Recon -> Identification -> Reporting / exploitation

Recon

• Find information about the target
• Avoid unnecessary load and make everything faster
• Expand your scope
• Multiple tools of the trade, my personal preferences:
  • Subdomains: Amass
  • Ports / tech detection: nmap
  • Web tech detection: httpx
  • Virtualhosts / paths / content / assets: ffuf
  • Inner links: hakrawler

Identification

• XSS: Look for reflections from parameter inputs
• LFI: Look for known strings (like "root:x:0:" for /etc/passwd)
• SQLi: Use timing based payloads with proper ffuf filters
• SSRF: Look for callbacks with interactsh / burp collaborator
• IDOR: Look for known non-accessible data
• SSTI: Look for calculation results based on your payloads
• ...[insert your vulnerability category here]...

Examples provided later in the presentation

Reporting

• Push to external services: notify
  • Slack
  • Discord
  • Custom webhooks
  • E-mail
  • Output files
• ...or write your own
  • Simple example for Mattermost webhook can be found here.

Scripting, parsing, piping and filtering

Scripting

To allow easy extension and iterative automation build-up is to use either Python or shell scripting (for the shell of your choice).

• Benefits of 🐍
  • Ability to act immediately on results, "event" based
  • Easy to filter results within the flow
  • Have more control without extensive knowledge of dark magic
  • Control of (potentially) parallel jobs
• Benefits of 🐚
  • Get going extremely fast
  • A lot of readily made FOSS tools on your disposal
  • Easy to scale even further with frameworks like Axiom

Parsing

JSON is made to be read by computers, and it's your best ally. Most of the tools support it in one way or another. In general you'll be dealing with either newline separated text files, or JSON.

• Python supports JSON natively
• jq is a awesome CLI tool for JSON parsing / filtering
• Cherrypick specific parts of urls with unfurl

Piping

Many different stages in the automation pipeline can branch in to multiple subtasks, so it's often good to store results from previous stages to a temporary file. This often helps you to debug possible issues as well.

• Use tee to append stdout to a file while also displaying it
• anew adds only new unique lines to the output file

Filtering

Try to avoid creating unnecessary traffic, and especially spinning out of scope that can happen quite easily. Make sure to filter out unwanted entries from your automation workflow in an early stage. This will make your automation faster, and will cause considerably less legal issues down the road ;)

An example of a simple python script that reads lines from stdin (intended to be used within a pipe) and outputting only http(s) urls within scope can be found here

Everything starts with a good, potentially context specific wordlist.

• Simple txt files with one payload per line
• You should build your own!
• Get started with: https://github.com/six2dez/OneListForAll
• ...and https://github.com/danielmiessler/SecLists

A simple example of a context specific addition to a default wordlist is using output from recon to feed into wordlists for the next stages.

#!/bin/bash
# Optimally you already have the links from a previous step
echo 'https://target.tld' |hakrawler -subs -u |tee target.tld.txt
cat target.tld.txt |unfurl keys |anew custom_words.txt
cat target.tld.txt |unfurl values |anew custom_words.txt
# Add common entries from a public SecLists wordlist
cat burp-parameter-names.txt |anew custom_words.txt
                                

GET /path/resourcename?id=12345 HTTP/1.1
Host: ffuf.io.fi
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; ...
Accept: text/html
Connection: keep-alive
Cookie: cookiename=cookievalue;session_id=1234567890
Pragma: no-cache
Cache-Control: no-cache

GET /path/FUZZRES?id=12345 HTTP/1.1
Host: ffuf.io.fi
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; ...
Accept: text/html
Connection: keep-alive
Cookie: cookiename=FUZZCOOK;session_id=1234567890
Pragma: no-cache
Cache-Control: no-cache

$ ffuf -w custom_words.txt:KEYS -w cookies.txt:FUZZCOOK ...