Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

So You Want To Be A Breaker, Part 1: Web Security

daeken.com

Post reply on HN
Print view View original

21–30 of 86 posts

Re: So You Want To Be A Breaker, Part 1: Web Security

#21

Post by nbpoole »

tptacek wrote: post #5
daeken wrote: post #4

Earlier quoted context omitted.

> Also: I understand why Cody didn't write it this way, but the reality is, if you're going to test web apps, Burp is the standard tool. You can use things like mitmproxy or even WebScarab, but most people end up in Burp. Burp is also extremely valuable for testing even if you're not doing appsec full-time. I actually forgot to update that -- it was on my list of edits. Done now, thanks!

I feel like I could justify the expense of Burp for a random freelance developer, even if they weren't billing out as a security tester. Like, I feel like we could convince Patrick McKenzie that it was worth his money. What do you think?

Ex-Matasano chiming in! ;-)

I've been demonstrating web app security topics for the Intro to Security course at Brown University this semester. I've used Burp almost exclusively. I've even had the students use the free version of Burp for labs. I don't know that the functionality / price tradeoff would make sense for them even if they were full time freelancers: they use Repeater and Proxy more than any other tools.

That being said, any time someone complains about it being too expensive I point out that a single vulnerability found as part of a security bug bounty program (ie: Google, Facebook, Mozilla, etc) nets you more than the cost of a license.

Re: So You Want To Be A Breaker, Part 1: Web Security

#22

Post by switch33 »

tptacek wrote: post #12
jcr wrote: post #11

Earlier quoted context omitted.

As one of the 200 incompletes mentioned, I gotta say Sean Devlin at Matasano is top notch. The puzzles are fun, possibly too much fun. It's easy to wander off into the weeds and spend a lot of time thinking through and testing the non-puzzle implications. I hope to get through the puzzles eventually, but I'm terribly slow and it will take me a very long time. Even if you're a sec-idiot like me, the puzzles are a wond…

\o/

Any idea why he's doing this stuff only primarily by e-mail? It'd be great if this stuff was online like in a blog or whatnot.

I'd like to take the time and look over the crypto challenges.

Re: So You Want To Be A Breaker, Part 1: Web Security

#23

Post by nbpoole »

tptacek wrote: post #15
passfree wrote: post #14

Or you can forget this java madness and go with Websecurify Suite ( https://suite.websecurify.com ). It works from the browser and it is a lot faster.

I tried to see what this was and kept getting asked to sign into Google; I saw a page that mentioned "Subscriptions" and "Google Wallet", and thought to myself, "this is probably not going to talk me out of Burp Suite". I don't like Java applications any more than you do, but it happens that the best web testing application is built in Java; I'm not going to not use it out of pique.

Hmm, a majority of passfree's account's submissions (20/25) appear to be for websecurify.com. Combined with the dismissal of Burp as "java madness," seems like a socketpuppet on behalf of the company.

Re: So You Want To Be A Breaker, Part 1: Web Security

#24

Post by daeken »

nbpoole wrote: post #23
tptacek wrote: post #15

Earlier quoted context omitted.

I tried to see what this was and kept getting asked to sign into Google; I saw a page that mentioned "Subscriptions" and "Google Wallet", and thought to myself, "this is probably not going to talk me out of Burp Suite". I don't like Java applications any more than you do, but it happens that the best web testing application is built in Java; I'm not going to not use it out of pique.

Hmm, a majority of passfree's account's submissions (20/25) appear to be for websecurify.com. Combined with the dismissal of Burp as "java madness," seems like a socketpuppet on behalf of the company.

Every one of them is either about it or a link to the site itself.

Re: So You Want To Be A Breaker, Part 1: Web Security

#25

Post by recuter »

recuter wrote: post #16
tptacek wrote: post #9

Earlier quoted context omitted.

Also, if I'm justifying Burp to a non-security person, part of the reason why is that Intruder would allow me to do all sorts of wacky integration and stress tests without having to write fiddley code. A rule-based request generator is a pretty useful tool for the box.

So kind of like a magic 8 ball variant of ab? You know I'm rather surprised there aren't more open source tools like Burp and that it is so expensive.

I meant expensive for somebody who is new to the topic and just wants to play with it. Its an inertia thing.

Re: So You Want To Be A Breaker, Part 1: Web Security

#26

Post by tptacek »

switch33 wrote: post #22
tptacek wrote: post #12

Earlier quoted context omitted.

\o/

Any idea why he's doing this stuff only primarily by e-mail? It'd be great if this stuff was online like in a blog or whatnot. I'd like to take the time and look over the crypto challenges.

We want to actually teach people how to do stuff, instead of giving people something they can toss around in message board and twitter arguments; we also want to track (in a macro sense) how people do with them, and to be able to tell people when we add more challenges (I'm working on 42-48 next week).

Re: So You Want To Be A Breaker, Part 1: Web Security

#27

Post by anigbrowl »

tptacek wrote: post #9
daeken wrote: post #8

Earlier quoted context omitted.

Huh, yeah, I've never seen anyone use intruder like that. I might use it once every other engagement, whereas I use repeater 24/7.

Also, if I'm justifying Burp to a non-security person, part of the reason why is that Intruder would allow me to do all sorts of wacky integration and stress tests without having to write fiddley code. A rule-based request generator is a pretty useful tool for the box.

$299/year seems pretty affordable, I was expecting to see something that cost thousands from the way you were talking. I know zilch about Appsec, but this appeals to the part of me that's good at breaking things.

Re: So You Want To Be A Breaker, Part 1: Web Security

#28

Post by alinajaf »

tptacek wrote: post #3
tptacek wrote: post #2

If this stuff fascinates you and you're a solid software developer and you'd be interested in having this be your full-time job for awhile and you're willing to sink a little bit of your own time into ramping up, give us a ping. We'll help you get there. This page has a lot of info on how we recruit. We're getting pretty good at turning systems programmers into breakers, and we love hiring from HN: http://www.matasan…

Oh, hey! And if you'd like to learn to break crypto at the same time as you work through Cody's web recommendations --- even if you don't want to be an appsec person --- mail sean at matasano dot com. He's got a pretty kick-ass set of ~40 crypto-breaking exercises. Something like 200 people have started them over the past 6 months; only a few people have made it through the end. (They aren't deliberately hard; they j…

+1 I'm working through these now and they're the most fun thing I've done with a computer for a long time.

Re: So You Want To Be A Breaker, Part 1: Web Security

#29

Post by switch33 »

tptacek wrote: post #26
switch33 wrote: post #22

Earlier quoted context omitted.

Any idea why he's doing this stuff only primarily by e-mail? It'd be great if this stuff was online like in a blog or whatnot. I'd like to take the time and look over the crypto challenges.

We want to actually teach people how to do stuff, instead of giving people something they can toss around in message board and twitter arguments; we also want to track (in a macro sense) how people do with them, and to be able to tell people when we add more challenges (I'm working on 42-48 next week).

I like that answer. \O/

Also sent an e-mail.

Re: So You Want To Be A Breaker, Part 1: Web Security

#30

Post by Serplat »

Slimbo wrote: post #17

This guide is exactly what I've been looking for, thanks Cody. Been on the receiving end of some very talented pentesters, and really want to learn more about how on earth they find the things they do. Want to make sure I catch your future editions, do you have anything I can sign up for notification? Can't find an RSS feed on your blog.

I second the need for an RSS feed. I was actually a bit surprised when I couldn't find one.
Post reply on HN