Live data from Hacker News

So You Want To Be A Breaker, Part 1: Web Security

daeken.com

71–80 of 86 posts

Re: So You Want To Be A Breaker, Part 1: Web Security

#71
post #68
post #67

Earlier quoted context omitted.

It's not the anon that I care about, it's that someone is being an asshole in public to people I consider to be friends, and using my (and nbpoole's) name to do it. I'm not fond of that.

It bothers me too.

You guys are all great; honestly, though, I think we're the only ones reading this part of the thread, and I was owed some kind of karmic retribution for turning Cody's post into a Matasano hiring thread.

I'm surprised none of you think I'm devious enough to have planted that anonymous commenter, though. "What, you're saying you test ALL the form inputs? What are you, some kind of atomic superman?"

Re: So You Want To Be A Breaker, Part 1: Web Security

#72
post #56
post #31

Earlier quoted context omitted.

It's something I thought about for a while and just decided it wasn't worth it. I just switched away from Posterous (c.f. https://news.ycombinator.com/item?id=5388857 ) and when I was building the new blog, I looked at my RSS subscribers and realized only 15 people actually use it. Just wasn't worth building.

FWIW, it looks like I'm at least the 3rd person today who would have added your rss feed if it existed...

And I'll be the 4th.

Re: So You Want To Be A Breaker, Part 1: Web Security

#73
post #31
post #30

Earlier quoted context omitted.

I second the need for an RSS feed. I was actually a bit surprised when I couldn't find one.

It's something I thought about for a while and just decided it wasn't worth it. I just switched away from Posterous (c.f. https://news.ycombinator.com/item?id=5388857 ) and when I was building the new blog, I looked at my RSS subscribers and realized only 15 people actually use it. Just wasn't worth building.

Until you wrote something worth following :)

Re: So You Want To Be A Breaker, Part 1: Web Security

#76
post #40
post #36

Earlier quoted context omitted.

I worked as an IT security consultant for a bit over a year and found it rather boring after a while. In theory, you do lots of interesting and different things, get to know many different technologies. Maybe it was just the job I was working at, but the actual penetration testing became pretty boring after a few months. While it sounds compelling to beat up startups, startups are probably not the clients. Our consul…

We work with lots of startups. We work with big companies, too, but that work is disproportionately with big west coast tech companies. The "east coast" BigCo work we do touches on trading protocols and order routing systems, which is fun for a lot of other reasons (wider application domain for findings, extremely high impact, complicated systems with message-oriented middleware, non-web inputs). We do zero governmen…

> Maybe the web appsec work at a place like that is boring? We take it pretty seriously.

Could be. Your work description sounds different though. We did use Nessus and Metasploit for some things, but not for web app security, since ALL these tools suck on a web app security level. They do stupid request-response analysis and they usually have no capability to hold some sort of state, which gets increasingly important in modern web apps.

> We avoid tools like sqlmap.

I think there's actually no other tool like sqlmap. Sqlmap is pure gold as a time saver and also capability-wise. Exploiting a blind time-based SQL vulnerability manually is a pain. Why not use a good tool for that?

If you want to be super careful, just hook up Burp between sqlmap and the target host and check every statement manually. Still better than typing it out.

Note for non-security guys: Blind means that you don't get an error message from the host, which should be the default. Time-based means that you craft some SQL statements that take longer than other statements to get an idea which statement is true. So you could ask something like "does user 1 in table 1 start with letter a-f? if so, return it, if not, wait 3 seconds". This way, you get true or false based on the time it takes the host to respond.

Still, if you're interested in web app security, go and try it out. But if you feel you're some sort of pentesting monkey that does the same stuff day-in day-out, better leave and chase something more interesting :)

Re: So You Want To Be A Breaker, Part 1: Web Security

#77
post #4
post #2

If this stuff fascinates you and you're a solid software developer and you'd be interested in having this be your full-time job for awhile and you're willing to sink a little bit of your own time into ramping up, give us a ping. We'll help you get there. This page has a lot of info on how we recruit. We're getting pretty good at turning systems programmers into breakers, and we love hiring from HN: http://www.matasan…

> Also: I understand why Cody didn't write it this way, but the reality is, if you're going to test web apps, Burp is the standard tool. You can use things like mitmproxy or even WebScarab, but most people end up in Burp. Burp is also extremely valuable for testing even if you're not doing appsec full-time. I actually forgot to update that -- it was on my list of edits. Done now, thanks!

I'd be interested in what you security guys think of ZAP, the OWASP/Mozilla attack proxy. It's probably not up to the level of Burp yet, but I've found it works pretty well at least for basic stuff. https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Proje...
Post reply on HN