Test & Tea : ITSEC testing, manual vs automated

1. IT Security testing:
manual VS automated
Zoltan Balazs, CTO @ MRG Effitas
2017

3. Whoami?
• I’m NOT a CEH
• Creator of the Zombie Browser Toolkit
https://github.com/Z6543/ZombieBrowserPack
• Creator of the HWFW Bypass tool
• Idea later(?) implemented by nation state attackers in Duqu 2.0
https://github.com/MRGEffitas/hwfwbypass
• Creator of the Malware Analysis Sandbox Tester tool
https://github.com/MRGEffitas/Sandbox_tester
• Played with crappy IoT devices
https://jumpespjump.blogspot.hu/2015/09/how-i-hacked-my-ip-camera-and-found.html
https://jumpespjump.blogspot.hu/2015/08/how-to-secure-your-home-against.html

4. Introduction
There is a saying that every software and system will
be tested from a security point of view, but the
question is whether the owner controls when this is
done and who reads the report.
But the owner (or the users) will pay the price either
way.

5. Automated testing
Good at scanning multiple pages, multiple
parameters for the same issues
Bad at finding logical bugs, authentication bypasses,
…

6. This is still an issue which is
not found by automated
scanners by default
What do you do?

7. This is still an issue which is
not found by automated
scanners by default
What do you do?
admin/admin
Automated scanners don’t brute-force user
logins by default

8. This is still an issue which is not
found by automated scanners
What do you do?

9. This is still an issue which is not
found by automated scanners
What do you do?
Automated scanners don’t have a clue that they should try
this parameter they have never seen before

10. What is the problem here?

11. Is this found by scanners?
/login.php?username=admin&password[$ne]=asdfg
array("username" => "admin""password" => array(”$ne" => "asdfg"));
Usually scanners don’t know NoSQL. And if they know, they are usually not
that smart
ProTIP: instead of asdfg, use a long complex password so you can be sure
this is not the correct password ;)
Try this challenge here:
https://platform.avatao.com/challenges/28f5fca5-6a01-11e6-bdf4-
0800200c9a66

12. Automated scanners continued
Informational issue (not high, medium, low severity)
“An unknown service is running on TCP port 4444”
What do you do?

13. Automated scanners continued

14. Sample request:
/code.php?src=code.php&hl[0]=nice&hl[1]=text&mode=hl

15. Solution
Bypass whitelist by change order of parameters:
/php0816/code.php?hl[0]=nice&hl[1]=text&mode=hl
&src=solution.php
Try it here:
http://www.wechall.net/challenge/php0816/index.p
hp

16. Conclusion
Use a good tool for boring, repetitive tasks
And use your brain for creative hacks
And always develop new tools for new problems 

17. Hack the planet!
zoltan.balazs@mrg-effitas.com
https://hu.linkedin.com/in/zbalazs
Twitter – @zh4ck
www.slideshare.net/bz98
Check out avatao.com to practice issues like this
Hackersuli meetup!!!!!!!!!!!!!
Greetz to @CrySySLab, @SpamAndHex
JumpESPJump.blogspot.com