Bug bounty vs. Big companies Paul Amar, Hack.lu, 19/10/2017

Le Puy de Dôme, Auvergne.

Puy de Dome, Auvergne.

Charming attraction in the City of London - Tube during strike + rush hour combo, lovely.

“If attackers get to choose what time we're going to engage with them, we get to choose the battlefield.” Haroon Meer, “Learning the wrong lessons from Offense”, 2016

La bataille de Marengo, 14th of June 1800 - http://desaix.unblog.fr/

“If the cost to attack is less than the value of your information to the attacker, you will be attacked.” Dino A. Dai Zovi, “Attackers Math 101”

“Build your defenses from an offensive mindset.” Zane Lackey, “Attack-driven defense”, 2013

-

Found http://bf1-adxdb-001.data.bf1.yahoo.com

https://medium.com/bugbountywriteup/900-xss-in-yahoo-recon-wins-65ee6d4bfcbd

-

Found http://bf1-adxdb-001.data.bf1.yahoo.com Enumerated files and found: - about.php - nginx.conf - testdb.php < vulnerable to XSS - 900 USD$ bounty

https://medium.com/bugbountywriteup/900-xss-in-yahoo-recon-wins-65ee6d4bfcbd

-

Found http://bf1-adxdb-001.data.bf1.yahoo.com Enumerated files and found: - about.php - nginx.conf - testdb.php < vulnerable to XSS - 900 USD$ bounty

Enumeration also led him to (5 subdomains deep): -

target.*.*.*.yahoo.com target.*.*.*.*.yahoo.com

https://medium.com/bugbountywriteup/900-xss-in-yahoo-recon-wins-65ee6d4bfcbd

IP Ranges & Exposure

So what? Monitor your ranges and *automatically* check: - New IP addresses? -

What’s open on it?

So what? Monitor your ranges and *automatically* check: - New IP addresses? -

What’s open on it?

- Any delta? -

Open/Closed ports, changed services? (Apache > Nginx, …)

So what? Monitor your ranges and *automatically* check: - New IP addresses? -

What’s open on it?

- Any delta? -

Open/Closed ports, changed services? (Apache > Nginx, …)

- Go for low-hanging fruits -

“product: tomcat”, port:445, port:3389, port:21 “successfuly logged in”, …

So what? Monitor your ranges and *automatically* check: - New IP addresses? -

What’s open on it?

- Any delta? -

Open/Closed ports, changed services? (Apache > Nginx, …)

- Go for low-hanging fruits -

“product: tomcat”, port:445, port:3389, port:21 “successfuly logged in”, …

- Always ask you the question: -

Should it be exposed online?

Domains names

What’s out there? -

theHarvester (https://github.com/laramies/theHarvester) Knockpy (https://github.com/guelfoweb/knock) Enumall (https://github.com/jhaddix/domain) GoBuster (https://github.com/OJ/gobuster) dnsrecon (https://github.com/darkoperator/dnsrecon) subbrute (https://github.com/TheRook/subbrute) Aquatone (https://github.com/michenriksen/aquatone)

Domain wordlist? @jhaddix got you covered: https://gist.github.com/jhaddix/86a06c5dc309d08580a018c66354a056

https://media.rootcon.org/ROOTCON%2011/Trainings/RECON.pdf

https://www.blackhillsinfosec.com/eyewitness-and-why-it-rocks/

https://www.blackhillsinfosec.com/eyewitness-and-why-it-rocks/ https://github.com/ChrisTruncer/EyeWitness

https://hub.docker.com/r/wappalyzer/cli/

https://github.com/evilsocket/xray

SSL certificates

https://mishresec.wordpress.com/2 017/10/13/uber-bug-bounty-gainin g-access-to-an-internal-chat-syste m/

(Unofficial) Python API: https://github.com/PaulSec/crt.sh

(Unofficial) Python wrapper : https://github.com/PaulSec/censysio

http://nahamsec.com/secure-your-jenkins-instance-or-hackers-will-force-you-to/

Sensitive source code

What to look for? Use their search engine and start looking for g00di3s: "company" API_key "company" secret_key "company" aws_key "company" Password "company" FTP "company" Login "company" Github_token

https://www.hackerone.com/blog/how-to-recon-and-content-discovery

Remember this?

Remember this?

Remember this?

Automated tools within CI

https://bugbountyforum.com/tools/

Amazon Web Services (S3)

https://flaws.cloud

https://gist.github.com/PaulSec/50c5075017e3021d46d4560793353f1d

Wrapping-up

Few takeovers - Pepito ¡Arriba, arriba! -

https://github.com/PaulSec/pepito

- Wrapper for Censys.io -

https://github.com/PaulSec/censysio

- AWS scan script to test AWS S3 bucket configuration/security -

https://gist.github.com/PaulSec/50c5075017e3021d46d4560793353f1d

- Python script to gather scopes and public reports from HackerOne (in csv) -

https://gist.github.com/PaulSec/fd29abf7d596ccc58439e21376d3eabf

- eyeWitness - Perform footprint of web servers, RDP, VNC, ... -

https://github.com/ChrisTruncer/EyeWitness

- Wappalyzer docker container -

https://hub.docker.com/r/wappalyzer/cli/

How to keep up? - @jhaddix and @nahamsec are really good resources -

Also many hunters but I will not try to name them all here…

- @disclosedh1 for public reports on HackerOne - /r/netsec/ -

Public blog post get usually posted there. Lurk and wait for MOAR.

- Develop stuff.

