start	end	text
0	5500	So the panel would be around bug bounties and reaches, insider tales from the trenches.
5520	9300	And we'll be taken care of by Jason Haddix.
9460	15060	And we have panelists Olivia, Wesley, Ben, and I would just give it...
15060	15480	Orion.
15600	20580	Orion. So I will stop here. I will not introduce them.
20580	24400	Jason and they themselves will introduce them.
24400	27480	So let's give them a big round of applause.
34580	36960	Alrighty. Thank you everyone for showing up.
36960	38220	So my name is Jason Haddix.
38220	44780	I am formerly a pretty well-known bug hunter and now a full-time red teamer.
44960	50560	So I wanted to put together a panel where I brought some of my friends on who I respect,
50560	55620	colleagues, and that, and basically talk about some of the stories.
55620	59920	So I think the funnest part of DEF CON, or the most fun part for me,
59920	63200	DEF CON is swapping war stories with other professionals in the field.
63200	66020	Like you have a hallway con and your buddy is like,
66020	69440	I did this crazy thing this year, but you haven't seen him for a year.
69440	74600	And so I thought that I would bring on a panel that represented both red teamers and bug hunters
74600	80420	because I wanted to kind of tie it together and say that we're not so different in the kind of things we try to accomplish,
80420	82900	especially when you're a wide scope bug bounty hunter.
83280	85060	There's only minor differences.
85060	87980	So on the panel today, I have Olivia.
87980	92520	Olivia works at an undisclosed company, but she builds red team tools for this company
92520	94000	and is also on the red team.
94120	97060	I have Ariane, who is on my red team at Budobot.
97580	98820	I have Wesley.
99120	101520	Wesley, where are you? Am I allowed to say where you work?
101780	103800	No, okay. So Wesley is a full-time red teamer.
103800	105320	You're an internal red teamer though, right?
105520	107560	Okay, so not researcher on Twitter.
107640	110900	And then we have Ben, who's a bug hunter, content creator.
110900	113780	But Ben, you're mostly doing bug hunting these days, right?
117240	118460	All of it? Okay.
118520	120040	Okay, so Ben does everything.
121520	125460	Red teaming, bug bounty, pentest, appsec, mobile, everything, right?
126420	127680	Okay, yeah. Cool.
128360	130860	So I mean, I don't know if I really need to give you their long history.
130860	133320	I think we can jump into kind of the questions that I had.
133360	138660	But they're pretty well known if you are in the Twitter spirit at all or anywhere like that.
139060	142980	So we will jump right into the first question.
143940	147680	So the first question I have, and I'll give you guys some time to ruminate on this,
147680	154660	is just without disclosing the customer name, can you think of one of your best hacks in the past couple years, right?
154660	156740	Like whether it was a red team assessment or a bug bounty assessment.
156740	160900	I know Ben did a whole panel on this, so he might just use one he already has in his pocket.
160900	169260	But I'll start so that you guys can take a couple seconds just to ruminate.
169260	177100	So one of the ones that actually Ari and I had this year was a customer, was actually a prospect.
177100	180600	And so we did some initial recon on the prospect.
180880	183380	Everyone knows that, you know, this is recon village.
183440	185540	I've done several talks on recon.
185760	194380	And we did our normal recon methodology and we ended up finding a whole bunch of assets that were not really tied to the main domain name or anything like that.
194380	196380	And they tended to be S3 buckets.
196380	201620	And this was in a sales cycle, so this wasn't actually when they had paid for testing yet.
201620	204980	So we basically found this stuff in the cloud.
204980	207300	We found an S3 bucket with source code in it.
207300	218340	And in the source code was about 13 hard-coded AWS keys for their organization that allowed to pull down multiple terabytes of data for their company with PII.
218920	221600	And this was before we even started the red team test.
221600	225680	This was like initial recon to do on the company.
225740	227720	And so that happened like a month ago.
227720	230000	So that's one of the ones I haven't told yet.
230100	234340	The other one I like to tell is the one on a bug bounty.
236380	245680	So the one I tell in my class that I like a lot was there is a large e-commerce site.
245680	247600	And it has a very wide scope bug bounty.
247980	255800	And so what I did was I was doing recon on this bug bounty and I figured out that this company had bought a CRM software.
255960	257460	Because I had found it in my recon.
257460	261240	I had visited all their pages and eventually I landed on the login for a CRM page.
261240	262740	It said CRM in the title.
262740	266440	And so I looked at the CRM page and I don't have credentials.
266940	268760	But I googled it.
268760	271300	And that's like 90% of our job as hackers, right?
271300	272460	Is googling things.
272460	276960	So I googled it and I found the company that made the CRM software they use.
276960	278820	Customer Relationship Management Software.
278820	280220	It's to manage all your customers.
280620	283340	And they turned out they had acquired this company.
283340	288020	But they hadn't taken down all of the websites for the former company yet.
288100	291520	And so what was still left online was a demo of the CRM.
291520	294640	So prospective clients could go check it out.
294640	297240	So I logged into the demo, which they gave you credentials for.
297240	299540	And I ran all that traffic through Burp Suite.
300480	305840	And they give you an admin cred so you can check out the admin backend if you're going to buy the CRM.
306020	309900	And so I was able to browse all the admin functions and all the admin APIs.
310300	321040	And then I took all of those paths and URLs and I replayed them against the production site that this company had already put on prod on their thing.
321040	324320	And it turned out that they hadn't applied any authentication to the admin APIs.
324500	328820	So I was able to steal about 16 million records from this company.
329360	337620	And then on top of that, I was able to send SMS messages to anybody's phone who had their app installed on their mobile app.
337620	340860	And I was also able to get into their supplier network and order things.
340860	341880	And that was pretty crazy.
341880	344160	So that's another one I did last year.
345780	347520	We'll start with Olivia.
347520	351130	All right.
351130	358610	So one really interesting engagement that I had was for a company that cared about these things called low latency systems.
358610	365530	Which is where you focus on the speed of a network and transferring data.
365590	374710	And so the reason why this engagement was so interesting was that in terms of developing an exploit and all of that,
374710	381910	you have to focus on what is really easy to transport, because the things that they're sending are very easy to transport.
382010	386390	And the other thing is that they monitor these networks a ton.
386390	396410	Because if something's taking too long to send, or if data's not being processed correctly, they lose tons and tons and tons of money very, very fast.
