SlideShare a Scribd company logo

Subgraph vega countermeasure2012

David Mirza, profile picture
David Mirza

Using and Extending Vega Vega is an open-source web application vulnerability assessment platform that provides an automated scanner and intercepting proxy. The automated scanner recursively crawls targets and runs injection modules to find vulnerabilities. The intercepting proxy allows editing requests and responses and running response processing modules. Modules are written in JavaScript and Vega is highly extensible. Future plans include improving detections, adding a fuzzer, and making the platform more scriptable.

1 of 34
Downloaded 22 times
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
Using and Extending Vega David Mirza, Subgraph Montreal www.subgraph.com
Introduction Who We Are  Open-source security startup  Based in Montreal  Experienced founders: • Secure Networks Inc. • SecurityFocus (Symantec) • Core Security Technologies • Netifera • REcon www.subgraph.com
Open Source and Security  Kerckhoffs’ principle  Auguste Kerckhoffs: 19th Century Dutch linguist and cryptographer  Made an important realization: “ “  “The security of any cryptographic The security of any cryptographic system does system doessecrecy, it in itsbe able to fall not rest in its not rest must secrecy, it mustthe enemy’s hands without inconvenience. into be able to fall into the enemy’s hands without inconvenience”  The adversary knows the system (Claude The adversary knows the system Shannon) (Claude Shannon) ” ”  As opposed to “security through obscurity” www.subgraph.com
Open Source and Security  Kerckhoffs’ Principle  Well understood in the world of cryptography  New ciphers not trusted  Because cryptography is a “black box”  Once in a while, less now, companies try to market proprietary ciphers  There’s a term for this: “snake oil”  Kerckhoffs’ principle can be understood as “open source is good security” www.subgraph.com
Commercial Web Security Software  Advantages  Ease of installation, upgrade, use  User experience  Quality assurance, bug fixes  Documentation and help  Development driven by demand and need  Disadvantages  Expensive  Sometimes bizarre licensing restrictions  EOL, acquisitions, other events  Proprietary / closed source www.subgraph.com
Open Source Web Security Tools  Let’s just talk about disadvantages..  No integration / sharing between tools  Poor or non-existent UI, documentation / help  Painful, broken installations  Code is of inconsistent quality  Developer / contributor unreliability  Developer interest driven by interest, skill level, whim  Forks  Abandonment   Developer finished college, got a job  Successfully reproduced www.subgraph.com
i hurt  myself today www.subgraph.com
Our Vision  One web, one web security tool  Open source  Consistent, well-designed UI  Functions really well as an automated scanner  Shouldn’t need to be a penetration tester  Advanced features for those who are  User extensibility  Community  Plus all that boring stuff  Documentation, help, business friendly features  We are building the ultimate platform for web security  Rapidly prototype attacks  Nobody should have to use commercial tools  Because Vega is free www.subgraph.com
Introducing Vega Platform ‣ Open-source web application vulnerability assessment platform ‣ Easy to use Graphical Interface ‣ Works on Windows, Mac, Linux ‣ Automated scanner, attacking proxy finds vulnerabilities ‣ Based on Eclipse RCP ‣ Extensible: Javascript – language every web developer knows ‣ Shipped first release July 1 ‣ EPL 1.0 www.subgraph.com
Vega is Built On: Eclipse RCP / Equinox OSGi Apache HC JSoup Mozilla Rhino Eliteness www.subgraph.com
Automated Scanner  Recursive crawl over target scope  404 detection  Probes path nodes to determine if files, directories  Builds tree-like internal representation of target application  Vega runs injection modules on nodes, abstracted in API  Response processing modules run on all responses  Modules written in Javascript  New for 1.0  Expanded scope, more than one base URI  Support for authentication: HTTP, form-based, NTLM  Much better scanner modules  Very annoying crawler bugs fixed  www.subgraph.com
Vega Automated Scanner www.subgraph.com
Start new scan and choose some of these modules: www.subgraph.com
Which are each one of these.. www.subgraph.com
Modules produce vulnerability reports: www.subgraph.com
..which are based on these: Vega is very extensible. www.subgraph.com
Request / response pair www.subgraph.com
Can be reviewed / replayed, module highlights finding www.subgraph.com
Vega Proxy  Intercepting proxy  SSL MITM, including CA signing cert  http://vega/ca.crt through the proxy  Edit requests, responses  Request replay  Response processing modules run on all responses  Modules written in Javascript  New for 1.0  Proxy scanning  Fuzzes pages in target scope when enabled  Finds lots of vulnerabilities  www.subgraph.com
Browser proxy configuration: www.subgraph.com
General proxy use. Green “play” button enables proxy, red stops it. www.subgraph.com
Configuring a Breakpoint www.subgraph.com
Intercepted Request www.subgraph.com
SSL MITM: Magic proxy URI www.subgraph.com
Proxy Scanning Gathers parameters and path information observing client-server interaction Sees things the crawler can’t see  RPC endpoints  Links in flash, Java, other active content Very effective at finding vulnerabilities To try it, configure the proxy, create a proxy target scope, enable proxy scanning www.subgraph.com
Configure a target scope www.subgraph.com
Enable Proxy Scanning Alert Notification Icon, aka SQL Injection Blinker www.subgraph.com
Proxy Scanner Alerts www.subgraph.com
Demo (1.0!) www.subgraph.com
Extending Vega Modules written in Javascript In the Vega/scripts/ subdirectory tree  Well on OS X they’re in some weird place Two kinds of modules:  Injection, AKA “Basic”  Send fuzzing requests, do stuff with the responses  Response processing  Pattern matching, regex, checking response properties www.subgraph.com
Extending Vega Rich API  Check documentation at https://support.subgraph.com DOM Analysis with Jquery  E.g. file upload, password input submitted over HTTP.. Alerts based on XML templates  In the XML/ subdirectory Freemarker Macro / CSS components www.subgraph.com
Where are we at?  Feature complete for 1.0  Testing and fixing bugs  Additional module refinement and testing  Vega 1.0 release in November? Or early December  Visit my github (or github.com/brl) if you want what you see here  Download link on our website is the beta..  Can provide builds for OS X, Windows users  Just ask me – email, irc (#subgraph / freenode), twitter, whatever www.subgraph.com
What’s coming?  Even more improvements in detections  Fuzzer / brute forcer  Better reporting  Better encoding, decoding, representation and manipulation of structured data  Headless scanner  HAR export  Scriptable proxy  We’re open to ideas and feedback! www.subgraph.com
Thank you!  Web  Try Vega / get the source  http://www.subgraph.com  http://github.com/dma/Vega (newer, less stable)  Twitter  http://github.com/subgraph/Vega  Us: @subgraph (more stable)  Me: @attractr  E-mail us  IRC  info@subgraph.com  irc.freenode.org, #subgraph www.subgraph.com