Embrace hackiness. (and thanks for not sleeping)

Paul Amar

@PaulWebSec

Resources - “Learning the wrong lessons from Offense”, Haroon Meer https://www.youtube.com/watch?v=AQfbPpkaq88 - Zane Lackey - Attack-driven defense https://www.youtube.com/watch?v=_4vSurKPl6I - Recon slides from jhaddix https://media.rootcon.org/ROOTCON%2011/Trainings/RECON.pdf - How to recon? https://www.hackerone.com/blog/how-to-recon-and-content-discovery

Bug bounty vs. Big companies.pdf

Big companies.pdf. Bug bounty vs. Big companies.pdf. Open. Extract. Open with. Sign In. Main menu. Displaying Bug bounty vs. Big companies.pdf. Page 1 of ...
Download PDF
4MB Sizes 15 Downloads 266 Views
Report

Recommend Documents

Bug bounty vs. Big companies.pdf
83-101. 4. E. Colla et M. Dupuis, Le Défi mondial du bas prix, Publi-Union, Paris, 1997. Distrib Livre.fm Page 11 Mardi, 20. octobre 2009 11:13 11. Page 3 of 55. Bug bounty vs. Big companies.pdf. Bug bounty vs. Big companies.pdf. Open. Extract. Open
BOUNTY HUNTER.pdf
There was a problem previewing this document. Retrying... Download. Connect more apps... Try one of the apps below to open or edit this item. BOUNTY ...
PayPro | Bounty Programme.pdf
Page 2 of 11. 2. INTRO. As a way to reward our community, we are distributing 2% of all PayPro Tokens in. our Bounty Program. The bounty pot will be split according to points accumulated. pro- rata between the participants. Rewards: • 30% Twitter.
CBD BUG
modes) over private motor vehicles in improving Queensland's traffic system. ... current budget/s for improving infrastructure across the state for cycling, walking and public ... vulnerable road users injured in crashes with motorists, so it is up t
CBD BUG Meeting
Mar 21, 2007 - CBD BUG could raise this with BCC and property managers if any further instances are reported. .... Jeff Griffin. Project Manager, Tank Street.
boggo road cycleway - CBD BUG
The Boggo Road cycleway will be delivered as part of the development of the Boggo ... Building the cycleway at a later date could result in an additional cost.
bed bug data.pdf
killing heater FF3T-13 to concentrate the. heating power. A single heater will work with. a 3M x 2M tent. Page 2 of 2. bed bug data.pdf. bed bug data.pdf. Open.
The Duchamps Mine Bounty
visited the home of No Dice on the web www.nodicerpg.com. If you've .... choice. As usual there is no specific prohibition beyond your own Hosting abilities as .... Page 10 ... A pair of top quality brand new six shooters (6 chambers per gun).
NPC Bounty Hunter Bonus Pack.pdf
... below to open or edit this item. NPC Bounty Hunter Bonus Pack.pdf. NPC Bounty Hunter Bonus Pack.pdf. Open. Extract. Open with. Sign In. Main menu.
kings bounty the legen.pdf
There was a problem previewing this document. Retrying... Download. Connect more apps... Try one of the apps below to open or edit this item. kings bounty the ...
PRODUCTIVIST-BOUNTY-REFERRAL-V1.pdf
Mar 1, 2018 - ... participate in Productivist Bounty Cam- paign: United States of America, People's Republic of China (except for Hong Kong, Macau and. Taiwan), South Korea, Cuba, Iran, North Korea, Syria. 1. Bounty Program & Referral. • Reddit. â€
CS4HS ICS3C vs ICS3U vs ICS4C vs ICS4U Expectations.pdf ...
sequential file, database, XML file,. relational database via SQL);. A2.3 demonstrate the ability to declare,. initialize, modify, and access one- dimensional and ...
CS4HS ICS3C vs ICS3U vs ICS4C vs ICS4U Expectations.pdf ...
sequential file, database, XML file,. relational database via SQL);. A2.3 demonstrate the ability to declare,. initialize, modify, and access one- dimensional and ...
BUG Slow Jam Song List -
Oct 1, 2014 - Breakfast In Hell. Bm. | d - D u - u d u |. Scrambled Eggs. C. | d - D u d - D u | over the melody of Yesterday. Cupid. G. | d - R u - u d u | led by Anna-Maria. Dona Nobis. See Tab. Cockles and Mussels. D. | d - d u d u |. Spooky - Dus
Bug Out Bag List.pdf
bug out bag list is even more important. Everyone living in a city or a suburban environment is. at an increased risk to experience political and civil unrest, riots and will likely feel the effects of. a man-made disaster before those in less popula
bug tracking system free download
bug tracking system free download. bug tracking system free download. Open. Extract. Open with. Sign In. Main menu. Displaying bug tracking system free ...
Bug Club Intro Letter.pdf
place the book was written or sometimes information about the author or illustrator. Inside back cover: these notes suggest puzzles and challenges that help ...
Bug-out Grab & Go List.pdf
There was a problem previewing this document. Retrying... Download. Connect more apps... Try one of the apps below to open or edit this item. Bug-out Grab ...
Automatic Bug-Finding for the Blockchain - GitHub
37. The Yellow Paper http://gavwood.com/paper.pdf ..... address=contract_account, data=seth.SByte(16), #Symbolic buffer value=seth.SValue #Symbolic value. ) print "[+] There are %d reverted states now"% .... EVM is a good fit for Symbolic Execution.
Bug in extrafont/ggplot2/knitR -
May 9, 2015 - Load packages and define theme options(stringsAsFactors=FALSE) library(ggplot2) ... Call.graphics. My setup: R.Version(). ## $platform.
native-vs-web-vs-hybrid.pdf
Page 1 of 26. Web. Native. vs. vs. Hybrid. How to Select the Right Platform. for Your Enterprise's Mobile Apps. Page 1 of 26 ...