Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

So You Want To Be A Breaker, Part 1: Web Security

daeken.com

Post reply on HN
Print view View original

51–60 of 86 posts

Re: So You Want To Be A Breaker, Part 1: Web Security

#51

Post by tptacek »

livingontheedge wrote: post #48
tptacek wrote: post #2

If this stuff fascinates you and you're a solid software developer and you'd be interested in having this be your full-time job for awhile and you're willing to sink a little bit of your own time into ramping up, give us a ping. We'll help you get there. This page has a lot of info on how we recruit. We're getting pretty good at turning systems programmers into breakers, and we love hiring from HN: http://www.matasan…

DON'T WORK FOR MATASANO!!! Reasons below: #1 Lack of honesty. Seriously, they promised releasing those crypto challenges publicly 2 years ago (Blackhat 11: Crypto for Pentesters) and never done so: https://twitter.com/matasano/status/101714851633700864 . And now they're using them as a recruiting tool. #2 Lack of humility: Matasano guys seem to disregard common tools like Burp scanner or Sqlmap. It's fine to cherry-p…

If you want to run scanners all day, we're definitely not a great place to work.

We changed the format for the crypto challenges because:

* the "vulnerable" web app got in the way of what we were trying to teach people (it's easy to work CTR mode into "decrypt this cookie" but not so easy to work Diffie Hellman into that)

* the web parts got repetitive (there's only so many times you can show people "decrypt this cookie" before the "cookie" part of that gets in the way).

* some of the challenges involve implementing crypto constructions (which we found to be the best way to learn how to break them). We had features in 36 Chambers that tried to capture "building" as well as "breaking", but they were extremely clumsy and contrived.

* But mostly, because we'd rather put effort into tech supporting people learning crypto, as opposed to Ruby code running on Heroku.

Sean's crypto stuff has about 2.5x as much material as the 36Chambers crypto-for-pentesters site had, and that's mostly because we stopped wasting our time making it look pretty. The site was a silly way to spend our time. We'll have RC4 keystream bias challenges by the end of next week. If we were going to work them into a shiny web app, we might not have them by the end of the year.

If the pricing model we use for the challenges ("mail Sean and ask for them and he'll give them to you for free") is too much for you, I don't know what to tell you. Yes, making it to the end does incur the penalty of us begging you to come work with us. But if you're unwilling to surrender to a life of indentured servitude in the pentest mines at Matasano, we will happily accept a warrant on the blood of your firstborn child. That is, I think you'll agree, a tiny price to pay.

I guess thanks for giving me a chance to clear up this issue, which, if you follow me on Twitter, has maybe had you confused for awhile (at least until last November or so when we started telling people every damn week to mail Sean for the challenges).

Re: So You Want To Be A Breaker, Part 1: Web Security

#52

Post by tptacek »

livingontheedge wrote: post #50
daeken wrote: post #49

Earlier quoted context omitted.

So, I'm ex-Matasano and now work for Accuvant LABS (a competitor). While I'd love to snag awesome people to join up on my side, I completely disagree here. Matasano is a great company and they do do good work. #1 they should remedy for sure, but #2 I disagree with -- they hold the same opinion I've found in other high-end consulting shops, just more vocally.

"We avoid tools like sqlmap" "I wish Burp didn't have a Scanner. I might pay $25 more for a branded version of Burp that specifically didn't have that feature, so I could reassure clients I wasn't ever using it." Tell me, how do you expect to find MOST instances of SQL Injection or XSS without using tools? Do you manually tamper with every cookie parameters? Unless Matasano has better tools and release them publicly,…

My gosh. Actually understand every cookie parameter, instead of running some tool to generate a list of obvious SQL injection vulnerabilities? Next they'll say they actually base64-decode every cookie too. How do they find time to sleep?

We automate lots of things. We just don't automate things that remove judgement from testers.

I've been a vuln researcher since 1995 and so have my partners. I was a lead dev on the industry's second commercial vulnerability scanner (Ballista), and Jeremy worked at ISS on the first. I think we know what we're talking about. Here is what we've learned: when you give a smart tester a tool that purports to find "low hanging fruit" vulnerability X, testers get worse at finding vulnerability X on their own. They subconsciously lean on the tool. They make assumptions about what kind of vulnerability the tool will find that they shouldn't waste time looking for. They gradually start getting worse at finding even the clever variations of X.

So the challenge is to find ways to eliminate drudgery (for instance, in comparing large numbers of responses from a web app to a run of different metacharacter input vectors across every parameter) without introducing things that degrade tester judgement.

Burp Intruder: Fine (though we do better internally for some things). Burp Scanner: Not Fine.

Re: So You Want To Be A Breaker, Part 1: Web Security

#53

Post by livingontheedge »

livingontheedge wrote: post #50
daeken wrote: post #49

Earlier quoted context omitted.

So, I'm ex-Matasano and now work for Accuvant LABS (a competitor). While I'd love to snag awesome people to join up on my side, I completely disagree here. Matasano is a great company and they do do good work. #1 they should remedy for sure, but #2 I disagree with -- they hold the same opinion I've found in other high-end consulting shops, just more vocally.

"We avoid tools like sqlmap" "I wish Burp didn't have a Scanner. I might pay $25 more for a branded version of Burp that specifically didn't have that feature, so I could reassure clients I wasn't ever using it." Tell me, how do you expect to find MOST instances of SQL Injection or XSS without using tools? Do you manually tamper with every cookie parameters? Unless Matasano has better tools and release them publicly,…

You can script the scanner to auto-decode B64 cookie once you found them: http://blog.portswigger.net/2012/12/sample-burp-suite-extens...