More Related Content

PPTX
Azure bastion
Mohit Chhabra
 
PDF
Continuous Integration With Jenkins
Edureka!
 
PDF
Azure DevOps Tutorial | Developing CI/ CD Pipelines On Azure | Edureka
Edureka!
 
PDF
AWS ELEMENTAL MEDIA SERVICES UPDATE
Amazon Web Services Japan
 
PDF
AWS Certified Cloud Practitioner Brochure and sample questions
TestPrep Training
 
PDF
Subgraph vega countermeasure2012
David Mirza
 
PDF
hacking your website with vega, confoo2011
Bachkoutou Toutou
 
PPTX
Overview of Vulnerability Scanning.pptx
AjayKumar73315
 
Azure bastion
Mohit Chhabra
 
Continuous Integration With Jenkins
Edureka!
 
Azure DevOps Tutorial | Developing CI/ CD Pipelines On Azure | Edureka
Edureka!
 
AWS ELEMENTAL MEDIA SERVICES UPDATE
Amazon Web Services Japan
 
AWS Certified Cloud Practitioner Brochure and sample questions
TestPrep Training
 
Subgraph vega countermeasure2012
David Mirza
 
hacking your website with vega, confoo2011
Bachkoutou Toutou
 
Overview of Vulnerability Scanning.pptx
AjayKumar73315
 

Similar to Subgraph vega countermeasure2012 (20)

PDF
Web Development in Advanced Threat Prevention
IRJET Journal
 
PDF
Defcon 20-zulla-improving-web-vulnerability-scanning
zulla
 
PDF
Defcon 20-zulla-improving-web-vulnerability-scanning
zulla
 
KEY
Trending with Purpose
Jason Dixon
 
ODP
Large scale crawling with Apache Nutch
Julien Nioche
 
PDF
Nguyen Huu Trung - Building a web vulnerability scanner - From a hacker’s view
Security Bootcamp
 
PDF
Technical Challenges in Resource Discovery
Paul Walk
 
PDF
Technical Coping Strategies for Resource Discovery - Paul Walk
Jisc
 
KEY
Fostering Synergies - How Semantic Web Technology could influence Software Re...
Michael Würsch
 
PDF
Blackhat11 shreeraj reverse_engineering_browser
Shreeraj Shah
 
PDF
OSDC 2014: Devdas Bhagat - Graphite: Graphs for the modern age
NETWAYS
 
PDF
Unmanned Aerial Vehicles: Exploit Automation with the Metasploit Framework
egypt
 
