see I did offensive cyber warfare research and development, where I kind of learned the tricks of the trade.

33
00:02:29,980 --> 00:02:47,260
I took some of these, I'll say, attempts to fill the gap of understanding your attack surface to the energy industry, to the financial industry, where they desperately seem to need visibility on their attack surface.

34
00:02:47,260 --> 00:03:03,920
I've also brought this to so many other clients privately, which you would perhaps think would have this under control or, you know, have mature programs that would have better visibility on this, but the answer is not a single one I've ever worked with said,

35
00:03:03,920 --> 00:03:07,640
oh good, we expected exactly that, you can leave.

36
00:03:07,880 --> 00:03:09,920
It was hardly the case.

37
00:03:11,360 --> 00:03:14,440
Not even the ones I kind of hoped would say that.

38
00:03:15,360 --> 00:03:17,980
I am at ZeroFox now.

39
00:03:18,640 --> 00:03:26,140
Part of the reason for that is ZeroFox has so many clients that, you know, gives me incredible visibility on what's going on out there.

40
00:03:26,360 --> 00:03:32,760
The challenges they face with external cyber security are right in line with what I've been bringing to you for years now.

41
00:03:32,900 --> 00:03:39,140
And it just makes it so that I feel like I can bring even greater value to this community by working there.

42
00:03:39,140 --> 00:03:40,780
So I love working there.

43
00:03:41,020 --> 00:03:48,500
If you want to reach me to talk to me about anything related to reconnaissance, use these socials, reach out any time, feel free to engage.

44
00:03:51,260 --> 00:04:08,980
All right, so I guess I don't really need this slide, or at least not too much, since most people here seem quite aware of what this is, but Amass is a flagship project and it's about in-depth attack surface mapping and asset discovery.

45
00:04:08,980 --> 00:04:12,320
It's about understanding what you have out there.

46
00:04:12,320 --> 00:04:23,960
What do you have exposed on the internet as part of the contested environment that we all deal with, right, by being part of the internet, or on the internet, forgive me.

47
00:04:25,780 --> 00:04:27,540
It was a tool.

48
00:04:27,540 --> 00:04:32,480
I hope you'll know by the time this talk is done, it's not really just a tool anymore.

49
00:04:32,480 --> 00:04:33,800
It's more like a framework .

50
00:04:34,320 --> 00:04:42,740
And we're really more focused these days on attack surface intelligence collection and making the data easy for you to work with.

51
00:04:42,740 --> 00:04:46,760
That's my goal that I'm gonna keep pushing in this project.

52
00:04:46,760 --> 00:05:03,120
It's also a goal that's been shared with OWASP and they're quite excited about because we want it to be more about the data, about making it easy for you to work with it, you doing what you need to do with it, making people more aware of the problem, right.

53
00:05:03,120 --> 00:05:05,500
It's not just about tooling.

54
00:05:06,540 --> 00:05:15,900
If you want to get in touch with this project, you can use these socials and of course some of you are probably already familiar with these links.

55
00:05:15,920 --> 00:05:19,100
Maybe the most important one though being the discord at the bottom.

56
00:05:19,440 --> 00:05:22,480
If you're not part of this discord, I would urge you please become part of it.

57
00:05:22,480 --> 00:05:30,740
Bring all your questions and thoughts and ideas about this to our discord because that's where the community gets together around this.

58
00:05:32,620 --> 00:05:35,840
Alright, a lot of people want to know though like why did you do this?

59
00:05:35,840 --> 00:05:37,680
Why did we need this?

60
00:05:40,520 --> 00:05:58,140
So, I needed this initially because as I was saying a moment ago, I was working with many clients trying to help them answer the question of what are their gaps, where should they be investing for next year's security budget, what do they need to be focused on,

61
00:05:58,140 --> 00:05:58,760
things like that.

62
00:05:58,760 --> 00:06:03,340
And since I didn't want to just be another voice in the room, I wanted to show them something real.

63
00:06:03,540 --> 00:06:14,840
I was bringing them concrete data of what they looked like on the internet and trying to raise the question of is this what you expected to look like?

64
00:06:15,640 --> 00:06:18,260
Do you think that's a good idea that you have that exposed?