It all boils down to: how can you be so sure if your tool/process is finding most vulnerabilities than others, and can you prove it?

If I were your client, I would be very worried by now.

Re: So You Want To Be A Breaker, Part 1: Web Security

#54

Post by tptacek »

livingontheedge wrote: post #53
livingontheedge wrote: post #50

Earlier quoted context omitted.

"We avoid tools like sqlmap" "I wish Burp didn't have a Scanner. I might pay $25 more for a branded version of Burp that specifically didn't have that feature, so I could reassure clients I wasn't ever using it." Tell me, how do you expect to find MOST instances of SQL Injection or XSS without using tools? Do you manually tamper with every cookie parameters? Unless Matasano has better tools and release them publicly,…

You can script the scanner to auto-decode B64 cookie once you found them: http://blog.portswigger.net/2012/12/sample-burp-suite-extens... It all boils down to: how can you be so sure if your tool/process is finding most vulnerabilities than others, and can you prove it? If I were your client, I would be very worried by now.

You've got me. I've only ever tested up to 49 dynamic forms, and only 42 insertion points.

Re: So You Want To Be A Breaker, Part 1: Web Security

#55

Post by livingontheedge »

tptacek wrote: post #51
livingontheedge wrote: post #48

Earlier quoted context omitted.

DON'T WORK FOR MATASANO!!! Reasons below: #1 Lack of honesty. Seriously, they promised releasing those crypto challenges publicly 2 years ago (Blackhat 11: Crypto for Pentesters) and never done so: https://twitter.com/matasano/status/101714851633700864 . And now they're using them as a recruiting tool. #2 Lack of humility: Matasano guys seem to disregard common tools like Burp scanner or Sqlmap. It's fine to cherry-p…

If you want to run scanners all day, we're definitely not a great place to work. We changed the format for the crypto challenges because: * the "vulnerable" web app got in the way of what we were trying to teach people (it's easy to work CTR mode into "decrypt this cookie" but not so easy to work Diffie Hellman into that) * the web parts got repetitive (there's only so many times you can show people "decrypt this coo…

>"Sean's crypto stuff has about 2.5x as much material as the 36Chambers crypto-for-pentesters site had..."

This site never existed, at least according to Matasano's offical website or Twitter account.

>"If the pricing model we use for the challenges ("mail Sean and ask for them and he'll give them to you for free") is too much for you, I don't know what to tell you"

You are deviating from the fact that you promised to give sth away at a national conference, then completely ignored it until s.b obviously pointed it out. What happened between BH-11 to last November - when you started telling everyone to send email to Sean?

Re: So You Want To Be A Breaker, Part 1: Web Security

#56

Post by bigiain »

daeken wrote: post #31
Serplat wrote: post #30

Earlier quoted context omitted.

I second the need for an RSS feed. I was actually a bit surprised when I couldn't find one.

It's something I thought about for a while and just decided it wasn't worth it. I just switched away from Posterous (c.f. https://news.ycombinator.com/item?id=5388857 ) and when I was building the new blog, I looked at my RSS subscribers and realized only 15 people actually use it. Just wasn't worth building.

FWIW, it looks like I'm at least the 3rd person today who would have added your rss feed if it existed...

Re: So You Want To Be A Breaker, Part 1: Web Security

#58

Post by daeken »

rdl wrote: post #57
jfolkins wrote: post #10

Tutorial I wrote on how to setup* BURP using OSX. http://www.acloudtree.com/how-to-configure-burp-and-chrome-f...

I've always preferred keeping all that stuff in a VM (usually linux).

I have a Windows VM that's snapshotted with all of my favorite tools. When I need to test something, I do so and then roll back. No mess, no cross-pollination of tests.

Re: So You Want To Be A Breaker, Part 1: Web Security

#59

Post by rdl »

daeken wrote: post #58
rdl wrote: post #57

Earlier quoted context omitted.

I've always preferred keeping all that stuff in a VM (usually linux).

I have a Windows VM that's snapshotted with all of my favorite tools. When I need to test something, I do so and then roll back. No mess, no cross-pollination of tests.

Yeah, I do the same thing with snapshots (and in some cases you're supposed to do work only on client/government-provided equipment, so moving a VM over is helpful).

Re: So You Want To Be A Breaker, Part 1: Web Security

#60

Post by tptacek »

livingontheedge wrote: post #55
tptacek wrote: post #51

Earlier quoted context omitted.

If you want to run scanners all day, we're definitely not a great place to work. We changed the format for the crypto challenges because: * the "vulnerable" web app got in the way of what we were trying to teach people (it's easy to work CTR mode into "decrypt this cookie" but not so easy to work Diffie Hellman into that) * the web parts got repetitive (there's only so many times you can show people "decrypt this coo…

>"Sean's crypto stuff has about 2.5x as much material as the 36Chambers crypto-for-pentesters site had..." This site never existed, at least according to Matasano's offical website or Twitter account. >"If the pricing model we use for the challenges ("mail Sean and ask for them and he'll give them to you for free") is too much for you, I don't know what to tell you" You are deviating from the fact that you promised t…

Maybe if you keep reframing your questions you'll manage to weave your way past my original evasive answer of "we decided not to do it that way" to the truth of "we grind up the bones of the victims of our free crypto challenges into a fine meal we use to fertilize the fungus patches we rely on for sustenance down in the pentest mines".

"Free" challenges, indeed. Ah hah hah hah hah haaaaaa! Mwrhwprh -gulp-. Mmmm. Fungus.

Post reply on HN