(SACON) Nilanjan, Jitendra chauhan & Abhisek Datta - How does an attacker know everything about your organization? - Know the Unknowns
•
0 likes•390 views
It is possible to create a comprehensive attack surface of any organizations just with open data available on the public internet It is possible to search vulnerable targets and compromise the targets. The organizations can be compromised without any RCE vulnerability. It is possible to create inhouse team to continuously monitor your attack surface and fix flaws before attackers find them.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to (SACON) Nilanjan, Jitendra chauhan & Abhisek Datta - How does an attacker know everything about your organization? - Know the Unknowns
Similar to (SACON) Nilanjan, Jitendra chauhan & Abhisek Datta - How does an attacker know everything about your organization? - Know the Unknowns (20)
More from Priyanka Aash
More from Priyanka Aash (20)
Recently uploaded
Recently uploaded (20)
(SACON) Nilanjan, Jitendra chauhan & Abhisek Datta - How does an attacker know everything about your organization? - Know the Unknowns
- 1. Attacker Techniques Using Open Source Intelligence and Data Abhisek Datta Head, Security Products @ Appsecco
- 3. Attackers Attack What They See
- 4. Let's start with how attackers work An attacker wants to hack a target and for this, will perform a bunch of activities 1. Online Attack Surfaces 2. Breached Credentials 3. Known Vulnerable Software 4. (Easy to?) exploit security vulnerabilities
- 5. Asset Discovery From Attacker’s Perspective
- 7. • Your-Company.com • Who is the registrar • Where is it hosted • Self-hosted or managed e-mail service • External help desk services • 3rd party services What Attackers See – Domain Enumeration whois whois your-company.com whois <IP> dig dig your-company.com NS dig @NS1 your-company.com MX dig @NS1 your-company.com TXT
- 8. What Attackers See – Subdomain Enumeration • Your-Company.com • Host-1 • Host-2 • Host-3 • Etc. amass enum –passive –d your-company.com amass intel –whois –d your-company.com
- 9. What Attackers See – Email Enumeration • Your-Company.com • u1@your-company.com • u2@your-company.com • u3@your-company.com • u4@your-company.com • Etc. Hunter.io theHarvester Many more …
- 10. What Attackers See – Breached Credentials
- 11. • haveibeenpwned.com • hacked-email.com • etc. What Attackers See – Breached Credentials
- 12. What Attackers See – Application Discovery • Your-Company.com • http://app1.your-company.com • http://app2.your-company.com • Etc. nmap –p 80,443,8080 -sV -A –iL hosts.txt
- 13. What Attackers See – Technology Discovery • Your-Company.com • App1 – Java/JavaEE • App2 – NodeJS, AngularJS • App3 – PHP • Etc. Wappalyzer npm i -g wappalyzer wappalyzer https://app1.your- company.com
- 14. Domain External Services Help Desk Mailers Email Breached Credentials Hosts Apps Technologies What Attackers See – Putting it all Together Unpatched Services App VulnerabilitiesCredential Spraying Ticket Trick Credential Spraying
- 15. Real-life Breaches Leveraging Internet Exposure Discovery Techniques
- 16. Invoice Fraud
- 17. Publicly Accessible Cloud Storage Buckets
- 18. Sub-domain Take Over Static site hosted on S3 and then forgot about it :)
- 20. Cloud Account Take Over
- 21. Automation at Scale Using Docker, Kubernetes and Cloud Native Technologies
- 22. An Example AppSec Workflow Domain Hosts Subdomain Enumeration CIDRASN Search DNS SPF, MX etc. Port and Service Scanning URLs Technologies Cloud Infrastructure Emails Public Breach DB Query Password Spraying Application Security Scan
- 23. Data Collection Analysis Inference Further Actions How does it look like from Automation Perspective? Security Tools Human + Learning Systems Human + Learning Systems Feedback Loop
- 25. Driving the System – Events FTW! API Service HTTP POST NATS Write to NATS Message Queue Scanners (Client) Minio Object Storage Persist Output Output Analysis and Feedback Alerting and Notification Tool Output Event
- 26. • 3rd Party Tools are not in our control • We need to be able to • Receive input from NATS • Run tool with tool specific command line • Receive output or check for error • Persist output to Minio The Tool Adapter (Pattern)
- 27. 1. Package 3rd party tools as Docker containers 2. Add Tool Adapter binary and set as entrypoint 3. Write Kubernetes deployment spec (YAML) 4. Deploy to Kubernetes 5. Write YAML rules for Feedback Processing Adding a Security Tool (3rd Party)
- 29. Security Tool Kubernetes Spec (YAML)
- 30. Match Transform Take Action Feedback Processor (Driving the System)
- 31. Feedback Processor - Example
- 32. • State management is difficult due to asynchronous nature of the system • NATS connection issue with preemptible nodes on GKE • Capacity planning and analysis • Cost analysis Challenges, Constraints and Things to do
- 33. How to Contribute 1. Clone the repository from Github 2. Try out and report bugs 3. Add new security tools 4. Add feedback processor rules 5. Submit PR github.com/appsecco/kubeseco
- 34. Questions? abhisek@appsecco.com That’s all for now.. https://appsecco.com @abh1sek github.com/abhisek github.com/appsecco/kubeseco