hacking your website with vega, confoo2011
2 likes2,442 views
The document discusses Subgraph Technologies, an open source security startup based in Montreal. It introduces the company and its founders' backgrounds in security. The main topics covered are: - Kerckhoffs' principle of security through open scrutiny rather than secrecy. - How open source development has benefited the security research community and led to important tools through collaboration. - Both advantages and disadvantages of commercial and open source web security software. While commercial tools have better usability, open source allows for transparency and avoids vendor lock-in. - The existing landscape of both commercial and open source web security tools, noting some open source tools lack integration or are outdated.
hacking your website with vega, confoo2011
- 1. Hacking Your Website With David Mirza, Subgraph Technologies Montreal http://www.subgraph.com
- 2. Introduc>on Who we are Open-‐source security startup Based in Montreal Experienced founders: o Secure Networks Inc. o SecurityFocus (Symantec) o Core Security Technologies o Ne>fera o REcon http://www.subgraph.com
- 3. About us Subgraph is an open source security company Helping organiza>ons protect their websites o Building high quality soRware o Penetra>on tes>ng o Code / architecture review Incorporated in February 2010 Philosophy of openness important to us o More than just releasing the code http://www.subgraph.com
- 4. Open Source and Security I say! Kerckhoffs’ principle Auguste Kerckhoffs: 19th Century Dutch linguist and cryptographer Made an important realiza>on: o “The security of any cryptographic system does not rest in its secrecy, it must be able to fall into the enemy’s hands without inconvenience” o More succinctly, the adversary knows the system As opposed to “security through obscurity” http://www.subgraph.com
- 5. Open Source and Security Kerckhoffs’ Principle Well understood in the world of cryptography o New ciphers are not trusted without public scru>ny over years o Because cryptography is used as a “black box” It’s the only way to be sure o Once in a while, less now, companies try to market proprietary ciphers There’s a term for this: “snake oil” But what about everyone else? http://www.subgraph.com
- 6. Beyond Cryptography Security Research Community Ac>ve, global community of passionate professionals, amateurs, students and hackers o Collabora>ve o Open Examples o Phrack magazine o Bugtraq o Defcon o Blackhat o REcon! This community changed the soRware industry Full-‐disclosure won Beaer security for all Bug boun>es o Google, Mozilla http://www.subgraph.com
- 7. Open Source and Security Tools These researchers write tools o Exploits o Network security (e.g. nmap) Enough to have specialized, dedicated LiveCDs.. o BackTrack – Penetra>on tes>ng LiveCD o Helix – Forensics LiveCD The security industry owes all so much o Grassroots, open source innova>on o Some open source projects became commercial successes Snort IDS Metasploit http://www.subgraph.com
- 8. Open Source and Security Open source has always been a part of security Collabora>ve, open research Open source tool development Kerckhoffs’ Law: open code scru>ny Means beaer security, in general Open source security soRware Is more trustworthy: read the source, compile it yourself No worries, no maaer where in the world you live Why doesn’t everyone demand open source for security? http://www.subgraph.com
- 9. Open Source and Security Web applica>on security Followed the same path Collabora>ve, open research, advocacy o E.g. OWASP Great open source tools, frameworks Also, the cueng edge of web applica>on development En>rely open source! http://www.subgraph.com
- 10. Web Security Timeline http://www.subgraph.com
- 11. Commercial Web Security SoRware Advantages of commercial tools Ease of installa>on, upgrade, use User experience Quality Assurance, bug fixing Documenta>on/Help Development driven by demand/need Disadvantages Expensive Bizarre license restric>ons EOL, acquisi>ons, other events Proprietary, closed source http://www.subgraph.com
- 12. Open Source Web Security SoRware Since I’ve already talked about the advantages.. Disadvantages No integra>on / sharing of data between the various tools Poor or non-‐existent UI, documenta>on, help Painful, broken installa>ons Code is of inconsistent quality Developer, contributor unreliability Development driven by whim, interest, skill level Forks Abandonment o Developer finished college, got a job o Successfully reproduced http://www.subgraph.com
- 13. Exis>ng Landscape of Web Tools There are very good commercial tools HP, IBM, Qualys SAAS, such as Whitehat NetSparker BurpSuite (free version available) Expensive Some free/community versions, crippled Proprietary http://www.subgraph.com
- 14. Open Source Tools There are also some fantas>c open source tools Specialized o Various specialized fuzzers o Standalone proxies o Standalone scanners o Standalone brute-‐forcing tools They do not share a data model o Integrate them yourself In our experience: o Some>mes buggy o Last commit was in 2008.. o Broken user interfaces http://www.subgraph.com
- 15. Free/Open Source Web Security Tools http://www.subgraph.com
- 16. Our Vision One web, one web security tool Open source Consistent, well-‐designed UI Func>ons really well as an automated scanner o Shouldn’t need to be a penetra>on tester o Advanced features for those who are User extensibility o Community Plus all that boring stuff o Documenta>on, help, business friendly features http://www.subgraph.com
- 17. Hi, My Name Is: Vega is a web-‐applica>on security scanner It finds vulnerabili>es in your website Wriaen in Java, runs on: Mac OS X Windows Linux A desktop applica>on with a nice GUI Eclipse RCP http://www.subgraph.com
- 18. Introducing VEGA Currently two modes of opera>on Automated scanner o Point and click hacking Intercep>ng proxy o Instrumenta>on o Manual closer inspec>on o Penetra>on tes>ng http://www.subgraph.com
- 19. Scanner Automated scanner Crawls your web applica>on recursively Analyzes links Runs a configurable set of audit and aaack ac>ons on these links Limited brute forcing Tests parameters for favorites, such as: o Reflected, persistent XSS o SQL injec>on o Command injec>on o Local file include o Local file reading Tries to iden>fy server misconfigura>ons http://www.subgraph.com
- 20. Proxy Intercep>ng proxy Intercepts requests, responses o Based on request method o Filters Can be edited Requests can be replayed or created Data decoding and encoding Customized automa>c manipula>on of requests, responses Response processing scanner modules http://www.subgraph.com
- 21. What’s Inside Architecture Eclipse RCP Modularity of design enforced with OSGI Using Apache HTTPComponents JSoup Google Guava DB4O Rhino JS Interpreter http://www.subgraph.com
- 22. Extensibility Extending Vega with ease Scrip>ng of custom modules o Javascript o DOM, JQuery o Clean, sensible API Scrip>ng of proxy o Automated manipula>on of intercepted requests, responses Custom alerts o XML Templates http://www.subgraph.com
- 23. VEGA DEMO http://www.subgraph.com
- 24. Current Status We are really close Finish a few features Polish Tes>ng Fixing bugs Documenta>on User Developer Help Beta! Mid-‐April http://www.subgraph.com
- 25. Future Fun stuff Penetra>on tes>ng o Exploita>on of vulnerabili>es o Support for advanced aaacks Brute Forcing o Directories o Username/password Fuzzing o E.g. A really good web services fuzzer Specialized support for audi>ng apps o CakePHP, Rails, J2EE Less fun Really nice repor>ng http://www.subgraph.com
- 26. Thank you! Interested? Web E-‐mail us hap://www.subgraph.com info@subgraph.com Twiaer MTLSEC Company: @subgraph (we’ve been quiet) If you’re in Montreal, we do a monthly, Me: @aaractr informal 5@7 hap://www.mtlsec.com, @mtlsec IRC irc.freenode.org, #subgraph http://www.subgraph.com