396410	408390	And so developing an exploit was very difficult, because I had to essentially look at all the previous exploits that had been used.
408390	416170	And I had to do this because if you try to write something from scratch, there's a much higher fail rate.
416170	420650	Because you can't really test it on anything, because you don't own those systems.
420650	425430	And if you do try to test it, they now know that you're trying to test those systems, and you've been caught.
425430	433610	So it's like you have kind of one shot to do this, and if you mess up, it's like, oh well, too bad, so sad, you've been caught, and then you get in trouble.
433690	437290	The company you're freelancing with is getting in trouble.
438350	447090	And what we had to do was essentially modify pre-existing open source malicious tools and then send those across the network.
447090	457110	And what that entails is essentially reading thousands upon thousands of lines of code and then slightly modifying it to fit your specific use case.
457670	460630	And that's what we did, and luckily it worked.
460630	466350	But it was very scary, because it was the first time I had done something under that amount of pressure.
466450	471630	And it was also the first time that I had done something that was just being watched so intensely.
471630	478030	Because most of the time when I've done red teaming and done those types of engagements, it's been on a network where there's a lot of normal traffic.
478030	485610	So you see people going to all these different websites, sending lots of different things, doing lots of different things, and this network was just doing one thing all the time.
485990	490690	And so trying to slip something in was a little bit more difficult.
493280	496160	Hi, everyone. My name is Ariam.
496900	502320	I have a pretty interesting story when I had to do an internal physical test.
502760	510440	I'm just going to skip through the first part and say when I got into the building, I was just walking around and I see a conference room.
510440	514960	And I go and sit down, and my first thought is, you know, go for the easiest layer.
515120	517520	Had an Ethernet cable, tried to plug it in, nothing.
518140	522800	Assume that they had some sort of NAC filtering or some Mac-based filtering.
522940	528760	So I then thought, okay, let me go to a printer, try to print out the network settings, because sometimes they have the Mac address on it.
528800	532800	I could then spoof it and then unplug the printer and then try again that way.
533380	536120	But while I was doing that, I was just sitting on the table.
536120	542140	I saw a mouse and wiggled it a little bit, and I looked to my left and there's a big TV and I see the Windows logo.
542240	545540	And my face lit up. I'm like, okay, there's something I can work with.
545540	549280	I go behind the TV and I see a little computer attached to it.
549680	555060	So I'm like, all right, let me try and boot up a portable Kali image.
555260	562380	And thankfully the BIOS didn't have a password on it, so I could just switch the boot option to my Kali box.
562880	571400	I boot it up, I log in, and I can mount the hard drive that was on the actual Windows machine to my Kali box.
571400	573820	And then you can just go to System32.
574240	580360	I downloaded everything and then I parsed the SAM security with SecretStump from Impact.
580360	587200	I got the local SAM hashes, and I mean, you bypass the NAC, you have access to their internal network.
587740	593660	I had the local admin creds, and I'm like, you know what, I'm going to just try and see if they reuse that password.
595000	597980	And every host had the same admin password.
597980	601920	So you basically went from zero to hero in under like 10, 20 minutes.
601920	605100	And this is for a government organization, if that makes you feel safer.
607060	613920	And I mean, after that, I just dumped one of the creds on one of the hosts, and you see like a SQL user on it.
613920	615540	You go after the databases.
616400	618340	But yeah, that's probably one of the more interesting stories.
618340	622040	So if you ever have an internal, you're in a conference room, look at the TV.
622040	623420	You might be surprised.
624080	631320	But yeah, I mean, that definitely was very interesting and a great way to bypass any security controls that they might have.
635770	636430	Thanks.
636530	637510	I'm Wes.
637510	638470	I'll tell two stories.
638470	639550	First one real quick.
639550	649850	I think my favorite kind of bug bounty kind of finding that kind of really started me in a lot of kind of doing bug bounties was I was driving home from a hiking trip with my son.
649850	652170	He was getting a little hungry, and I was like too lazy to cook.
652170	654310	And I was like, I'll just stop at a fast food restaurant.
654310	660730	Pulled into the drive-thru, looked at the display, and there was just a TeamViewer login with the code right there.
660730	662190	And I was just like...
662190	665630	That was like the easiest finding of my life.
666410	669810	And while I don't do a whole lot of bug bountying, that was like my favorite piece.
669950	671890	And the second story I'll tell is how I cheated.
672050	674650	So I love some bug bounty people.
675870	681890	So as part of like some recon for an engagement, you know, obviously internal red team, you're able to see all the reports, see all the findings.
681890	684930	So I was digging into some findings, and I saw vulnerability.
685290	688730	And I saw where a, you know, kind of bug bounty just didn't go far enough, right?
688730	692190	So this researcher, he was very respectful of the program and the scope.
692250	694650	He was like, hey, I took it this far. Here's where it's at.
694770	696450	I was like, oh, that's juicy.
696450	698190	And I don't think it's been remediated yet.
698190	700050	So I was like, let me see where I can go with this.
700210	701470	So took it from there.
701750	703210	Just continued on with the exploit.
703210	704330	It was really awesome.
704590	706570	The work he did, the payload he provided.
706590	709190	And then just, you know, something simple as like S3 buckets, right?
709310	711050	There's nothing entertaining in those.
711490	713690	But then it just felt like textbook, right?
713690	716650	There's just backups.
717090	719590	And I was like, okay, so backup, source code, nothing too fancy.
719590	721190	We're digging through there, just trying to find, you know,
721190	722530	is there a flaw in the source code?
722530	724290	But at least now I have all the source code.
724750	725670	And then I couldn't believe it.
725670	730830	I just found a backup where their, I guess they had mounted,
730830	735370	their Docker container had like a, mounted their local dev system.
735590	736930	And there was just keys.
737010	738170	Keys for days.
738830	742830	So from there, it was just really simple just to go down like 32 different paths.
742850	744330	And then just exploit from there.
744330	748350	So it was super fun, but like, honestly, you know,
748350	750010	there's just kind of like what Jason was saying.
750030	751490	There's just a lot of overlap.
751490	755510	And I can't do my job without like an attack surface management team
755510	758790	or the devs out there doing the recon on my behalf,
758790	761310	managing all the tools, like project discovery and all that,
761310	764290	just automating everything so that I kind of have that easy part of,
764290	767190	let me pick out some findings and then do some real cool Red Team stuff.
