Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

So You Want To Be A Breaker, Part 1: Web Security

daeken.com

Post reply on HN
Print view View original

11–20 of 86 posts

Re: So You Want To Be A Breaker, Part 1: Web Security

#11

Post by jcr »

tptacek wrote: post #3
tptacek wrote: post #2

If this stuff fascinates you and you're a solid software developer and you'd be interested in having this be your full-time job for awhile and you're willing to sink a little bit of your own time into ramping up, give us a ping. We'll help you get there. This page has a lot of info on how we recruit. We're getting pretty good at turning systems programmers into breakers, and we love hiring from HN: http://www.matasan…

Oh, hey! And if you'd like to learn to break crypto at the same time as you work through Cody's web recommendations --- even if you don't want to be an appsec person --- mail sean at matasano dot com. He's got a pretty kick-ass set of ~40 crypto-breaking exercises. Something like 200 people have started them over the past 6 months; only a few people have made it through the end. (They aren't deliberately hard; they j…

As one of the 200 incompletes mentioned, I gotta say Sean Devlin at Matasano is top notch. The puzzles are fun, possibly too much fun. It's easy to wander off into the weeds and spend a lot of time thinking through and testing the non-puzzle implications. I hope to get through the puzzles eventually, but I'm terribly slow and it will take me a very long time. Even if you're a sec-idiot like me, the puzzles are a wonderful way to spend time learning.

Re: So You Want To Be A Breaker, Part 1: Web Security

#12

Post by tptacek »

jcr wrote: post #11
tptacek wrote: post #3

Earlier quoted context omitted.

Oh, hey! And if you'd like to learn to break crypto at the same time as you work through Cody's web recommendations --- even if you don't want to be an appsec person --- mail sean at matasano dot com. He's got a pretty kick-ass set of ~40 crypto-breaking exercises. Something like 200 people have started them over the past 6 months; only a few people have made it through the end. (They aren't deliberately hard; they j…

As one of the 200 incompletes mentioned, I gotta say Sean Devlin at Matasano is top notch. The puzzles are fun, possibly too much fun. It's easy to wander off into the weeds and spend a lot of time thinking through and testing the non-puzzle implications. I hope to get through the puzzles eventually, but I'm terribly slow and it will take me a very long time. Even if you're a sec-idiot like me, the puzzles are a wond…

\o/

Re: So You Want To Be A Breaker, Part 1: Web Security

#13

Post by recuter »

tptacek wrote: post #3
tptacek wrote: post #2

If this stuff fascinates you and you're a solid software developer and you'd be interested in having this be your full-time job for awhile and you're willing to sink a little bit of your own time into ramping up, give us a ping. We'll help you get there. This page has a lot of info on how we recruit. We're getting pretty good at turning systems programmers into breakers, and we love hiring from HN: http://www.matasan…

Oh, hey! And if you'd like to learn to break crypto at the same time as you work through Cody's web recommendations --- even if you don't want to be an appsec person --- mail sean at matasano dot com. He's got a pretty kick-ass set of ~40 crypto-breaking exercises. Something like 200 people have started them over the past 6 months; only a few people have made it through the end. (They aren't deliberately hard; they j…

Sigh. And there goes my productivity. :)

Re: So You Want To Be A Breaker, Part 1: Web Security

#15

Post by tptacek »

passfree wrote: post #14

Or you can forget this java madness and go with Websecurify Suite ( https://suite.websecurify.com ). It works from the browser and it is a lot faster.

I tried to see what this was and kept getting asked to sign into Google; I saw a page that mentioned "Subscriptions" and "Google Wallet", and thought to myself, "this is probably not going to talk me out of Burp Suite".

I don't like Java applications any more than you do, but it happens that the best web testing application is built in Java; I'm not going to not use it out of pique.

Re: So You Want To Be A Breaker, Part 1: Web Security

#16

Post by recuter »

tptacek wrote: post #9
daeken wrote: post #8

Earlier quoted context omitted.

Huh, yeah, I've never seen anyone use intruder like that. I might use it once every other engagement, whereas I use repeater 24/7.

Also, if I'm justifying Burp to a non-security person, part of the reason why is that Intruder would allow me to do all sorts of wacky integration and stress tests without having to write fiddley code. A rule-based request generator is a pretty useful tool for the box.

So kind of like a magic 8 ball variant of ab? You know I'm rather surprised there aren't more open source tools like Burp and that it is so expensive.

Re: So You Want To Be A Breaker, Part 1: Web Security

#17

Post by Slimbo »

This guide is exactly what I've been looking for, thanks Cody. Been on the receiving end of some very talented pentesters, and really want to learn more about how on earth they find the things they do.

Want to make sure I catch your future editions, do you have anything I can sign up for notification? Can't find an RSS feed on your blog.

Re: So You Want To Be A Breaker, Part 1: Web Security

#18

Post by tptacek »

recuter wrote: post #16
tptacek wrote: post #9

Earlier quoted context omitted.

Also, if I'm justifying Burp to a non-security person, part of the reason why is that Intruder would allow me to do all sorts of wacky integration and stress tests without having to write fiddley code. A rule-based request generator is a pretty useful tool for the box.

So kind of like a magic 8 ball variant of ab? You know I'm rather surprised there aren't more open source tools like Burp and that it is so expensive.

You could use it to benchmark (it might be useful for that in cases where what you were benchmarking wasn't raw request handling speed, or the performance of simple SQL queries, but rather some backend event that would only be tickled by a particular pattern of requests), but the real thing it does that I think ab doesn't do is collect all the responses and allow you to compare them.

(It's actually not great at doing those comparisons, but I don't have a better alternative).

Burp costs money, but it costs so little money relative to its value that if you think it's expensive, I'm going to suggest you're doing something wrong with your bill rate.

Re: So You Want To Be A Breaker, Part 1: Web Security

#19

Post by daeken »

Slimbo wrote: post #17

This guide is exactly what I've been looking for, thanks Cody. Been on the receiving end of some very talented pentesters, and really want to learn more about how on earth they find the things they do. Want to make sure I catch your future editions, do you have anything I can sign up for notification? Can't find an RSS feed on your blog.

I'm probably going to set up a mailing list soon, but if you drop me an email at cody.brocious@gmail.com I'll make sure to let you know when I put out the others. Glad you found it useful!

Oh, also, follow me on twitter, as I'll certainly link it there. https://twitter.com/daeken

Re: So You Want To Be A Breaker, Part 1: Web Security

#20

Post by daeken »

tptacek wrote: post #18
recuter wrote: post #16

Earlier quoted context omitted.

So kind of like a magic 8 ball variant of ab? You know I'm rather surprised there aren't more open source tools like Burp and that it is so expensive.

You could use it to benchmark (it might be useful for that in cases where what you were benchmarking wasn't raw request handling speed, or the performance of simple SQL queries, but rather some backend event that would only be tickled by a particular pattern of requests), but the real thing it does that I think ab doesn't do is collect all the responses and allow you to compare them. (It's actually not great at doing…

> Burp costs money, but it costs so little money relative to its value that if you think it's expensive, I'm going to suggest you're doing something wrong with your bill rate.

Couldn't agree enough. Even if this is something you do as a hobby, Burp will more than pay for itself in a single bug bounty payout.

Post reply on HN