BlackHat and Defcon Talks to look forward to (and why)

Some talks are being presented at both. 

BlackHat: 

Must See:

Breaking the Laws of Robotics: Attacking Industrial Robots

Practical attacks against industrial robots with real hard data? Sign me on

 

Don't Trust the DOM: Bypassing XSS Mitigations via Script Gadgets

For making me think deeply

 

Escalating Insider Threats Using VMware's API

Could be useful when encountering VMware products on the network, once potential for other low-hanging fruit has been exhausted

 

Exploiting Network Printers

Following in the vein of previous publications

 

Fighting the Previous War (aka: Attacking and Defending in the Era of the Cloud)

I had an engagement where Google products were used almost exclusively, e.g. GMail, Docs, Drive. This meant: most communication was via HTTPS; there was limited chatter visible just by plugging in; and no AD environment, no Outlook, etc. Short of ARP spoofing on a limited segment, I ran out of ideas.

 

Ichthyology: Phishing as a Science

I want to learn more about phishing.

Practical Tips for Defending Web Applications in the Age of DevOps

Yup, dynamic analysis just doesn't cut it when the focus is on integrating security earlier into the SDLC. See also SecDevOps

The Industrial Revolution of Lateral Movement

I'd like to know how this is presented (industrial revolution?)

They're Coming for Your Tools: Exploiting Design Flaws for Active Intrusion Prevention

You can never stay in one spot, relying on a few tools. Even in the glacial world of enterprise security, NBNS/LLMNR will stop working eventually.

Why Most Cyber Security Training Fails and What We Can Do About it

Introduces a framework for comparing cyber security training. Useful for anyone in a corporate environment where testing against frameworks and standards is a trusted baseline.

For Fun:

Tracking Ransomware End to End

Ties into phishing. Big picture of ransomware should be great as a high- and low- level overview.

 

What's on the Wireless? Automating RF Signal Identification

Anything from Michael Ossmann is a must-see.

 

Splunking Dark Tools - A Pentesters Guide to Pwnage Visualization
I'd like to see how the presenters deal with large quantities of data, having encountered increasing amounts of files and logs with each engagement, and not just as a CYA measure.

The Active Directory Botnet
AD and botnets are unfamiliar territory. 

Defcon: https://www.defcon.org/html/defcon-25/dc-25-speakers.html

(P.S. Check out the bios of the EFF panel speakers, intensely qualified each and every one)

Must See:

Game of Drones: Putting the Emerging "Drone Defense" Market to the Test 

Last year's presentation is fantastic, this year should be great ( a new DangerDrone???)

Introducing HUNT: Data Driven Web Hacking & Manual Testing

Another burp plugin, to make my life easier? Yes please

I Know What You Are by the Smell of Your Wifi

Can I find more vulnerabilities with it?

D0 No H4RM: A Healthcare Security Conversation (Panel)

Medical industry security is a hot topic. I've had one engagement in the industry and the mindset of health-care professionals is one to come to grips with before you start working.

Radio Exploitation 101: Characterizing, Contextualizing, and Applying Wireless Attack Methods

101 indeed.

Dark Data

 

Wiping out CSRF

CSRF has always been a weak point for me.

Game of Chromes: Owning the Web with Zombie Chrome Extensions

Owning stuff with new attack vectors? Yes please

A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!

I click blindly on anything that has SSRF in it.

There's no place like 127.0.0.1 - Achieving reliable DNS rebinding in modern browsers

Could be dry, or not

For Fun: 

Popping a Smart Gun

 

Hacking travel routers like it's 1999

Given my habit of using a PirateBox on the plane, this could be fun.

Breaking Wind: Adventures in Hacking Wind Farm Control Networks

One of several presentations at either Defcon or Blackhat about hacking esoteric ICS stuff (there's another one about vulnerabilities in radiation monitoring devices).  

Little work interlude

Monday night I flew to LA. Tuesday evening I flew to Detroit, arriving early Wednesday morning. Wednesday I'm spending onsite, and this evening if TS Cindy doesn't delay the flight Houston will be all around me again. Very busy, and there wasn't much sleep to be had on the plane from LA. On the plus side I've seen some impressive oil&gas structures, unbelievably complex piping and all.

Remember, it's GPX files that you need to format in SublimeText, because it has the best alignment of times to latitude/longitude items.

Exciting upcoming BlackHat talk

James Kettle of PortSwigger will talk about bug bounties for DoD and back-end web services:

https://www.darkreading.com/threat-intelligence/major-websites-vulnerable-to-their-own-back-end-servers/d/d-id/1329166

https://www.blackhat.com/us-17/briefings/schedule/#cracking-the-lens-targeting-https-hidden-attack-surface-6387

EyeWitness is an invaluable tool that takes nmap results and scans/screenshots web services found in those results. Since integrating it into my pentests it's come in handy to report services that have HTTP content of some sort exposed internally.  It's intriguing to see how much content is available, and how often it uses default passwords. The next step in my testing will be to learn how to increase the severity of other issues by changing settings through the web interfaces.