65
00:06:18,520 --> 00:06:22,260
Do you know what that would look like through the attacker lens?

66
00:06:24,180 --> 00:06:33,200
And I found this to be far more effective than just sitting there and being, like I said, another voice in the room and saying I think you know I would advocate that you do this with your money.

67
00:06:33,600 --> 00:06:41,760
So, it was effective but it needed to be easy, right?

68
00:06:41,760 --> 00:06:46,900
Like for me also because I was doing this quite frequently and I didn't really want to sit here doing it manually all the time.

69
00:06:47,540 --> 00:07:00,060
But also when this became more about... so when I saw that this wasn't a one-off problem where all these companies were having this problem and I asked myself what are we gonna do about it?

70
00:07:00,360 --> 00:07:19,420
The way I saw it was we needed to raise awareness around this but part of that needed to be that if they said well I don't know if we have the resources to address this or we have the people that know how to do this like you do, I wanted to be able to say and you don't need it because there's a tool right here that will do it automatically for you.

71
00:07:19,420 --> 00:07:26,560
The person doesn't need to know barely anything about it and you'll get the answers anyway or you'll get the data that you need.

72
00:07:26,720 --> 00:07:33,740
So, the purpose of the tool initially really was to make it so these people almost had to address this problem.

73
00:07:33,740 --> 00:07:42,520
They had to wake up to what was going on and it turned into, I guess I would say, much more since many people seem to like it.

74
00:07:42,700 --> 00:07:51,620
But it really was kind of, in my mind, more focused on these organizations that needed to open their eyes to the gap that they were dealing with.

75
00:07:52,900 --> 00:07:55,360
All right, getting to the more interesting things.

76
00:07:56,380 --> 00:08:06,640
So, last year I was at this very village on Naham Sec's panel discussion for attack surface management.

77
00:08:07,160 --> 00:08:11,120
Was anyone in this room at that panel discussion by chance?

78
00:08:11,180 --> 00:08:13,100
All right, look at that, we got one person.

79
00:08:13,120 --> 00:08:14,220
Anybody else?

80
00:08:14,480 --> 00:08:18,880
All right, because something kind of important happened during that talk.

81
00:08:19,540 --> 00:08:26,960
Naham Sec said, should an attack surface just be IT assets and internet infrastructure?

82
00:08:27,240 --> 00:08:31,620
And I was kind of quick to say, no, I don't think so.

83
00:08:31,620 --> 00:08:38,080
I think it should be anything that is relevant to a security program that can be discovered on the internet.

84
00:08:38,080 --> 00:08:40,740
And I think it should... and that's a lot of things.

85
00:08:40,900 --> 00:08:45,020
There's a lot of things out there that could fall into that definition.

86
00:08:46,040 --> 00:08:58,600
And we talked about it for a while, but I kind of put the stake in the ground at that point and said, well, as far as a MAS is concerned, or the project is concerned, we're broadening the definition as of today.

87
00:08:58,600 --> 00:08:59,860
And I meant it.

88
00:08:59,940 --> 00:09:10,240
We are going to start working towards being able to include anything that is relevant to a security program, not just what we cover currently.

89
00:09:10,720 --> 00:09:14,740
Well, excuse me, like I said, I took that quite seriously.

90
00:09:14,740 --> 00:09:15,880
I wasn't kidding.

91
00:09:16,660 --> 00:09:18,460
So what did we do about it?

92
00:09:18,460 --> 00:09:22,180
What have we done since I was here last time?

93
00:09:23,920 --> 00:09:35,120
We realized in order to honor that promise or work towards that promise, we were going to need to be able to represent many more asset types than we currently do, right?

94
00:09:35,600 --> 00:09:44,220
We were going to need this data model capable of being very quick to add new types, new relationships between the types.

95
00:09:44,220 --> 00:09:47,920
If it took too long to do this or it was too cumbersome, this just wasn't going to work.

96
00:09:47,920 --> 00:09:50,980
And it was too cumbersome at the time that this happened.

97
00:09:50,980 --> 00:09:54,120
So this was quite a task for us.

98
00:09:54,560 --> 00:10:09,080
And a year ago, the database we were using was... it made it impossible for any of you to just say, I have a different use case, I have a different way I'd like to query this data, and I want to pull it out my way, or you know, ask different questions.

