Earlier quoted context omitted.
Totally agreed on all counts.
DON'T BELIEVE EITHER OF THEM! THEY ATE THE FUNGUS!
The Fungus is made from people!
So You Want To Be A Breaker, Part 1: Web Security
81–86 of 86 posts
Re: So You Want To Be A Breaker, Part 1: Web Security
#82Earlier quoted context omitted.
Justifying the expense wouldn't be difficult at all. However, I think the free version is Just Fine (TM) unless you need stuff like the scanner or intruder (intruder works in Burp Free, but is limited to something like 1 request/second).
Burp Intruder is the fuzzer inside of Burp. All the Burp-like tools let you capture requests your browser sends, edit them, and replay them. Burp Intruder lets you take a captured request and set up rules to send hundreds or thousands of variant requests. I am weird among Matasanos (and ex-Matasanos :|) in that I live inside of Burp Intruder; I use it instead of Repeater. Why replay a request once when I can replay i…
> I wish Burp didn't have a Scanner. I might pay $25 more for a branded version of Burp that specifically didn't have that feature, so I could reassure clients I wasn't ever using it.
Huh? Do you like wasting clients time/money?
Re: So You Want To Be A Breaker, Part 1: Web Security
#83Earlier quoted context omitted.
We work with lots of startups. We work with big companies, too, but that work is disproportionately with big west coast tech companies. The "east coast" BigCo work we do touches on trading protocols and order routing systems, which is fun for a lot of other reasons (wider application domain for findings, extremely high impact, complicated systems with message-oriented middleware, non-web inputs). We do zero governmen…
> Maybe the web appsec work at a place like that is boring? We take it pretty seriously. Could be. Your work description sounds different though. We did use Nessus and Metasploit for some things, but not for web app security, since ALL these tools suck on a web app security level. They do stupid request-response analysis and they usually have no capability to hold some sort of state, which gets increasingly important…
I think there's actually no other tool like sqlmap.
But there is no tool that will come close to competing with a top-notch pentester on a SQLi hunt. Automated tools just don't cut it. There is nothing like watching First Blood in action.
Re: So You Want To Be A Breaker, Part 1: Web Security
#84Earlier quoted context omitted.
Burp Intruder is the fuzzer inside of Burp. All the Burp-like tools let you capture requests your browser sends, edit them, and replay them. Burp Intruder lets you take a captured request and set up rules to send hundreds or thousands of variant requests. I am weird among Matasanos (and ex-Matasanos :|) in that I live inside of Burp Intruder; I use it instead of Repeater. Why replay a request once when I can replay i…
> I wish Burp didn't have a Scanner. I might pay $25 more for a branded version of Burp that specifically didn't have that feature, so I could reassure clients I wasn't ever using it. Huh? Do you like wasting clients time/money?
No,
* which is why we don't charge billable hours to run off-the-shelf tools that our clients could just run themselves,
* I addressed why we don't "augment" with scanners downthread (shortened answer: it's a slippery slope to testers just running scanners),
* Our scoping and rates are dead square in the middle of the market, so if scanners are helping other firms deliver projects more cheaply than us, I don't think the savings are being passed along. (We also don't double- or triple- book consultants on multiple projects, and we don't pay overtime.)
I upvoted you, because while I thought that was a pretty snide way to ask the question, I sure am happy to get to say over and over again how our projects aren't just Burp Scanner results. :)
Re: So You Want To Be A Breaker, Part 1: Web Security
#85Earlier quoted context omitted.
> I wish Burp didn't have a Scanner. I might pay $25 more for a branded version of Burp that specifically didn't have that feature, so I could reassure clients I wasn't ever using it. Huh? Do you like wasting clients time/money?
No, * which is why we don't charge billable hours to run off-the-shelf tools that our clients could just run themselves, * I addressed why we don't "augment" with scanners downthread (shortened answer: it's a slippery slope to testers just running scanners), * Our scoping and rates are dead square in the middle of the market, so if scanners are helping other firms deliver projects more cheaply than us, I don't think…
Well I don't want to turn this into a company-specific debate, so I'm just addressing the position that running burp's scanner or sqlmap is "low quality". I have a few issues with that position and your justifications.
I wouldn't bill a client for running a scan on them. I would start a scan and do manual testing at the same time, focusing on more intelligent attacks and understanding the application. By the time I am done, the scan would typically kill off a significant number of buggy parameters that I now don't have to test because I already know it's as vulnerable. For some projects, this can be quite substantial. Beyond creating a POC and documenting the issue, I now don't have to spend billable hours on all of that.
The fact that scans consistently find a lot of bugs tell you that clients aren't running tools themselves. They don't know the tools, don't understand the results, don't know how to use them beyond point-and-click. They don't know how to set up macros that validate the session and re-log in, etc.
Although it sounds good to say that they aren't paying you to just run a scanner, the reality is no other reputable testers are doing that either.
Yeah, it was a bit snide, but you were scoffing at testers who do use scanners, and I genuinely think not using them (properly) is a colossal waste of time
Re: So You Want To Be A Breaker, Part 1: Web Security
#86Earlier quoted context omitted.
No, * which is why we don't charge billable hours to run off-the-shelf tools that our clients could just run themselves, * I addressed why we don't "augment" with scanners downthread (shortened answer: it's a slippery slope to testers just running scanners), * Our scoping and rates are dead square in the middle of the market, so if scanners are helping other firms deliver projects more cheaply than us, I don't think…
Well I don't want to turn this into a company-specific debate, so I'm just addressing the position that running burp's scanner or sqlmap is "low quality". I have a few issues with that position and your justifications. I wouldn't bill a client for running a scan on them. I would start a scan and do manual testing at the same time, focusing on more intelligent attacks and understanding the application. By the time I a…
I wouldn't want to restate a whole bunch of points I made downthread (we think scanners degrade manual testing, we're not opposed to automation but instead only to automation that actually flags findings, we grind up the bones of candidates to fertilize the fungus we use for our pentest "trips", &c).
It would be fun to have this debate somewhere that wasn't 10 comments deep into an old thread.
I don't actually know you, or who you work for, so please don't think I could be calling you out as a bad tester. We just don't test with automated scanners. We're not the only shop that doesn't use scanners. It's just the way we work.