Parsing .Nessus Files Part 2

A short update on improving Melcara's parse_nessus perl script:

My primary issue with the original, which took the most time, was sorting outputted IP addresses in the "Vulnerability to IP summary" sheet. A couple hours of investigation found that sorting those in the perl script was easier said than done.

my $ip = join "\n", keys %{$ip_vuln_data{$file}->{$sev}->{$plugin}->{ip}};e>

That's the line that creates a scalar string of IPs, separated by (invisible) newlines in the Excel cells. Turns out you can't easily sort that string. You might ask, ok, how about $ip_vuln_data:

# store data in the %ip_vuln_data hash
        $ip_vuln_data{$host->{file}}->{$h_report->{-severity}}->{$h_report->{-pluginID}}->{pluginName} = $h_report->{-pluginName};
        if ($host->{'host-ip'} eq "") {$ip_vuln_data{$host->{file}}->{$h_report->{-severity}}->{$h_report->{-pluginID}}->{ip}->{$host->{'name'}}++;}
        else{$ip_vuln_data{$host->{file}}->{$h_report->{-severity}}->{$h_report->{-pluginID}}->{ip}->{$host->{'host-ip'}}++;}
     

Looks like it's searching a $h_report string to create a 'name','host-ip' hash (forgive my phrasing, Perl is not native tongue).

What if we go even earlier in the process? How does it get the string data?

Somewhere in here, it's parsing the .Nessus file. Later I realized that you can't control the order of IP addresses in the export of the .nessus file from Nessus, so it was back to the original location.

Then I found a solution here, and adjusted it thus:

                #convert unsorted string to array  
                my @ip2 = split("\n",$ip);
                #print @ip2;

                my @sorted_ips =
                    map  { $_->[0] }
                    sort { $a->[1] <=> $b->[1] }
                    map  { [ $_, eval { Net::IP->new( $_ )->intip } ] }
                    @ip2;

                #convert back to newline-seperated string
                my $ip2 = join "\n", @sorted_ips;


Now, the contents of the cells is invisibly new-line separated, and in order. Now to pack it into a new executable:

pp -M JSON -M PAR::Dist -M URI::Escape -M LWP::UserAgent -M HTTP::Cookies -M Data::Dump -M Data::Dumper -M XML::Hash::XS -M XML::TreePP -M MIME::Base64 -M Math::Round -M Excel::Writer::XLSX  -M Excel::Writer::XLSX::Chart -M Excel::Writer::XLSX::Chart::Pie -M Data::Table -M Getopt::Std -M Net::IP parse_nessus_xml.v22.pl

And we are good to go! Get it here.

Next steps: Add the ability to merge Nessus files to this script.

Update 5-22-18: I'm adjusting the original post to help anyone who's actually trying to re-create this.

To get this to work:

1. Add "use Net::IP" at the top of the perl file.
2. Where the original file has:
my $ip = join ";", keys %{$ip_vuln_data{$file}->{$sev}->{$plugin}->{ip}};

mine has the following (changes in bold):

         my $ip = join "\n", keys %{$ip_vuln_data{$file}->{$sev}->{$plugin}->{ip}};  
         #convert unsorted string to array  
         my @ip2 = split("\n",$ip);  
         my @sorted_ips =  
           map { $_->[0] }  
           sort { $a->[1] <=> $b->[1] }  
           map { [ $_, eval { Net::IP->new( $_ )->intip } ] }  
           @ip2;  
         print @sorted_ips;  
         #convert back to newline-seperated string  
         my $ip2 = join "\n", @sorted_ips;  
         my $ip_cnt = keys %{$ip_vuln_data{$file}->{$sev}->{$plugin}->{ip}};  
         $ip_vuln_data_worksheet->write($ip_vuln_data_ctr, 0, $file,$cell_format);  
         $ip_vuln_data_worksheet->write($ip_vuln_data_ctr, 1, $severity,$cell_format);  
         $ip_vuln_data_worksheet->write($ip_vuln_data_ctr, 2, $plugin,$cell_format);  
         $ip_vuln_data_worksheet->write($ip_vuln_data_ctr, 3, $ip_vuln_data{$file}->{$sev}->{$plugin}->{pluginName},$cell_format);  
         $ip_vuln_data_worksheet->write($ip_vuln_data_ctr, 4, $ip_cnt,$cell_format);  
         $ip_vuln_data_worksheet->write($ip_vuln_data_ctr, 5, $ip2,$cell_format);  
         ++$ip_vuln_data_ctr;  
       }  

For reference, here is the perl file with my additional formatting changes.

So many Projects to do!

Here's an incomplete list of all my projects, planned and desired, at least for brain-dump purposes. Some of this is from a year ago.

Older:

Try to get PluginDetect working on old versions of IE/firefox

*           Figure out reverse DNS for rubber ducky

*           Set up a web-app pentest system – outline, pictures, file structure – in progress

*           Social Engineering Toolkit

*           Play with Metasploit on Metasploitable 2

*           Learn to firewall

*           Wireshark Packet analysis

*           Play with tshark

*           OpenStack

*           Play with Word Macros for Social Engineering

*           iptables

*             Arachni web scanner

*             Nikto Scanner

*             Last four blog posts on Burp Suite suite – cool XSS and exploits to research

*             BH & Defcon videos on application security – last few years

Newer:

CapAnalysis
Replace Linksys Router with Edgerouter X
COnfigure a pfsense firewall to actually do things on my network
Build a DMZ as a branch from primary router first, then later move to edge and internal firewall configuration
Monitor network traffic live?
Learn PHP to be able to build a web page to automatically download and save Youtube audio to my plex server.
Keep working on a script to display Tor Relay traffic in color on a Pimoroni
Figure out IPTables
Get good at Wireshark
Set up DVWA and play with Arachni at it, also dirbrute.
Keep working on DVWS. 
CTF VMs.
Find an alternative to Lubuntu - it's great but not ideal.
Read "The Tangled Web"
Automate everything heheh.
Sit down and figure out munin-plugins to customize Munin display
Get Tor Relay into Munin

 Edit: Scripts for Nessus output, scripts for nmap, scripts for everything....