2015. I really appreciate everyone being here he's way

smarter than me this is me I work for bug crowd I'm director

-- I manage a team of hackers behind the scenes by bounty can

you write the program. In 2014 I participated as a researcher.

This talk is about my mend I use to do web hack king as well as

stuff I learned from other researchers while doing this

work. What is this really about. It's just -- I put a lot of --

my wife says it's okay. So more specifically what I did I

started off with my mend which is a pen tester mend when I

started doing this, application assessment. And so, I then went

out manually parse d out all of the public researchers of all

the badasses bug hunter I new about a hundred visit -- -- as

well as people I new were good at it I went through ever

article from the beginning of the crowd source bug bounty seen

and also all of the Google and Facebook plans inter Bryce -- I

created a presentation what I disstilled around that

knowledge. This is kind of the stuff I'm going to bring in this

presentation. Bug bounty testing from web -- discovery

techniques, parameters often a tack useful fuzz strings, by

pacer filter and some too long I think is cooler than other too

long. Cool. So the first sections philosophy. So the

differences between kind of bug bounty hunting and being a web

pen test templet both sides and they are both right but when you

get down to the practical work you introduce a lot of stuff

here, up under dues time ton to a security tester they are not

use to exesion when you are doing this kind of stuff unless

you are playing in CTF I played in CFF's I was kind of used to

it. You are only -- for what you find and not the hours you put

in, so, I mean this is a basic overview of how they differ the

talk is more about the technical stuff. Yeah, you basically

tailor method based around finding stuff in 20 percent as

opposed top 80 percent application assessment we'll go

into how that 80/20 rule kind of fits in the rest of the slides.

So if you are doing regular web app assess. -- this is usually

what you are trained from and what your internal method is

built off mostly any of the good consultants use and authors are

you know super great testers, right but these take from you A

to Z and you even though them find good bugs they take a long

time to complete in full scale. So bug bounties are different if

you want to do web hack and these are what you go for my

talk as little bit different. Let's talk about discovery in

web application assessment for a bounty. What you want to do is

basically find the road less traveled if you are aiming to

get paid I think so, you can a tack the flag ship application

that the company has, right. That's not where the

vulnerability is going to be that application has been tested

by a pen test team probably had a bug bounty on it for a long

time. Was really want to find part of the -- maybe has been

secure web servers on different ports. You what about to find

acquisition maybe the company had recently that came from a

different development team and they might have a whole view of

problems that came from a whole different group. You want to

look at functional will the changes and redesigns on sites.

Mobile websites because you are set to renter differently on

your phone. And also a new mobile app version when you are

testing. We are going to go into tools and stuff I used to find

for you to a tack. So recouldn't MG is this tool that a lose to

you do -- one part has all these modules to do subdomain

discovery. Now subdomain discovery is a big part of

finding application left out there marketing spins up a

sight, -- DEF -- finding those and hacking those code execution

through those sites is kind of where you can get big pay

outside. So this script what it does is it scrapes Google for

all -- given web property so let's say Acme.com this will --

for everything that is in ACME and remove those result until

you are down to this long list of subdomains. Also scrapes

being -- net craft, subdomains like common fires tool would

this is on get had you been wrap around reCON installed if to you

use -- you can pop the script in and go. Yes, so this is the

output of something like that against the company like this.