767670	769250	With that, I'll turn it over to Ben.
770570	772910	All right. Speaking of bug bounties, good morning.
773110	775090	Yeah, I have a bug bounty story.
775090	779330	A lot of, I'm trying to think of like how to describe this company.
779330	788450	They are a financial institution in the credit monitoring area of financial stuff.
788470	791170	And then they got owned very hard a couple of years ago.
791510	792250	If it makes sense.
792570	794290	Everyone knows who it is? Perfect. All right.
794290	795710	I didn't say their name, so.
796770	799130	We're all on the same page then? Cool.
799250	800570	Well, they have a bunch of domains.
800570	802790	They have a bunch of different TLDs, right?
802790	804330	Every country has one.
804330	806770	And I do these like live recon streams.
806770	808130	My chat picks a target.
808370	810990	They want to do this one for some god awful reason.
810990	811990	I don't know why.
812490	818330	My favorite thing to do is just spin up boxes and just send traffic.
818570	822930	Purely send traffic of endpoints that I think would be a quick little win.
822930	824530	Just see what we can find.
824530	826710	Set up three, four, or five machines.
826770	829390	Each of them send one endpoint.
829930	832610	I think Tom's actually using his tool, Meg.
832730	837610	And it takes a list of files and a list of endpoints or a single endpoint.
837610	841730	And it just sprays that across the entire infrastructure.
841730	845650	And it saves the entire GET request.
845650	848350	So whether it was successful or it wasn't, it takes it.
848350	850010	And then you can parse through all that.
850010	854650	You can grab through it and see if the keyword you were looking for, it was in there.
854650	859670	So this instance, I did like swagger, actuator, .get.
859670	861550	A couple of easy ones, right?
861770	863150	Low-hanging fruit.
863770	865010	Well, nothing came back.
865790	868050	And then my chat was like, you should look at this domain.
868050	871910	It's some super random TLD, South American.
871910	873670	I don't even know what country it was, to be honest.
873670	875310	I couldn't recognize the TLD.
875810	880750	Well, we kept going at it and brute-forcing, looking for subdomains, nothing.
881030	881970	Subdomains, nothing.
881970	882770	And I'm like, there's no way.
882770	885410	This company was owned really hard years ago.
885410	886630	There's no way they got their...
886630	887710	Can I pass on this one?
888190	890690	There's no way they got their shit together at this point, right?
892490	893490	Well, they didn't.
893490	901070	It was just a little tricky because based on the application, based on the language of the country,
901070	904410	the path where the apps could be stored are different.
904410	909250	And sometimes you don't even find them because they just give you this URL that your customers go to,
909250	912670	to sign up or whatever it is, the general public doesn't have access to.
912670	913990	It's not in robots.txt.
913990	915370	It's not Cache by Google.
915370	920930	It's like this super random path of three letters, dash, three letters, dash, and then the app name.
921090	925670	And the way I came across it was I was looking for something else on GitHub,
925670	928150	but in my clipboard I still had the domain name.
928210	931530	And I pasted it and pushed enter right away without noticing.
931530	937730	And the next thing I see there's this list that comes up from some engineer who had done some automation,
937730	943970	and it just gave me the path that I just mentioned, three letters, dash, three letters, dash, three letters, dash,
943970	944850	and the app name.
944850	945990	Go to it.
945990	947150	Hit actuator.
947210	947990	It opens up.
947990	948790	There's nothing there.
948790	950250	There's actuator info.
950250	951630	There's the basic ones.
951630	952590	I have no information.
952590	956930	And if you're not familiar with actuator, it's for Java apps mostly, I think.
956930	964730	If you actually find a leaked actuator, you can pull the memory and you can parse it and get credentials.
965170	968330	They use an environment variable.
968370	969090	I can't talk today.
969170	969970	Variables.
970210	972090	And then a bunch of info.
972090	977650	Sometimes it has the entire HTTP request from all the other users, just depending on what you find in similar cases.
978250	981630	Well, when you go to the application, you right-click, view source.
981850	984350	There's a bunch of links hidden in comments.
984350	985470	It's a bunch of different apps.
985470	989230	Every single one of them had an open actuator with a heap dump available.
989750	992130	And I'm doing this on stream at this point on accident.
992130	1001090	So I take down this stream, go look at it, and it turns out the actual heap dump had an authorization or bearer token inside of it that I just parsed for.
1001090	1004170	So you go cat heap dump.
1004170	1006310	You pass it to strings.
1006430	1008330	And then with strings, you do another pipe.
1008330	1009410	And then you do grep.
1009410	1013610	And you just do bearer, where you do authorization or whatever one you're looking.
1013610	1018650	Well, it turns out one of the bearer tokens I had was the admin token.
1018890	1022150	And you can actually impersonate every bank that was using this application.
1022150	1023830	You go to the bank from that country.
1023830	1028070	Every bank's loan, application, financial data for their customers.
1028070	1030410	And there's a bunch of functionality that you could play around with.
1030410	1032670	But unfortunately, I couldn't go any further.
1032670	1038570	I just felt a little unethical to take these credentials and own the entire application.
1038570	1045050	But just looking at those loans and applications was really, really cool to just see that you can get access like this.
1045230	1048430	So moral of the story is if you don't find something, there's always something there.
1048430	1049950	GitHub is a good one.
1049950	1052890	I Googled for stuff I couldn't find, and GitHub is a good one.
1052930	1055450	And then you just need to find that one path that could leak stuff.
1055450	1059590	And in my case, it wasn't literally in the HTML documents or HTML comments.
1059650	1063190	You just have to open them up and then feed it to Actuator, and it opened up.
1063210	1064170	So, yeah.
1070640	1072060	Sorry about the mic situation.
1072060	1073940	It's just, like, flowing over all of them.
1074360	1075160	Okay.
1075320	1080000	So next question is kind of, like, what is a day in the life for you?
1080000	1085380	And so we have a pretty good panel of people up here to ask this question to.
1085380	1087340	We have a Red Team Tools developer.
1088140	1091220	Arianne, I mean, you do everything, but you specialize in internal.
1091220	1091860	Right?
1092720	1097620	You're an internal tester for a company, but Arianne externally consults for other companies.
1097620	1100880	And then, Ben, you do everything but bounty and a lot of web.
