ChatOps, a concept originating from Github, is chatroom-driven DevOps for distributed teams, using chatbots (like Hubot) to execute custom scripts and plugins. We have applied the concept of ChatOps to the penetration testing workflow, and found that it fits outstandingly – for everything from routine scanning to spearphishing to pentest gamification. This talk discusses the tools that we use (RocketChat, Hubot, Gitlab, pentesting tools), and provides battle stories of using Pentesting ChatOps in practice.

1. Dr. Melanie Rieback
May 17, 2017 melanie@radical.sexy
Pentesting ChatOps

2. May 17, 2017
When hackers grow up...

3. May 17, 2017
What is ChatOps?

4. May 17, 2017
Pentesting ChatOps

5. May 17, 2017
XML Pentest Report Automation

6. May 17, 2017
XML Pentest Report Automation(2)

7. May 17, 2017
XML Pentest Report Automation(3)

8. May 17, 2017
Pentesting ChatOps(2)

9. May 17, 2017
Pentesting ChatOps(3)

10. May 17, 2017
Passive Vulnerability Scanning

11. May 17, 2017
Red/Blue Pentesting

12. May 17, 2017
But WAIT.. there's more!!!!
● Scanning + Exploitation:
– Nmap, w3af, sqlmap,
hydra, etc..
● Reconnaissance:
– Whois, Google,
PassiveScan, etc..
● Exploitation:
– Hash cracking,
Spearphishing, etc..

13. May 17, 2017
Security Consultancy
as a “DevOps Shop”
● Project
management:
– Kanboard, Gitnotes,
Charge, etc..
● Infra/automation:
– RBAC, error logs,
help menu, etc..
● The Future: AI
chatbots?

14. May 17, 2017
Awards and Recognition
Dutch Chamber of Commerce (KvK):
ROS is 50th
Most Innovative SME 2016

15. May 17, 2017
Awards and Recognition
CIO Magazine: Most Innovative Leader 2017

16. May 17, 2017 melanie@radical.sexy
Questions?