99
00:10:09,160 --> 00:10:10,380
You couldn't do that.

100
00:10:10,380 --> 00:10:14,520
If a mask didn't support it for you, then you weren't getting it, right?

101
00:10:14,520 --> 00:10:15,800
And I hated that.

102
00:10:15,920 --> 00:10:22,560
And it wasn't going to work for this if we started collecting even more and people had new creative ways they wanted to use it.

103
00:10:24,360 --> 00:10:29,060
So it caused the open asset model to be created.

104
00:10:30,200 --> 00:10:36,540
Now, let me say real quick, there's no way this would have happened if this was just me doing it.

105
00:10:36,540 --> 00:10:41,560
There are some people who made this possible that deserve to be... deserve credit.

106
00:10:41,960 --> 00:10:46,400
ZeroFox saw this vision as making perfect sense.

107
00:10:46,400 --> 00:10:52,460
They thought this is exactly what the community needs, and that that's just good for everybody.

108
00:10:52,460 --> 00:11:00,080
They believed in what I said at this conference last year, and they put a lot of resources against this.

109
00:11:00,080 --> 00:11:07,340
They had, you know, like six engineers working full-time for two quarters, director of architecture.

110
00:11:07,340 --> 00:11:14,600
I mean, they had quite a team working on this, and they just donated it with no strings attached whatsoever to OWASP.

111
00:11:14,600 --> 00:11:16,860
They just said, here, have it.

112
00:11:17,400 --> 00:11:19,900
So to ZeroFox, right?

113
00:11:19,900 --> 00:11:21,040
Like, that was amazing.

114
00:11:21,260 --> 00:11:28,000
We wouldn't be able to talk about this right now if they hadn't made that, you know, put all that energy behind it.

115
00:11:28,400 --> 00:11:32,900
And what was created, I got to say, was exactly what I told them I needed to.

116
00:11:32,900 --> 00:11:47,420
It was this Agile database that creates unified representation of these assets on the internet, and the relationships between them, and this real-world interconnectedness that we need to be able to represent between the assets.

117
00:11:47,720 --> 00:11:59,820
And we did get this taxonomy and model that makes it so easy to add more to this, that this can now be community driven and shaped by all of us from now on.

118
00:11:59,820 --> 00:12:10,680
Like, we got this started so that it's capable... it now is what a mass is using, but it's just the beginning, because now there's so much more we can do with it.

119
00:12:10,900 --> 00:12:14,720
We also created the database that implements this model.

120
00:12:15,980 --> 00:12:22,220
It currently is supported on SQLite, I would say, for all of you that don't want to touch the database with a 10-foot pole.

121
00:12:22,220 --> 00:12:25,720
You just want to be able to have it thrown somewhere and start using it.

122
00:12:25,820 --> 00:12:40,340
We didn't forget it about all of you, but if you're serious about... you really want to manage this, you want to put it in one central place, and you want to be able to keep this for a very long time and work at high performance, Postgres is what I would recommend you use,

123
00:12:40,340 --> 00:12:42,720
and we are supporting that as well.

124
00:12:44,500 --> 00:12:50,800
It makes it possible now to be storing the data and pulling it out at the same time.

125
00:12:50,800 --> 00:13:01,260
So I can't tell you how many people have said to me, well, I can't access the data that a mass is collecting until it's finished, right?

126
00:13:01,260 --> 00:13:04,920
That was kind of... I imagine that must have been quite a problem for a lot of workflows.

127
00:13:04,940 --> 00:13:06,260
Well, it's not a problem anymore.

128
00:13:06,260 --> 00:13:09,200
These are all able to be accessed concurrently.

129
00:13:09,200 --> 00:13:19,120
You can be collecting the data and analyzing it at the same time, which I would think if I was a user of this, I would be very happy about that.

130
00:13:19,160 --> 00:13:28,080
And it's all still in this graph-like structure that we used previously, which makes this very easy to navigate and make use of, I would argue.

131
00:13:28,360 --> 00:13:40,700
At least personally, I'm pretty set on having it that way, but in my defense, the director of architecture felt the same way who reviewed all this and, like I said, actually built this.