1100880	1103600	So what is a day in life for you when you're on a project?
1105460	1109960	So for me, the day in the life really depends on who is hiring me.
1110140	1118560	So if it's, like, am I on, like, an actual pen test team, or is, like, a pen testing team hiring me to do a specific task?
1119160	1124820	Both of them are, like, environments that I have experience with.
1124820	1131220	And so when it comes to, like, if I'm actually on a pen test team, it's usually just pretty standard.
1131220	1138660	And the things that I will develop are, you know, usually pretty quick, like, you know, Python script or, you know, something in Go.
1138660	1140660	Like, it's pretty standard.
1140820	1147920	And then when a pen testing team hires me to do malicious tool development, it's usually for a very specific purpose.
1148240	1151080	And it's a little bit more specialized.
1151080	1160460	And I think the reason why some teams, like, decide to kind of, like, outsource this or whatever is because, like, you kind of have to sit down and read, like, a lot of code.
1160580	1167380	And then you also have to be able to find, like, what specific thing you need to modify in order to make that thing work.
1167440	1175880	Because when it comes to, you know, pen testing some types of systems, accuracy is extremely important.
1177240	1187000	And when accuracy is very important, the focus becomes not on building a tool from scratch, which is a common misconception, and really modifying the tools that you know work.
1188780	1192400	And to me, that's kind of, like, the heart of what I do.
1192400	1195480	And I think it's really where, like, the craft lies.
1195480	1198200	Because, you know, anyone can make a malicious tool, right?
1198200	1201180	And you can make a really awesome tool that can do really awesome stuff.
1201180	1203560	But it's, like, will this tool be used?
1203560	1206740	Will this tool, like, actually help people?
1206740	1212380	And with what I do, it only usually helps one engagement or one thing and all of that.
1212380	1219260	And I just think it's really cool to be able to tailor something for a very specific purpose that could otherwise just be used in general.
1219260	1220720	And I think it's really cool.
1221720	1222920	Oh, yeah.
1222980	1230580	So, Livia, when you're doing tools development for Red Teaming, you said that Python and Go are your preferred language or mostly asked, right?
1230580	1230900	Okay.
1230900	1236800	So if you want to do offensive tool development, that is mostly what we see today is Python and Go tools today, right?
1237120	1238000	What?
1238120	1238660	Yes.
1238660	1239100	In Bash.
1239100	1241400	If you can do something quick and dirty on Bash.
1241400	1241840	In Bash.
1241840	1242240	Yes.
1242240	1243080	Absolutely.
1243960	1244600	Yeah.
1244600	1246800	Like, Bash is another great one.
1246800	1250600	Python and Go, especially for, like, general engagements are great.
1250600	1257460	And then when it comes to, like, if you're doing something with, like, lower level stuff, Assembly is huge.
1258460	1262500	It's not, like, I know a lot of people's favorite thing in the world.
1262740	1267120	But I think for me it's really helped me find, like, a niche in that space.
1267120	1269700	And I think it's the so I'm, like, I'm a junior in college.
1269700	1274980	And so, like, I have to kind of convince people why, you know, I might be better to hire someone else.
1274980	1283100	And so finding a good niche and all that and Assembly is a good one for that space because a lot of people don't want to deal with it.
1285600	1286100	Awesome.
1286100	1287000	So, yeah.
1287460	1291920	For me, it would either be internal pen testing or red teaming.
1292800	1298100	Obviously, red teaming being the more advanced, you know, two-, three-, four-, five-month engagements.
1298560	1305720	I'll focus on internal pen tests for this little section because red teaming, you can just go down the whole rabbit hole with that.
1305720	1312640	But, yeah, I mean, we would start off with an ROE of what scope you are testing against.
1313260	1319140	Either a assumed breach campaign where you just put on a subnet inside of a user network.
1319140	1321280	If they don't give creds, it's fine.
1321540	1325200	You usually go after layer two attacks, network attacks.
1326280	1333520	I think, like, one of the more important things that not a lot of people talk about is client communication during internal pen tests.
1334140	1336580	Because at the end of the day, they are paying for the tests.
1336580	1341320	They are the ones that, you know, if you want to get rehired, you have to write a good report.
1341320	1350820	So I've learned that taking notes during the internal pen test and taking screenshots, writing the captions under each screenshot.
1351560	1359880	Because not only does that have the timestamp under the picture, it also helps you remember the kill chain for when you are writing the report.
1359880	1361980	So that is one important thing.
1361980	1368720	Another important thing is asking before the test starts if the client wants you to update them daily, weekly.
1369560	1373260	Because I've noticed that sometimes they just expect you to respond daily.
1373480	1377520	And at the end of the test, one thing we didn't like is that there was no response.
1377560	1381980	And, you know, after a while, you realize that, okay, that should be a question that you should ask.
1385240	1394940	Another interesting thing is before the test starts, what I like to do is ask them if they want us to update them if we find any critical vulnerabilities.
1395600	1406860	The only issue with that is I've had IT admins that when I tell them I found a path to get to domain admin, they somehow magically have a password reset day the same day I told them.
1406860	1411520	And the next day I wake up, I try to log in, it says incorrect password.
1412740	1417840	So it does suck, but at the end of the day, again, they're paying for the test. You just find another path.
1417840	1425940	We have a lot of internals that I do nowadays. Some easy wins for you guys.
1425940	1431480	Kerberos thing is obviously there. This is like you're not going under the radar. This is just trying to get domain admin to find attacks.
1431540	1433180	ESC8 is nice.
1435060	1443880	Surprisingly, you still see Responder working in like 95% of environments, which is honestly upsetting because it's like 10 years old at this point.
1443880	1449700	But you still see DA creds flying around, relay them or crack them.
1449800	1458600	But yeah, it's typically ROE, testing for a week or two, updating client every day, taking notes and screenshots, very important.
1458600	1466060	And then, of course, the biggest role of a pen tester is the report because that's what they're paying for and that's what their whole team is.
1466860	1472600	One thing I've noticed that clients like is having an executive summary with just like C-level wording.
1472600	1477540	And you go down, you have a list of all the vulnerabilities you find with the screenshots, the remediation.
1477880	1484100	And what we also do is we map the MITRE ATT&CK framework to whatever ATT&CK we do, put a link there.
1484220	1487680	So then if they have any more questions without asking you, they just go there.
