The Bug Hunters
Methodology v3(ish)
whoami
★ Jason Haddix - @jhaddix
★ VP of Trust and Security @Bugcrowd
★ 2014-2015 top on Bugcrowd (Top 20 currently)
★ Father, hacker, blogger, gamer!
What this talk is about...
history && topics
Aka “How to Shot Web” @ DEFCON23
(still) light reading
Discovering IP Space
ASN’s
★ autonomous system number - [Link]
ARIN & RIPE
★ [Link]
★ [Link]
Rev whois
★ [Link]
Shodan Organization
★ [Link]
=org%3A%22Tesla+Motors%22
Discovering New Targets
(Brands & TLDs)
Brand / TLD Discovery
Brand ★ Wikipedia the ORG
Acquisitions ★ Crunchbase Acquisitions section
Discovery
Linked
★ *BURP* Spidering
Discovery
Weighted Link
and REVERSE ★ DomLink
TRACKER analysis ★ bUILTWITH
Acquisitions
Linked Discovery (Burp Demo)
1) Turn off passive scanning
2) Set forms auto to submit (if you’re feeling frisky)
3) Set scope to advanced control and use string of target name (not a normal FQDN)
4) Walk+browse, then spider all hosts recursively!
5) Profit (more targets)!
DomLink
Vincent Yiu @vysecurity
Builtwith
Builtwith
Others
★ Trademark In Google: ” "Tesla © 2016" "Tesla © 2015" "Tesla © 2017" inurl:tesla
Discovering New Targets
(Subdomains)
Subdomain Scraping
It’s all about sources
Sublist3r Amass
● Amass by jeff Foley - @jeff_foley
● [Link]
● Includes reverse DNS methods
● Includes permutation scanning:
○ [Link], [Link]
root@Test2:~/tools/amass# cat [Link]
#!/bin/bash
mkdir $1
touch $1/$[Link]
amass -active -d $1 |tee /root/tools/amass/$1/$[Link]
Sublist3r Subfinder
● Subfinder by ICEMAN
● [Link]
● Json output, multi resolver for bruteforce, ++
root@Test2:~/tools/subfinder# cat [Link]
#!/bin/bash
mkdir $1
touch $1/$[Link]
subfinder -d $1 |tee /root/tools/subfinder/$1/$[Link]
Fancy table referencing runtimes ++
amass Both subfinder
blah jUST USE BOTH blah
blah jUST USE BOTH blah
blah jUST USE BOTH blah
jUST USE BOTH
I Don’t use anymore:
● Enumall / Recon-NG (not great on sources or speed)
● Aquatone (not great on sources) but aquatone-scan is useful
● Sublist3r (same as above)
● Anything else for scraping
● ClouDflare Enum (although sometimes i think about it)
○ [Link]
Subdomain Brute Forcing
1,136,964 line subdomain dictionary ([Link])
Tool Time to run Threads Found
subbrute errored 100 0
time ./[Link] -c 100 [Link] $[Link] | tee [Link]
gobuster 21m15.857s 100 87
time gobuster -m dns -u $[Link] -t 100 -w [Link]
massdns 1m24.167 n/a 213
time ./[Link] /root/work/bin/[Link] $[Link] | ./bin/massdns -r [Link] -t A -a -o -w massdns_output.txt -
dns-parallel-prober 42m2.868s 100 43
time python [Link] $[Link] 100 $TARGET_outputfile -i /root/work/bin/[Link]
blacksheepwall 256m9.385s 100 61
time ./blacksheepwall_linux_amd64 -clean -dictionary /root/work/bin/[Link] -domain $[Link]
Sub Bruting
With Massdns (or subfinder), why not all of them?