PDF
Thug: a new low-interaction honeyclient
Angelo Dell'Aera
 
PDF
Html5 Application Security
chuckbt
 
PDF
Window Shopping Browser - Bug Hunting in 2012
Roberto Suggi Liverani
 
PDF
Insider Threat Visualization - HITB 2007, Kuala Lumpur
Raffael Marty
 
PDF
Insider Threat Visualization - HackInTheBox 2007
Raffael Marty
 
PDF
OpenChain Webinar - AboutCode - Practical Compliance in One Stack – Licensing...
Shane Coughlan
 
PPTX
Burp Suite is a powerful and widely-used tool
waudit1
 
PDF
Web Crawling with Apache Nutch
sebastian_nagel
 
Web Development in Advanced Threat Prevention
IRJET Journal
 
Defcon 20-zulla-improving-web-vulnerability-scanning
zulla
 
Defcon 20-zulla-improving-web-vulnerability-scanning
zulla
 
Trending with Purpose
Jason Dixon
 
Large scale crawling with Apache Nutch
Julien Nioche
 
Nguyen Huu Trung - Building a web vulnerability scanner - From a hacker’s view
Security Bootcamp
 
Technical Challenges in Resource Discovery
Paul Walk
 
Technical Coping Strategies for Resource Discovery - Paul Walk
Jisc
 
Fostering Synergies - How Semantic Web Technology could influence Software Re...
Michael Würsch
 
Blackhat11 shreeraj reverse_engineering_browser
Shreeraj Shah
 
OSDC 2014: Devdas Bhagat - Graphite: Graphs for the modern age
NETWAYS
 
Unmanned Aerial Vehicles: Exploit Automation with the Metasploit Framework
egypt
 
Thug: a new low-interaction honeyclient
Angelo Dell'Aera
 
Html5 Application Security
chuckbt
 
Window Shopping Browser - Bug Hunting in 2012
Roberto Suggi Liverani
 
Insider Threat Visualization - HITB 2007, Kuala Lumpur
Raffael Marty
 
Insider Threat Visualization - HackInTheBox 2007
Raffael Marty
 
OpenChain Webinar - AboutCode - Practical Compliance in One Stack – Licensing...
Shane Coughlan
 