1487880	1489180	Yep, that's it.
1490860	1494040	Awesome, thank you. I'm glad you kind of brought up some of those soft skills.
1494040	1502540	So I'd say at some principle security engineer, so I don't get to have as much day-to-day fun, I think, as some of these other individuals do.
1503000	1505480	But I definitely live in that soft skill kind of realm.
1505480	1510380	So I definitely live vicariously through some of our other members on the team.
1510380	1513300	So definitely do a lot of like pair hacking sessions, things like that.
1513300	1517960	So I can hop in, understand what they're doing, you know, definitely give advice where I can.
1517960	1520340	But a lot of times I'm also just learning something new, right?
1520340	1523520	Especially like different, you know, newer AD attacks, things like that.
1523520	1525520	So definitely loving that.
1526280	1529540	But I live and breathe in report writing.
1529700	1534940	Not just writing reports, but also just briefing them out to that C-level suite.
1535120	1536800	Also briefing out to the engineers.
1537240	1542880	And especially as a red teamer, the internal red teamer, you know, at the end of the day, it's awesome to find cool stuff.
1542880	1544000	It's awesome to have a story.
1544000	1547620	But if you're not reducing risk at the company, like you're not delivering value.
1547620	1551440	So partnering with that blue team, more than just a partnership, right?
1551440	1554800	We are really close with each other and the different teams that we have.
1555060	1559580	And that's part of it is just building out that rapport so that you can get things fixed in a timely manner.
1560220	1562460	As well as that there's no, like, animosity, right?
1562460	1564460	There's no, like, hey, I did this, I attacked you, right?
1564460	1565780	It's like, hey, I found this.
1565780	1571240	Let's figure out how we can, you know, reduce the risk, increase security, and just make this a better place.
1571580	1573840	So that's where I probably spend most of my time.
1574460	1576980	You know, typical engagements, two, three months long.
1577400	1580740	One, I'd say, misconception is that you're always doing the same thing as a red teamer.
1580740	1585480	But I would say every engagement I've done has been definitely different, right?
1585480	1590480	So especially larger companies, you're going to have subsidiaries, you're going to have just different technologies you're going to focus on.
1591300	1594880	Different, as things pop up, you know, they want emphasis, right?
1594880	1596780	Like AI, let's go take a look at AI.
1596780	1597460	What are we doing there?
1597460	1601260	So every single engagement I've done is completely different than the last one.
1601300	1603380	So at no point am I really repeating anything.
1603660	1609420	Definitely love learning, that kind of speed of picking up new things, digging into it.
1609420	1614460	But I can't stress enough, kind of like that mentoring, the soft skills.
1614920	1623860	So if you want to progress in your career, it's picking up a lot of those things that I know it's hard to say, let me step it back from the keyboard a little bit and have less fun.
1623860	1625820	And you definitely do feel out of touch at times.
1625820	1627740	And then trying to pick up these new things.
1627760	1630740	But it's what I enjoy doing.
1631040	1636740	And it makes it, I think, just fun, just building up those relationships and doing that.
1636980	1639280	But occasionally, you know, I do get to have some fun.
1639280	1642360	I think I did some Active Directory stuff not too long ago.
1642360	1644560	So still some excitement there.
1644880	1647780	But it's not all fun and games.
1647780	1648920	But I enjoy the briefings, though.
1648920	1649520	I don't know.
1650160	1651420	But with that, I'll turn it over to Ben.
1651460	1652100	Sure.
1652120	1652320	Yeah.
1652320	1655890	So you said purple teaming.
1656430	1665520	When you are doing a red team test, are you iteratively, like in a Slack, you exploit a whole chain and then come back and tell them?
1665540	1666700	How do you handle that?
1667660	1668680	So that's a great question.
1668780	1670400	Especially purple teaming.
1670400	1671780	So I'd say we have a couple different campaigns.
1671780	1678300	So in a standard kind of engagement, we're probably more waiting until we can kind of proof a kill chain to say, hey, I have something to kind of deliver.
1678300	1683380	If we just have, like, a nugget, you know, that might just be a finding that we include in a report.
1683620	1686020	Just depending on how we view that risk, right?
1686340	1695220	But definitely if there's a full-on kill chain, we're typically communicating that out soon after we find it and working with the developers and reaching out to them, letting them know, like, hey, this is what it is.
1695340	1697400	There's only so much you can put in a JIRA ticket.
1697680	1700400	But we do our best to, you know, provide that detailed information.
1700400	1701200	Here's a POC.
1701200	1702460	Here's how we did it.
1702500	1705300	You know, whether it's a video we include, all sorts of stuff like that.
1705300	1709740	And then definitely with the reports, you know, everything they were saying, we include all those links.
1709980	1711980	Purple team engagement is definitely a lot different.
1711980	1714420	It's a much closer feedback cycle on that.
1714420	1718000	So with that, it's typically we're performing this attack.
1718740	1720520	Depends on the engagement.
1720520	1724220	But typically we're performing an attack, and then we're immediately, you know, did you detect that?
1724220	1725220	What are your responses?
1725220	1725740	Things like that.
1725740	1728400	So, like, we might have, like, a 24-hour cycle on that.
1728400	1733700	Some of them where we're essentially testing specific controls in a specific environment.
1733840	1737380	We might have, you know, like a one-hour turnaround of, like, hey, we did all these things.
1737380	1739440	Here's this attack chain that we did.
1739440	1740440	What did you see?
1740440	1745600	And then going back through, testing out detections, adding some new ones, and then re-performing those attacks.
1749420	1749820	So...
1750320	1754780	I don't have a... honestly, I don't have a job, technically, yet.
1757200	1758920	So I work for myself.
1759160	1764460	And a lot of the things that I do is, you know, hacking is a big part of it, but it's not just hacking.
1764460	1770120	But as far as, like, hacking goes, and to get the tooling out of the way, give me a Linux terminal,
1770120	1775060	some project discovery tools, and some of Tom's tools, and that's all I need, honestly.
1775060	1778760	It's just open source stuff that I'm using, and that's about it.
1778760	1780800	I don't have a lot of, like, things that I need to do.
1780800	1784320	Everything is in Bash, pretty much, or in a Linux terminal.
1784900	1788920	But as far as, like, a day-to-day for me is, you know, hacking is a big part of it.
1788920	1792800	And I go through these, like, cycles of hacking, just because...