132
00:13:42,220 --> 00:13:49,680
What this ends up looking like when you dive into the database and you want to see, well, what did you guys actually create?

133
00:13:50,580 --> 00:13:52,460
It's really simple by design.

134
00:13:52,460 --> 00:13:56,200
It's two tables, one with assets, one with relations between them.

135
00:13:56,200 --> 00:13:56,560
That's it.

136
00:13:56,560 --> 00:14:00,960
It's just what is out there and what's the glue between them.

137
00:14:00,980 --> 00:14:10,320
And most of it tied together with simple integers that make it extremely high performance and easy to pull this data back out.

138
00:14:11,160 --> 00:14:33,860
I don't think this takes too much explanation, but if we find a DNS name, it goes in as a fully qualified domain name, all of these things are represented as JSON, so that each asset type can be unique in what we're saving about it, right?

139
00:14:33,860 --> 00:14:45,200
But the rows in the table are the same for everything, meaning, like I said earlier, we could add a new asset type and it doesn't require one change whatsoever to this database, the schema.

140
00:14:45,340 --> 00:14:49,560
We just have the new asset type with the new JSON format.

141
00:14:50,540 --> 00:14:53,140
So we have the DNS name with the name.

142
00:14:53,140 --> 00:14:55,000
We have the IP address with the address.

143
00:14:55,000 --> 00:14:57,600
It's a little bit more complicated than this.

144
00:14:57,600 --> 00:15:01,060
I've simplified it a little bit for this presentation, but you get the idea.

145
00:15:02,720 --> 00:15:12,820
The relations are just the type of relation and what asset is it from and what is it pointing to, like an edge.

146
00:15:13,100 --> 00:15:13,800
And that's it.

147
00:15:13,800 --> 00:15:15,640
That glues everything together.

148
00:15:15,640 --> 00:15:24,140
All of this stuff has timestamps on it, so you can do some fun things like saying, show me only the things that are, you know, have been validated within the last week or whatever.

149
00:15:24,240 --> 00:15:30,980
You can check easily for what's new versus what we've known about for quite a long time.

150
00:15:31,480 --> 00:15:35,060
I left all those things out so it would fit on this slide.

151
00:15:37,000 --> 00:15:41,700
But, as I said, by design we're trying to keep this super simple.

152
00:15:41,700 --> 00:15:46,540
There's nothing in here other than what was found and how these things are glued together.

153
00:15:47,000 --> 00:15:48,340
That's how we wanted it.

154
00:15:48,340 --> 00:15:49,620
That's how it turned out.

155
00:15:49,620 --> 00:15:56,380
It makes it so that it's really pretty easy once you see how to go back and forth between the assets and the relations.

156
00:15:57,360 --> 00:16:03,040
It's easy to make some powerful questions or ask powerful questions to this database.

157
00:16:03,920 --> 00:16:09,900
It's extremely extendable, like I said, I told them it needed to be, so we can create new types.

158
00:16:09,900 --> 00:16:10,640
That's the point.

159
00:16:10,640 --> 00:16:16,480
So we can keep saying we want to represent more things, more things, more accurately, more at, you know, that's the point.

160
00:16:18,540 --> 00:16:25,300
I'm very interested to see how everyone decides to start navigating or querying this information.

161
00:16:25,300 --> 00:16:33,400
I think you're gonna start finding things that you didn't realize you could find when we're connecting all the dots in this database.

162
00:16:33,400 --> 00:16:41,880
The other thing I'm pretty excited about is typically people are rerunning these scans every time they have a different question they want answered, right?

163
00:16:41,920 --> 00:16:43,620
That is so noisy.

164
00:16:43,620 --> 00:16:46,380
I mean, so noisy.

165
00:16:46,680 --> 00:16:49,040
There's no need for this anymore, right?

166
00:16:49,040 --> 00:16:57,540
You can just dump all this into the OAM database and you can just start asking more questions, unless you need to make sure that it's been validated again recently.

167
00:16:57,820 --> 00:17:03,900
That's really your only reason to be running the scans again, is to make sure you've updated the data.

168
00:17:03,900 --> 00:17:13,160
But you can ask the questions as many times as you want, navigate, peruse, whatever your heart desires.