You can see -- probably a lot of domains here that have gone

under assessed as far as you go, so, -- this is that idea of it

rating through Google to find subdomains here you have sight

then minus dub dub dub sites I found on its first hit sand box

I removed that this is the scraping that the cool -- tool

-- is doing. You get credit plier, business or shopping or

advertising and you just keep on removing these until you have

all of them. Then you -- then you end up with a huge list of

sites to assess. Then you want to go through and on your entity

that you are attacking you want to find mergers or acquisition

that may be on -- they just purchased accompany, purchased

by Facebook they got popped as soon as they were a choired they

were not under Facebook six month rule I don't know if it's

six month I can't remember how long. But yeah they got popped

immediate until was a whole different DEF team. They got hit

with injection and custom header that was great well not great

but it was good for the bounty hunter. Wikipedia, update these

things for stock reasons so keep an eye on these if you are --

your company has to purchase something else they have new

domain may not be in the bug about tea -- there's also a

repository of links of ever kind of -- that's comes out on pay

pal and Googled. This one is post -- hosted and Facebook I

have no idea its linked it has everything high percent linked

these are the blog articles. Why is this important if somebody

already found these bugs. Because, bugs get represented

across the domain In different places. So you can tell a lot

about an organization once you read these articles and find the

same bug in other locations like the subdomains may be rogue --

how they filter out input you get a lot of in tell around the

application, so, you no really doing a lot of research on your

target can help but it's not the fast stuff so so port scanning I

mentioned port scanning, it's not just for net pen, so, yeah,

I mean how I hacked Facebook there was an article by Ryan I

started out port scanning found a weird server he got in --

simple as that 8,000 dollar bug right or even more I don't

remember. So, I asked do the net the Microsoft domain that you

know -- that already opened to the world with MS12 zero 20 on

it vulnerable so that was a thing. Go ahead and use simple

map syntax to start port standing all of your sites make

sure you check all those services this syntax will port

scan for all ports on a domain as well as pull out any HTTP

servers and display those it's a sin scan and OS -- so. So

mapping so you found all of these new servers right like

maybe subdomains or maybe you found an acquisition and

something like that now you want to move you want to move into

mapping an individual application, so, and take and

notes is really important when you are doing this whether

inside of like note pad or you know just using pen and paper

like I use ever note all my bugs or in Temples I can copy and

paste disclosure E-mail. So these are mapping tips that I

use right away. Google is actually your friend you can get

a lot of information -- I know there's parameter par sink

scripts I couldn't find a good one for this presentation you

know just parse parameters out of the Google like catch stuff

but really the next big thing is directory reinforcing finding

unlinked content content that's not supposed to be there. A lot

of beam use content discovery for this kind of thing that's

good they are good list but those list were created by going

out spider the internet and then prioritizing them. There's some

other lifts that are better for this type of work, so, the list

or these list that came out of talk maybe four or five years

ago raft was application proxy it was a decent one but since

been discontinued its list for directory reinforcing has lived

on. They are a spider of the internet robot do the text files

everything that everybody doesn't want you to see is in

this directory group forcing list super sick I can't tell you

how many bugs I found just using this list like couldn't figure

files all over the place. There's another list like this

they went out and spider all the project if your sight or target

is open source place you can take all the paths have have

been -- get application or find config files. So after you do

some unlink content discovery or directory re-- you can try to

identify platform. So, there's just some really simple wins

here -- you can alcoholic and looking at the heeders the

comments in the pages analytic things that have been integrated

they will give you the whole server stack they will give you

version numbers if they can identify them. Retire do the JS

one of my new favorite it will profile all of the server side

Java script -- as well as give you all the vul never viability

before that patch or your vulnerable -- list of prioritize

process script tig. Once you identify all of these server

version numbers check nor CVE and server type stuff that's

standard that's web stuff. But these are good -- tools. Have

you happen tho come across SMS you want to use these two tools

curative scan for word compress a lot of people use this

already. It will identify all plug ins and users for word

compress install as well as look up any bones that are associated

with those plug ins that have been disclosed. And then SMS map

for -- and what is the other SMS -- so those are the two that

have really yielded any value for me across SMS. You see a

screen shot of curative scan. And its you know found aversion

of a plug in or theme that has a file -- sometimes there's false

positives honestly for what this script does it provides so much

value so its great. So the directory we talked about a

little bit earlier the work flow for this a lot of people do I

just put this slide in here because I see a lot of people do

it a little bit weird I see people -- off the top level path

a lot and then just stop right they'll get errors don't know

what to do with it they'll go to Acme.com and go to 200, 404, and

more 404 you know there's nothing there then they'll hit

control panel and see 401 I can't do anything I'm not

authorized right so they -- after control panel there's so

many like messed up access control on web server bugs you

can explicit if you route -- I just see this a lot where people

stop after the top level domain that's kind of the work flow you

are doing there. Some other things that you can do is

mapping and bone discovery using open source intelligence. Five

sites six methods that you can use to find already publish bugs

or almost all right public bugs I guess they are considered --

or whatever access .com, punk spider a burden of proof engine

that scans the internet if your car get is a high profile sight

information might all right be in here you can pull it out and

use it to your van tach. Even if those bugs have already been

disclosed. I found bugs on here not dis-- that's actually worked

before it was like a super easy win. Help you get a feeling for

what the company has faced before as far as prevalent

across side -- file up loads and then you can do regression

testing on all the domains up found earlier in the

presentation. Go out and use these resources to try and find

bugs in the platter form as quickly as possible they are

free and out L the customer should know about them any way

its the responsible thing to do. Okay. So this is my intern Ben,

he's never spoken before at DEF CON neither have I this is my

first speaking but he did an awesome project and he's going

to talk about it for a couple seconds I really like it so. >>

[Applause] >> So hello everyone my name is Ben. I'm on Jason's

team. For the past couple months we actually gathered a bunch of

files that includes all the date to for each Bugs Bunny program

that's out there 200 visit plus programs that are included in

this project they include how much a minimum is how much a

maximum is, what's not included in the scope of the program as

well. We use all this data and fed it into different scripts

like CC on -- it just went through every single one of