1792800	1798360	I went through a phase where, like, I was hacking all the time, like, 12-, 13-hour days.
1798360	1802280	And then I did it for two, three years, because I wanted to buy a house.
1802280	1805520	I wanted to buy, you know, get my life together, pay off debt, whatever it is, right?
1805520	1808600	And after a couple of years, it got old.
1808600	1810960	I got tired of it. I hated hacking. I hated bug bounties.
1810960	1814460	I left the bug bounty platform I was working for. I just couldn't do it anymore.
1814460	1820520	But recently, I've tried to repair that, and, you know, working for myself with, you know, bug bounties
1820520	1823040	and making content and, you know, launching my own company soon.
1823040	1826500	It's just a lot of different things you have to do.
1826500	1830220	Like, your brain is going from one different task to something else.
1830220	1833460	And then next thing you know, you have to do something else for it. That's completely different.
1833460	1836880	So there are three different things that I'm doing at the same time.
1836880	1843620	So the biggest thing for me for, you know, to set myself up is, one, is having a consistent routine.
1843900	1848960	The routine thing has been incredibly good for me to get my shit together in life in general
1848960	1852760	because at first, you know, I self-diagnosed myself with ADHD.
1852760	1855920	I think I have ADHD to some extent, but it wasn't as bad as I thought
1855920	1858420	because I just didn't have a framework to work with.
1858580	1862240	So having a, you know, every week telling myself these are the things I got to work with.
1862240	1863700	And I give an example in a bit.
1863700	1866040	And then Monday I'm going to focus on making content.
1866040	1868820	Every Monday or every Tuesday I usually make my content.
1868820	1872540	And then at night is when I do my pen test and my bug bounty stuff.
1872580	1877220	I go to the gym or I push myself to go out of the house at some point because I work at home.
1877220	1879160	And, you know, everything is at home for me.
1879400	1883780	So at some point, whether it's going to the gym, going to get coffee, going to get food,
1883780	1889060	I need to get out of the house for one hour just to have a switch so I can do other things, right?
1889060	1893220	And then the second bit of it is the routine thing.
1893220	1896380	It's just knowing, okay, so in the mornings I'm going to do this, take a break.
1896380	1898140	At nights I'm going to do my pen test.
1898140	1899760	So that switch also helps out.
1900140	1903440	But when it comes down to, like, doing bug bounty hunting,
1903440	1905480	I go to these live hacking events.
1905480	1907880	HackerOne puts them together. They just did one in Vegas.
1908120	1909200	They're doing one in Tokyo.
1909200	1911880	And they give you a target that's usually pretty hard to hack into
1911880	1916160	because they've been around for years or there's like 40 other hackers that are better than me
1916160	1918400	that are hacking on this thing and I want to look for bugs.
1918400	1920260	That's where the consistency comes in.
1920260	1923200	I tell myself, okay, I've got to make content for the next three weeks
1923200	1925520	because I'm going to be busy with hacking.
1925680	1929400	Make three pieces of content for the channel on Monday, record it, ship it out.
1929460	1932680	So it's on the channel and then every night hacking starts.
1932680	1934820	So you have to stay consistent.
1934860	1938160	If you're not consistent looking at these apps, you're going to miss a lot of bugs.
1938540	1940360	There are vulnerabilities there.
1940360	1941640	It's not that they're not there.
1941640	1943000	It's just you give up.
1943080	1944140	It's human behavior.
1944140	1945420	You put in three, four hours.
1945420	1947200	You want instant gratification.
1947200	1947920	It doesn't happen.
1947920	1948700	You give up.
1949000	1951800	But other people are finding vulnerabilities somehow, right?
1951980	1958500	So I've learned that no matter what, I'm going to dedicate every night from like 4 or 5 p.m. to 9, 10 p.m.
1958500	1961840	And when I say that, I'm not working 13 hours anymore.
1961840	1963340	I work three, four hours in the morning.
1963340	1965540	I tell myself, you're going to be hacking tonight.
1965540	1966240	Take a couple hours.
1966240	1967020	Go run errands.
1967020	1970220	Keep my house together, whatever it is, and then switch over to hacking.
1970220	1976120	And then on the hacking part of it, the thing that's helped me a lot is putting myself out of my comfort zone
1976120	1979320	and that's really worked out for me in the past two live hacking events.
1979940	1983420	I've never done any thick client hacking at all.
1983620	1987700	That was the one that I went after last event when I got a decent bounty.
1987700	1989420	And I've never done anything like that.
1989420	1991760	But it was just no one else was looking at it.
1991780	1993660	So why not learn something?
1993660	1995500	And it was a very huge learning curve for me.
1995500	1998920	I had to talk to a bunch of hackers who helped me, but it worked.
1999000	2000160	And then same thing with this event.
2000160	2004100	It was more of a what niche thing I find and no one else has found.
2004900	2007980	So for the first event, it took me the entire event.
2007980	2013140	So about two weeks of hacking until I found one vulnerability that I was happy about
2013140	2015340	and was one of the top bounties at the event.
2015400	2018600	And for this one, another two weeks until I found something that was really interesting
2019720	2022980	that helped me get over the hump of not finding any vulnerabilities.
2022980	2026980	And then I ended up placing in the top five for the leaderboard for it.
2026980	2030820	So it's just the pivoting and consistency of wanting to push yourself and say,
2030820	2032560	I have to get this done.
2033340	2035220	There's a healthy balance to do this.
2035220	2038800	You can't guilt trip yourself into, oh, I didn't do anything today,
2038800	2041780	or I'm not good enough, imposter syndrome, whatever you want to label it.
2041780	2044620	But it's just consistency. It's fine. Screw it.
2044620	2048960	The four hours that I have today, five hours that I've carved out for the entire night,
2048960	2051060	every night of the week, I'm going to dedicate to it.
2051060	2052740	And worst case, you've invested your time.
2052740	2054060	You're going to learn something.
2054320	2056680	And best case is you're going to find vulnerabilities.
2057000	2059180	It's a win-win, honestly, either way.
2059600	2061080	I have a question for you.
2061080	2066480	So you have been on some of the more known hacking teams
2068940	2071940	that do vulnerability disclosure rather than hacking.
2071940	2074940	So companies who don't have a bug bounty,
2074940	2081320	or you're on these teams that go after these big companies,
2081320	2086360	and then you responsibly disclose them, and you give them plenty of time.