169
00:17:13,560 --> 00:17:20,360
All right, so I've got a very simple demonstration to show you that this is quite real.

170
00:17:20,360 --> 00:17:22,600
I'm not just making this up.

171
00:17:24,120 --> 00:17:33,480
But let me just say real quick, this isn't to say that the tools you've come to like from Amass aren't still there.

172
00:17:33,480 --> 00:17:42,860
If you go to our GitHub, OASP Amass OAM tools, you'll find these three tools right currently.

173
00:17:42,860 --> 00:17:48,960
One called OAM subs, another one OAM viz, and another one called OAM track.

174
00:17:48,960 --> 00:17:59,300
They're the same functions that we supported before, so that if you really loved these, then don't worry, they're still there.

175
00:17:59,380 --> 00:18:02,140
And we'll be coming out with more, I'm sure, in the future.

176
00:18:02,640 --> 00:18:09,380
What I'm about to show you isn't to say that we won't create tools to help you with your typical use cases.

177
00:18:09,480 --> 00:18:17,640
What I want to show you is that if we are not supporting, you know, we don't have a tool for what you need, don't let us slow you down.

178
00:18:17,640 --> 00:18:25,460
This is to empower everybody, make it so that you could write a script to pull the data you need and do what you need to do with it.

179
00:18:25,520 --> 00:18:32,620
It's to make this easier, even though the queries might, you know, take you a little while to put together.

180
00:18:34,380 --> 00:18:51,040
All right, so actually, there's no keeping up with... you don't have to keep up with me in this demonstration, but if later when these slides are shared, you'd like to reproduce everything that's been done here, or you just want to be able to see that you can do what I did,

181
00:18:51,040 --> 00:18:58,920
I've got some instructions here to make sure that you've got, like, the correct version of a mass, which needs to be pretty much the most recent version.

182
00:19:00,640 --> 00:19:05,900
You know, make sure you have a recent version of SQLite, things like that.

183
00:19:07,240 --> 00:19:08,020
I would

184
00:19:11,260 --> 00:19:23,160
personally keep the data separate for your initial use of this, because you don't want to be mixing it with data that you were collecting previously.

185
00:19:23,240 --> 00:19:27,080
They're not the same format, so just be careful with that.

186
00:19:28,640 --> 00:19:33,200
So I've got two different demonstrations I was going to show.

187
00:19:33,260 --> 00:19:37,500
One being what I would call the easiest question you could possibly answer.

188
00:19:38,000 --> 00:19:39,220
What are the names that you found?

189
00:19:39,220 --> 00:19:40,660
Like, that's usually what people want, right?

190
00:19:40,660 --> 00:19:43,900
They run the tool and they say just have it spit out the names.

191
00:19:44,700 --> 00:19:52,520
So I'm going to show you how you can do that with SQL instead of relying on us to do it for you.

192
00:19:52,860 --> 00:20:10,040
I've got a more complicated example where we traverse more of the database, where it takes the namespace that we're interested in and then says, now show me all the CIDR blocks that these names resolve into, which is often a question I hear people asking.

193
00:20:10,080 --> 00:20:13,480
So I'm going to show you how you can do that just with the SQL as well.

194
00:20:17,210 --> 00:20:21,570
All right, so hopefully this looks pretty simple to everybody.

195
00:20:22,070 --> 00:20:30,470
What we're seeing here is we're just saying... so remember earlier I said that we have JSON for every row and every type of asset, right?

196
00:20:30,470 --> 00:20:32,650
So that's what content is in this case.

197
00:20:32,710 --> 00:20:46,090
So we're just saying select from the content the name from the assets table where the type has to be fully qualified domain name and the name has to end with a wasp .org.

198
00:20:46,090 --> 00:20:47,310
Pretty simple.

199
00:20:47,930 --> 00:20:52,730
So if I take this, let's hope that I don't have any issues here.

200
00:20:55,690 --> 00:20:58,510
If I copy this,

201
00:21:04,010 --> 00:21:05,530
hopefully everyone can see that.

202
00:21:05,530 --> 00:21:09,870
Let me remove this.

203
00:21:11,910 --> 00:21:13,410
Can everyone see this?

204
00:21:13,850 --> 00:21:14,830
All right, good.