Burp Suite is a powerful and widely-used tool
waudit1
 
Web Crawling with Apache Nutch
sebastian_nagel
 
Ad

Subgraph vega countermeasure2012

  • 1. Using and Extending Vega David Mirza, Subgraph Montreal www.subgraph.com
  • 2. Introduction Who We Are  Open-source security startup  Based in Montreal  Experienced founders: • Secure Networks Inc. • SecurityFocus (Symantec) • Core Security Technologies • Netifera • REcon www.subgraph.com
  • 3. Open Source and Security  Kerckhoffs’ principle  Auguste Kerckhoffs: 19th Century Dutch linguist and cryptographer  Made an important realization: “ “  “The security of any cryptographic The security of any cryptographic system does system doessecrecy, it in itsbe able to fall not rest in its not rest must secrecy, it mustthe enemy’s hands without inconvenience. into be able to fall into the enemy’s hands without inconvenience”  The adversary knows the system (Claude The adversary knows the system Shannon) (Claude Shannon) ” ”  As opposed to “security through obscurity” www.subgraph.com
  • 4. Open Source and Security  Kerckhoffs’ Principle  Well understood in the world of cryptography  New ciphers not trusted  Because cryptography is a “black box”  Once in a while, less now, companies try to market proprietary ciphers  There’s a term for this: “snake oil”  Kerckhoffs’ principle can be understood as “open source is good security” www.subgraph.com
  • 5. Commercial Web Security Software  Advantages  Ease of installation, upgrade, use  User experience  Quality assurance, bug fixes  Documentation and help  Development driven by demand and need  Disadvantages  Expensive  Sometimes bizarre licensing restrictions  EOL, acquisitions, other events  Proprietary / closed source www.subgraph.com
  • 6. Open Source Web Security Tools  Let’s just talk about disadvantages..  No integration / sharing between tools  Poor or non-existent UI, documentation / help  Painful, broken installations  Code is of inconsistent quality  Developer / contributor unreliability  Developer interest driven by interest, skill level, whim  Forks  Abandonment   Developer finished college, got a job  Successfully reproduced www.subgraph.com
  • 7. i hurt  myself today www.subgraph.com
  • 8. Our Vision  One web, one web security tool  Open source  Consistent, well-designed UI  Functions really well as an automated scanner  Shouldn’t need to be a penetration tester  Advanced features for those who are  User extensibility  Community  Plus all that boring stuff  Documentation, help, business friendly features  We are building the ultimate platform for web security  Rapidly prototype attacks  Nobody should have to use commercial tools  Because Vega is free www.subgraph.com
  • 9. Introducing Vega Platform ‣ Open-source web application vulnerability assessment platform ‣ Easy to use Graphical Interface ‣ Works on Windows, Mac, Linux ‣ Automated scanner, attacking proxy finds vulnerabilities ‣ Based on Eclipse RCP ‣ Extensible: Javascript – language every web developer knows ‣ Shipped first release July 1 ‣ EPL 1.0 www.subgraph.com
  • 10. Vega is Built On: Eclipse RCP / Equinox OSGi Apache HC JSoup Mozilla Rhino Eliteness www.subgraph.com
  • 11. Automated Scanner  Recursive crawl over target scope  404 detection  Probes path nodes to determine if files, directories  Builds tree-like internal representation of target application  Vega runs injection modules on nodes, abstracted in API  Response processing modules run on all responses  Modules written in Javascript  New for 1.0  Expanded scope, more than one base URI  Support for authentication: HTTP, form-based, NTLM  Much better scanner modules  Very annoying crawler bugs fixed  www.subgraph.com
  • 12. Vega Automated Scanner www.subgraph.com
  • 13. Start new scan and choose some of these modules: www.subgraph.com
  • 14. Which are each one of these.. www.subgraph.com
  • 15. Modules produce vulnerability reports: www.subgraph.com
  • 16. ..which are based on these: Vega is very extensible. www.subgraph.com
  • 17. Request / response pair www.subgraph.com
  • 18. Can be reviewed / replayed, module highlights finding www.subgraph.com
  • 19. Vega Proxy  Intercepting proxy  SSL MITM, including CA signing cert  http://vega/ca.crt through the proxy  Edit requests, responses  Request replay  Response processing modules run on all responses  Modules written in Javascript  New for 1.0  Proxy scanning  Fuzzes pages in target scope when enabled  Finds lots of vulnerabilities  www.subgraph.com
  • 20. Browser proxy configuration: www.subgraph.com
  • 21. General proxy use. Green “play” button enables proxy, red stops it. www.subgraph.com
  • 22. Configuring a Breakpoint www.subgraph.com
  • 23. Intercepted Request www.subgraph.com
  • 24. SSL MITM: Magic proxy URI www.subgraph.com
  • 25. Proxy Scanning Gathers parameters and path information observing client-server interaction Sees things the crawler can’t see  RPC endpoints  Links in flash, Java, other active content Very effective at finding vulnerabilities To try it, configure the proxy, create a proxy target scope, enable proxy scanning www.subgraph.com
  • 26. Configure a target scope www.subgraph.com
  • 27. Enable Proxy Scanning Alert Notification Icon, aka SQL Injection Blinker www.subgraph.com
  • 28. Proxy Scanner Alerts www.subgraph.com
  • 29. Demo (1.0!) www.subgraph.com
  • 30. Extending Vega Modules written in Javascript In the Vega/scripts/ subdirectory tree  Well on OS X they’re in some weird place Two kinds of modules:  Injection, AKA “Basic”  Send fuzzing requests, do stuff with the responses  Response processing  Pattern matching, regex, checking response properties www.subgraph.com
  • 31. Extending Vega Rich API  Check documentation at https://support.subgraph.com DOM Analysis with Jquery  E.g. file upload, password input submitted over HTTP.. Alerts based on XML templates  In the XML/ subdirectory Freemarker Macro / CSS components www.subgraph.com
  • 32. Where are we at?  Feature complete for 1.0  Testing and fixing bugs  Additional module refinement and testing  Vega 1.0 release in November? Or early December  Visit my github (or github.com/brl) if you want what you see here  Download link on our website is the beta..  Can provide builds for OS X, Windows users  Just ask me – email, irc (#subgraph / freenode), twitter, whatever www.subgraph.com
  • 33. What’s coming?  Even more improvements in detections  Fuzzer / brute forcer  Better reporting  Better encoding, decoding, representation and manipulation of structured data  Headless scanner  HAR export  Scriptable proxy  We’re open to ideas and feedback! www.subgraph.com
  • 34. Thank you!  Web  Try Vega / get the source  http://www.subgraph.com  http://github.com/dma/Vega (newer, less stable)  Twitter  http://github.com/subgraph/Vega  Us: @subgraph (more stable)  Me: @attractr  E-mail us  IRC  info@subgraph.com  irc.freenode.org, #subgraph www.subgraph.com