2086360	2088580	What is it like working on those teams?
2089060	2092060	How do you guys communicate? How do you structure your hacking team?
2092960	2094820	It's not super organized.
2094820	2097740	It's just a bunch of dudes on Discord going on a voice chat.
2099680	2104360	A lot of times, it's one Discord channel that one of our friends owns,
2104360	2108640	and it's honestly just people going in and out of the voice chat.
2109300	2111320	Discord is a really good place.
2111320	2114180	So even for when we do small engagements with bug bounties,
2114180	2115060	it's two or three of us.
2115060	2119320	We have our own Discord group on a Discord server.
2119320	2121980	It's just the three of us in the group, and we just pin things.
2121980	2124020	If you find an interesting thing, you pin it.
2124140	2126200	You have credentials, you pin it.
2126380	2129380	And if you really want to communicate with each other, get on a voice chat.
2129380	2132640	It's not that scary to be on a voice chat with strangers, honestly.
2132640	2134420	Just, hey, you want to get on a voice chat?
2134420	2136040	Because some of these people I've never met.
2136200	2137420	I've never talked to them.
2138180	2139880	We've just gotten a voice chat, and it helps,
2139880	2142300	because I can show you exactly the thing that I'm working on,
2142300	2145360	and you can physically see it and help out with streaming it, too.
2145960	2147700	But it's not super organized.
2147700	2149740	The other couple of things that we do is a spreadsheet.
2149740	2153440	So we dump all of our assets that are interesting, who looked at it,
2153440	2156200	what interesting thing they found, when it was looked at,
2156200	2160860	and then we use a Word doc a lot of times to track the findings,
2160860	2162200	whether we reported them.
2162200	2165480	Also another sheet that says the bug title, who reported it,
2165480	2168860	what was the bounty, what was the status of it, and so on.
2168860	2174300	So it's just Project Management 101 featuring Discord.
2179540	2181640	All right, so those are all the questions I had.
2181640	2183680	Did anyone from the audience have any questions?
2184440	2186620	All right, I think you put your hand up first.
2187240	2198360	So moving on to deal with the dangerous threats or other threats
2198360	2199940	we may be trying to disclose.
2199940	2200900	Like legal threats?
2200900	2201380	Yes.
2201380	2203780	Okay, so the question for the recording was,
2203780	2207200	how do you deal with what used to be kind of the consequences
2207200	2209820	of doing responsible disclosure, potential legal threats,
2209820	2211160	potential legal actions?
2211160	2213920	So I'll start, and then I think I'll give it to Ben,
2213920	2215820	because I think he probably has a lot of things.
2215820	2219480	So I am OG, so I've been around for a long time,
2219480	2221720	and so that kind of stuff scares me to death.
2221720	2223480	I don't do responsible disclosure.
2223480	2226520	Everything I do is contracted testing.
2226520	2228580	Or bug bounty, I'm allowed to do it through the scope,
2228580	2231680	because I have had friends who have gone to prison for hacking.
2231680	2235580	So I have family and kids, so I'm just not doing it.
2235820	2238540	In fact, Ben has invited me on some of the campaigns they go on,
2238540	2241300	and I'm like, eh, I'm not really going to do it.
2241300	2243980	But the newer school hackers have a different mindset,
2243980	2245300	and the world is evolving.
2245540	2248880	And so it's a good thing to discuss.
2248880	2249900	I'll hand it to Ben.
2255100	2258260	To be clear, I'm not the person that picks these targets.
2258280	2260540	I've only been a part of a couple of these.
2262000	2265900	But I've found random bugs that I want to report to companies,
2265900	2266900	but I just want to make it clear.
2266900	2269880	I don't support doing that kind of stuff.
2269880	2271040	I can't do it without permission.
2272000	2274360	But I've never had the word legal dropped on me
2274360	2275840	in the last 10 years of doing bug bounties,
2275840	2277440	whether I was invited to hack on them,
2277440	2279140	or whether it was just me being nosy,
2279140	2281620	or being stupid and finding something.
2281860	2284640	Well, there is a fine line between...
2285240	2287060	Let's talk about the bug bounty thing first.
2287060	2290440	There's a fine line between extortion and bug bounty.
2290600	2292460	You don't message a company saying,
2292460	2295400	I have a vulnerability, are you going to pay me if I report it to you?
2295420	2297220	You don't report a bug to them and say,
2297220	2299300	well, I put hours in, you should need to pay me.
2299300	2302780	Those are the fine lines of you crossing into extortion,
2302780	2305240	because nobody asks you to hack on these companies.
2305420	2308220	The way you communicate to these programs,
2308220	2309480	or these emails, or the managers,
2309480	2310860	whoever you're talking to,
2310860	2314840	is the key into not getting the word legal dropped on you.
2315220	2318220	Some of the stuff that Sam recently did,
2318220	2320060	that's zero invitation to hack on them,
2320060	2321080	but they just email and say,
2321080	2322340	hey, we just found this vulnerability,
2322340	2325120	we think it's pretty bad, please fix this.
2325400	2327200	We don't even ask for disclosure a lot of times.
2327200	2328660	And then afterwards we say, hey, by the way,
2328660	2330980	we're disclosing this in 90 days, this is a blog post.
2331320	2333960	As long as your goal isn't to make...
2333960	2335140	So there is hackers that do this.
2335140	2336100	I'm going to take this back.
2336120	2339200	There are hackers that purely do this for fame.
2339200	2342300	They find some shitty bug that does nothing,
2342300	2343640	they go to media,
2343640	2346160	and it turns out it's a rate-limiting issue.
2346240	2347100	Who cares?
2347180	2349180	There's not a life-changing thing.
2349180	2350680	And they complain, the company didn't pay us
2350680	2352080	for 100 vulnerabilities that we found.
2352080	2353880	Well, they didn't ask you to find 100 vulnerabilities.
2354920	2358480	So you have to be mindful of the other person.
2358480	2361100	If you are the person receiving these,
2361100	2362640	how would you want them to approach you?
2362640	2364940	It's just, hey, we're doing security research,
2364940	2366420	we came across this,
2366420	2368740	we want you to get it fixed, no pressure.
2368780	2369540	That's it.