205
00:21:16,310 --> 00:21:27,310
So I'm already in a database, or sorry, I'm in a directory where there is a database where OWASP.org has been enumerated and it's saved, right?

206
00:21:27,410 --> 00:21:36,850
And it's already in this file called a mass dot SQL lite, which is the default place it's gonna put the data if you're running a mass today.

207
00:21:37,670 --> 00:21:40,750
Unless you tell it to use Postgres instead.

208
00:21:41,230 --> 00:21:47,430
So if I fire off this query, you get the names, right?

209
00:21:47,670 --> 00:21:48,710
Straightforward.

210
00:21:48,890 --> 00:21:54,130
But what I wanted to show is that this is usually what everybody wants to know, what everybody would like to know.

211
00:21:54,130 --> 00:21:57,690
I wanted to show them how easy it is that you could just do it yourself if you like to.

212
00:21:57,690 --> 00:22:01,370
You don't need to have tooling around it to do it for you.

213
00:22:03,800 --> 00:22:12,700
The more complicated example is this one.

214
00:22:13,060 --> 00:22:17,400
Now, I would still argue it's not that complicated once you see what's happening here.

215
00:22:17,880 --> 00:22:28,160
Each time you want to go from an asset to a relation back to another asset, you're gonna do two of these joins.

216
00:22:28,160 --> 00:22:30,780
It's just the nature of how this is designed, right?

217
00:22:30,820 --> 00:22:42,460
So that you can connect the from asset ID on the relation to... or typically that's where you would be coming from with the initial asset.

218
00:22:42,560 --> 00:22:55,420
You'd be following the from asset ID across the relation, so to speak, and then to the to asset ID, which means it's pointing to that with the to asset ID.

219
00:22:55,600 --> 00:23:02,760
So here what we have is we say well we're gonna print out unique CIDR blocks, right?

220
00:23:02,760 --> 00:23:07,740
That's what we're gonna get from the nets table or information.

221
00:23:08,280 --> 00:23:30,020
So we start with fully qualified domain names, we use relations as rels1, we associate the ID from the name to the from asset ID, we connect assets again as IPs this time, and then say and if the to asset ID matches the IP then we're interested in it.

222
00:23:30,120 --> 00:23:39,420
We keep going though, we take we use relations again, we say if the IP ID matches the to asset ID.

223
00:23:39,420 --> 00:23:48,100
Now the reason we're doing that instead is the taxonomy currently doesn't have outgoing relations or relationships for IP addresses.

224
00:23:48,100 --> 00:23:54,360
They're only incoming, like in this case, it's the net block contains the IP address.

225
00:23:54,360 --> 00:23:58,020
So it's the net block that has the from asset ID.

226
00:23:58,500 --> 00:24:11,280
So here we see IP ID equals to asset ID, we join again with nets or assets as nets, where rels2 from asset ID is the net block or the nets ID.

227
00:24:12,500 --> 00:24:22,280
And then we do our filtering, where we say for rels1 we want to make sure the type is either the A record or the quad A record, and rels2 needs to be contains.

228
00:24:22,280 --> 00:24:24,920
I just explained why a moment ago.

229
00:24:25,460 --> 00:24:39,260
I threw in this helpful filter where I demonstrate how you can filter by time, so if you want to say it's got to be something we've validated within the past week, you know, you can do that.

230
00:24:39,260 --> 00:24:40,580
It's easy enough.

231
00:24:41,460 --> 00:24:51,820
For the asset types, we want to say fully qualified domain names need to be FQDN, the IPs need to be the IP address, the nets need to be the net block.

232
00:24:52,320 --> 00:24:53,280
Straightforward.

233
00:24:53,480 --> 00:25:04,700
And then finally, the fully qualified domain names need to end in OWASP.org so that this is all relevant to, you know, what we were asking about, which is OWASP.org.

234
00:25:05,880 --> 00:25:17,720
So it's a bit much, but if you take the time to craft these things and put them into your script, you don't have to touch them again necessarily, and now you can pull this data out anytime you want.

235
00:25:17,720 --> 00:25:21,120
And like I've said before, it's the way you want to do it.

236
00:25:21,120 --> 00:25:25,180
But let me quickly demonstrate that this actually works.