[Link]
[Link]
80a018c66354a056
CommonSpeak and
[Link] data
★ Subdomain data is awesome
★ URL data has been less useful
Auxiliary
★ Dnssec / nsec / nsec3 walking
○ Ldnsutils, nsec3walker, nsec3map
★ Github recon [Link]
levelup-subdomain-
○ Search for goodies enumeration/blob/master/esoteric_subdo
main_enumeration_techniques.pdf
★ Dorking: ads key, priv pol, tos, aws, s3
[Link]
53ZEq8
Enumerating Targets
Port Scanning
65536 unverified Hosts (a large targets ASN)
Tool Time to run Found
Masscan 11m4.164s 196
masscan -p1-65535 -iL $TARGET_LIST --max-rate 100000 -oG $TARGET_OUTPUT
nmap
∞ zzz
#!/bin/bash
strip=$(echo $1|sed 's/https\?:\/\///')
echo ""
echo "##################################################"
host $strip
echo "##################################################"
echo ""
masscan -p1-65535 $(dig +short $strip|grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b"|head -1) --
max-rate 1000 |& tee $strip_scan
Credential bruteforce
Brutespray
Nmap service
masscan credential [Link]
scan -oG
bruteforce
python [Link] --file [Link] -U
/usr/share/wordlist/[Link] -P /usr/share/wordlist/[Link] --
threads 5 --hosts 5
Credential bruteforce
Visual Identification
★ Because of the nature of scraping and dns redirects some sites will be
gone or the same.
★ Gotta get an idea of what is up and unique
★ We also don’t know what protocol these are on (http vs https, ++)
Wayback Enumeration
TIME OUT
Xmind Organization
★ Green w/ checkmark is Done
★ Orange is in progress
★ Red is vulnerable
Demo
Platform Identification
and CVE searching
TBHMv1
Parsing JavaScript
Coverage for Heavy js sites
★ ZAP Ajax Spider
★ Jsparser
★ linkfinder
Linkfinder
jsparser
Feeding these tools
Content Discovery
Content Discovery /
Directory Bruting
TBHMv1
❏ Seclists / RAFT / Digger wordlists
❏ Patator
❏ WPScan
❏ cmsmap
★ Gobuster
★ Burp content discovery
★ Robots disallowed
★ ¯\_(ツ)_/¯
Content Discovery / Directory Bruting
★ [Link]
ea67d85c13206125806f0828f4d10
★ But still gold
Parameter Bruting?
★ Yep! - Untested but love the idea
★ Can be combined with backslash scanners top 2500 alexa params
Domain Domain
Identify IPs bruteforcing, Visual
scraping for Portscan
and main TLDs Resolve && add Identification
discovered TLDs new IP ranges
ASNs aMASS
Reverse Whois Massdns masscan
SUBFINDER eyewitness
Acquisitions Manual
++
++
Platform Content Parameter
Identification Discovery discovery
Builtwith gobuster
Wappalyzer Wordlists Parameth
++ Burp Burp analyze target
XSS
Blind XSS Frameworks Continued!
Server Side Request
Forgery
What to do with SSRF?
[Link]
53f31ba453e273b
IDOR - MFLAC
★ IDs
★ Hashes
★ Emails
Insecure direct object
reference
Insecure Direct Object Reference
{regex + perm} id {regex + perm} user
{regex + perm} account {regex + perm} number
{regex + perm} order {regex + perm} no
{regex + perm} doc {regex + perm} key
{regex + perm} email {regex + perm} group
{regex + perm} profile {regex + perm} edit REST numeric paths
[Link]
Infrastructure & Config
Subdomain takeover!
★ Pretty simple, check for cnames that
resolve to these services, if the
service has lapsed, register and
profit!
Subdomain Takeover
Robbing Misconfigured Sh** (AWS)
WAF
★ Often on newer websites we are
hampered by WAF or CDN vendors
security products
○ Cloudflare and Akamai
○ Dedicated WAFs
★ Solutions:
○ Encoding (meh)
○ Finding origin
○ Finding Dev
★ [Link]
What’s in a name?
★ [Link]
★ [Link]
★ ww1/ww2/ww3...[Link]
★ [Link]/jp/...
★ ...
★ [Link]
The future of TBHM
Old
Aka “How to Shot Web” @ DEFCON23
New! Bugcrowd University