2369540	2372340	There's no... just the tone of your voice,
2372340	2374420	the way you interact with these companies,
2374420	2377140	you want them to understand you don't have any bad intentions,
2377140	2379120	you don't want to extort them for money,
2379120	2381520	you're not a bad actor or anything like that.
2381520	2383560	Honestly, in years of doing this,
2383560	2385600	I ordered a bunch of random stuff online
2385600	2387980	and I always go,
2387980	2389980	I wonder what happens if I change my order ID.
2390020	2392180	It's a constant thing I've done, right?
2392180	2393600	And I've done it 5 or 6 times
2393600	2395660	with some big companies or big startups.
2396080	2398220	9 out of 10 times, they responded to me.
2398220	2399620	They were grateful for it.
2399620	2401420	They sometimes comp my order,
2401420	2402780	sometimes just give me a gift card,
2402780	2404760	and sometimes just say, hey, thanks for doing this.
2404980	2407080	And I tell them, hey, this may show up in the talk,
2407080	2408940	but I'm going to try to react to you guys.
2408940	2410780	And if it doesn't, I'm going to make sure you look good.
2410780	2413020	So just don't make them look bad
2413020	2414460	because you want clout,
2414460	2416220	you want fame in front of media,
2416220	2418160	and you're going to make a joke out of this company.
2418200	2419700	Well, guess what? Joke's going to be on you
2419700	2421220	when the legal team gets involved.
2423720	2424880	Anyone else have a question?
2425620	2426800	I think you were next.
2454140	2457680	So the question was, like, there's been, like,
2457880	2461820	a kind of noticing of decreased payouts,
2461820	2466840	and that's affecting, you know, the platforms in Bug Bounty,
2466840	2469240	and do we see any changes to the Bug Bounty scene?
2470320	2471700	I'll start that one.
2471700	2475380	I think that there's more competition than ever with platforms, right?
2475380	2477600	So you may see lower...
2477600	2479160	you may see some lower payouts,
2479160	2481420	but you're in aggregate going to see more companies
2481420	2483200	doing Bug Bounty because there's now about
2483200	2486320	12 platforms that are live all over the world.
2486320	2487920	It's not just two anymore.
2487920	2490440	So as a bug hunter, I really feel like
2490440	2493020	you should diversify your platforms.
2493020	2494620	It sucks because you're used to one
2494620	2495720	and you're used to dealing with them,
2495720	2496820	and a lot of people have a lot of love
2496820	2498360	for a certain platform or brand,
2498360	2502460	but it's really important to diversify.
2503300	2504940	Do I see payouts going down?
2504940	2506120	I mean, I don't know.
2506120	2508360	I mean, the live event, like, you know,
2508360	2509900	like, they're going down, but the live event
2509900	2513000	just paid out, like, $2 million or something like that.
2513000	2515960	So at the top end, top end hackers are still getting paid.
2516220	2517720	For the middle tier stuff, you know,
2517720	2520140	maybe, like, low-hanging fruit is going down
2520140	2521400	for payouts and stuff like that.
2521400	2522920	Stuff that can be found by automation,
2522920	2524700	better automation's happening every day.
2524700	2527280	So it just depends, really.
2527740	2529840	In my experience, like, I'm very rollercoaster-y
2529840	2530660	with bug bounty, right?
2530660	2532340	I'll do a lot of it, and then I'll do none of it
2532340	2533960	because I hate it, and then I'll do a lot of it,
2533960	2535540	and then I'll do none of it because I hate it.
2536260	2538780	In my experience, like, if a program
2538780	2541700	you are working on isn't paying you fairly,
2541700	2543720	or, like, the worst thing is, like,
2543720	2545140	lumping all your good bugs together
2545140	2546900	into, like, one issue, or, like,
2546900	2549600	some BS like that, or, you know,
2549600	2551060	arguing risk or whatever,
2551400	2552540	just move on to another program.
2552540	2554920	There's so many programs and so many bugs.
2554920	2556980	Just move on, I would say.
2565310	2567230	So just to start us off,
2567230	2569870	I worked at a hacker one for a while,
2569870	2571810	and this is not a
2571810	2573850	ex-employee's comment, it's just my personal
2574930	2576370	experience with them.
2576370	2578110	I'll make it quick. I don't fully agree
2578110	2580290	with the bug bounty stuff going down.
2580290	2582010	I actually see more increase in how much
2582010	2585450	hackers are making just talking to people.
2585450	2586070	The biggest thing is
2586070	2588190	it's what you hack on, what platform
2588190	2589870	you hack on, what programs you hack on.
2589870	2591810	I haven't seen any companies go, we're dropping
2591810	2593770	our payout, you know, from this to that.
2593770	2595970	I've seen the opposite. I've seen campaigns of 50%,
2595970	2597650	100% engagements
2598010	2600170	that are increasing for bonuses, right?
2600910	2601990	It's a lot of those.
2601990	2603810	Like, I've seen the bounty amounts that people are making,
2603810	2606010	the average bounties are going higher. When COVID hit,
2606010	2608410	COVID hit and people were getting layoffs,
2608410	2610150	people were spending more in bug bounty.
2610150	2612310	I think bug bounties are doing a lot of,
2612310	2613750	they're finding a lot of things.
2613750	2615230	I don't think it's going down, it's just
2615230	2616950	it's becoming very competitive.
2618070	2619490	Jason said earlier about
2619490	2621230	people automating things and
2621590	2624130	people are finding just things that could be done with a scanner.
2624130	2625530	Of course, these companies can run the scanners
2625530	2627870	and they're not going to pay for it. So my biggest advice
2627870	2629810	is if you're doing bug bounty hunting, ask yourself
2629810	2631630	two questions. It's usually
2631630	2634150	the first one is, so what? What can you do with this company?
2634290	2635630	And the next one is, how can you affect
2635630	2637810	the company's infrastructure or customer's data?
2637810	2639950	And if you can't answer those two, don't report it.
2644290	2645570	All right, that's all we've got for today.
2645570	2647710	Thank you so much for Recon Village for having us.
2647710	2648870	We took it right up to the end.
2648870	2650050	Thank you to the panelists.
2654250	2655450	Ben has swag
2655450	2656630	at those tables out there
2656630	2658570	and Budobot has a whole bunch of swag too.
2658570	2660290	Challenge coins and a whole bunch of other stuff.
2660290	2661750	We'll be back at the back tables in the back
2661750	2662970	if you guys want to check that out.