237
00:25:36,590 --> 00:25:38,570
And it doesn't like me.

238
00:25:41,140 --> 00:25:41,900
I see.

239
00:25:41,900 --> 00:25:43,740
I must have copied it wrong.

240
00:25:47,080 --> 00:25:48,600
We'll try again.

241
00:26:02,730 --> 00:26:04,110
And there you have it.

242
00:26:04,110 --> 00:26:16,830
We have the four net blocks or CIDR blocks that these names resolve into.

243
00:26:17,110 --> 00:26:25,590
Easy enough, quick, but potentially powerful if that's what you're interested in finding out.

244
00:26:26,210 --> 00:26:31,790
The purpose, of course, not being that I think this is what everyone needs to know.

245
00:26:31,790 --> 00:26:36,750
It's more to demonstrate that you can find out pretty much anything you want to know.

246
00:26:36,750 --> 00:26:38,950
This is the point, I would say.

247
00:26:40,970 --> 00:26:41,730
All right.

248
00:26:42,310 --> 00:26:44,950
So what does this mean for all of us?

249
00:26:44,950 --> 00:26:47,670
Or why am I promoting this?

250
00:26:49,250 --> 00:26:52,610
So getting on, literally kind of getting on the soapbox here.

251
00:26:53,630 --> 00:26:58,410
I'm just, I just think we need to be, like I said at the beginning, more organized about this, right?

252
00:26:58,410 --> 00:27:01,270
We need to, we need to have a unified way to communicate about this.

253
00:27:01,270 --> 00:27:05,850
We need to have expectations around what kind of data we're collecting for these different asset types.

254
00:27:06,290 --> 00:27:15,090
There needs to, there needs to be a way to say, if I'm looking for this information and I ask you for it, I can expect it's gonna be these things you're gonna tell me.

255
00:27:15,090 --> 00:27:21,130
Not a spreadsheet that hopefully will have what I'm looking for, maybe, on a lucky day.

256
00:27:21,270 --> 00:27:44,230
So, and I don't like this sequential process we're using, where the first tool gets the fewer, the least number of seeds, and as you keep going, tools get more seed data and more, it's like, I don't know, it's, it's, I hope I'm not the only one that feels disappointed by how this is being done.

257
00:27:44,270 --> 00:28:02,090
But if we use this hub-and- spoke approach, where we're all, all of this is going into the OAM and all the questions are being answered from the OAM, there would be no, no need to have this clunky sequential process where we're potentially losing data along the way.

258
00:28:02,110 --> 00:28:07,810
Each tool could contribute the data to the OAM and everything it has to offer.

259
00:28:07,810 --> 00:28:08,410
That's the other thing.

260
00:28:08,410 --> 00:28:12,970
We're losing a lot of valuable data from these tools by executing them this way.

261
00:28:12,970 --> 00:28:31,190
But if each one was designed to say, here's what I do, here's what I'm gonna go out and get, and I'm going to put all of that into the OAM, they could all be running potentially and concurrently, or in parallel, and giving all their value to the database.

262
00:28:31,830 --> 00:28:38,110
I see this as way more powerful, both for tool developers and for the people using the tools.

263
00:28:38,190 --> 00:28:42,110
And it makes it easier for everyone to be contributing to this, right?

264
00:28:42,110 --> 00:28:58,770
We could have 50 different tools being used potentially, it doesn't really matter, as long as all the data is going back into one place and everyone's accurately reporting what they're finding, then your question could be answered by 50 tools instead of three that you feel fairly confident about,

265
00:28:58,770 --> 00:29:01,890
or whatever it is that exactly that you do.

266
00:29:01,930 --> 00:29:06,690
But I see this as more powerful than what we do currently.

267
00:29:08,710 --> 00:29:17,310
I also think, I said a moment ago, some of these tools are getting seeded with more of the what's been collected so far than others.

268
00:29:18,070 --> 00:29:19,210
Why do that?

269
00:29:19,210 --> 00:29:38,990
When they all could retrieve from the database to seed, I'll call it equally, all of them can do their discovery process, all of them can store back into the same place, and from the data in the database we could then notify of what is new to what we understand about the,

270
00:29:38,990 --> 00:29:40,330
I'll call it, target.

271
00:29:40,630 --> 00:29:43,310
But this is a better model.

272
00:29:43,310 --> 00:29:58,230
It's also not just my idea, I'm pretty sure it's safe to say that like Haddox has promoted this, I believe Nahamsek has promoted this, I think a lot of us have been saying this is a better approach to handling this than the way many people are doing it currently.

273
00:29:58,450 --> 00:30:03,110
So I'm just on the same bandwagon and I feel like the OAM is only gonna make it easier for everybody.

274
00:30:05,330 --> 00:30:14,270
I'm pretty excited because of that promise I mentioned at the beginning that we're just kind of, we're just getting started, right?

275
00:30:14,590 --> 00:30:19,450
We just got this working in time to bring it to you today.

276
00:30:19,450 --> 00:30:24,770
I mean, we were, we got the version 4.0 out, I believe, in July.

277
00:30:24,770 --> 00:30:28,950
We are testing it like crazy, you know, putting fixes out.

278
00:30:30,350 --> 00:30:38,210
It just was enough so that you can run Amass as you knew it before, but with the OAM now.

279
00:30:38,270 --> 00:30:42,450
But that's not where this, that's not the end, it's just the beginning.

280
00:30:42,450 --> 00:30:54,450
It's that now we have the data model to support the promise, which was now we're going to add more and more to this data model.

281
00:30:54,550 --> 00:31:02,210
And we are going to have... I'm not sure what's going on with that.

282
00:31:13,630 --> 00:31:16,430
Apologies for that, I'm not sure what that was about.

283
00:31:16,510 --> 00:31:28,440
But, so we're gonna have more, more asset types, more relationships between them.

284
00:31:28,440 --> 00:31:35,080
For instance, personally, I'm pretty excited about quickly adding TLS certificates and JARM fingerprints.

285
00:31:35,080 --> 00:31:38,760
I can't wait to have the new identifier for these assets.

286
00:31:38,760 --> 00:31:44,300
I'm excited about what we're going to connect when we have this additional identifier.

287
00:31:44,420 --> 00:31:48,140
But that's just one or two things, right?

288
00:31:48,600 --> 00:31:55,840
What's it gonna look like when we start adding email addresses and individuals and organizations and employees?

289
00:31:55,840 --> 00:32:01,320
And it's gonna get crazy and really fun, I think, to be doing this.

290
00:32:01,360 --> 00:32:15,520
And like I said, you're going to be able to collect all this, I would say, much more quietly and then have all the fun you want perusing the data and coming up with your findings from your recon activities.

291
00:32:15,600 --> 00:32:19,120
This is... this feels like the dream, right?

292
00:32:19,120 --> 00:32:21,080
And this is what I'm trying to give to everybody.

293
00:32:21,080 --> 00:32:22,800
This is where I'm trying to take this.

294
00:32:24,720 --> 00:32:27,500
And it's all for the community.

295
00:32:27,500 --> 00:32:29,480
There's no strings attached here.

296
00:32:29,480 --> 00:32:30,940
This is OWASP, right?

297
00:32:30,940 --> 00:32:32,880
We want everyone involved.

298
00:32:33,120 --> 00:32:34,820
I want everyone's ideas.

299
00:32:35,020 --> 00:32:36,760
Come bring it to the Discord.

300
00:32:36,760 --> 00:32:43,500
Let us know where you want to see this go or what you want to see... how you want to see us shape this, right?

301
00:32:43,500 --> 00:32:44,760
We're listening.

302
00:32:44,880 --> 00:32:50,580
We're reaching out to other organizations as well who are known for producing this kind of information.

303
00:32:50,780 --> 00:32:52,040
And they're starting to sign up.

304
00:32:52,040 --> 00:32:53,880
They want to export the data in this format.

305
00:32:53,880 --> 00:32:55,600
They want to be involved.

306
00:32:55,640 --> 00:32:59,260
They want to be chiming in on what is this going to look like.

307
00:32:59,260 --> 00:33:04,260
But now is the time, if you're interested, to get involved and put your two cents in.

308
00:33:04,520 --> 00:33:11,860
Because we're going to start modeling everything that's relevant to security that's found on the Internet.

309
00:33:15,960 --> 00:33:16,980
And that's what I have.