So I'm Johnny Christmas, this is Sam Crowther, we're from Kasada if you couldn't
figure that out, it's pretty obvious. That's too soon
audience, oh who here works for the red team in some capacity? Awesome. About
average. Who's blue team? Who's something completely different? Very cool.
I always like doing the penetration testing, offensive security
talks and seeing how many blue teamers show up. This amazing because, in reality
you're the guys that this is for. So we work for a company that is able to
detect the presence of automation client-side and determine if automation
is being used to leverage an HTTP based attack against your web applications.
This is the predominant method of attack on the Internet. Pretty much everything
is automated. Pen detect ,even if it's a penetration tester. Or you know, human
attacker, they're still using automation tool kits of some sort to your leverage these
attacks because holy crap, typing an individual credit card number is super
boring. And we build something really cool that's able to detect and defend
against that on the very first HTTP request. And I'm not gonna make this a
sales pitch because we're gonna be talking about high bypass WAF.
So, super quick, can everybody see this okay? Yeah, I was worried about that. They can't
do anything about the lighting on here unfortunately. However, I will have the
entire slide deck up, which is super nutrient rich on my github. I have links
at the end. You guys can try and zoom in, take pictures, do what you can about this.
In the meantime, we're gonna really discuss every bullet point that's up here
so, you can't see the slides it means you get to take some notes because we're
adults, I've been told. Here's a slide on me. I'm Johnny Christmas, who doesn't know me?
Wow, that's three hands. That's weird, usually it's like half the room.
So, I've done pretty much everything there is to do from network engineer
to systems engineer, to InfoSec engineer. InfoSec consultants. Have spent many years as a
penetration tester. And then I spent the last year or so in the industrial space
as a ICS researcher. Super cool and fun. Every
time I switch jobs, I try to switch careers and do something I've never done
before. So now I'm working in the vendor space because Sanic Casada has something
really freaking cool that I wanted to be apart of. So such I say, there's some
links on the side if you want to be able to find me again.
Pictures are totally cool. I do highly recommend you grab some pictures of
these slides because there's a lot of information in them. And your phone might
be able to see easier than you can. So Sam, you want to give a brief rundown? -Yeah. My name is Sam. I grew up a few miles
south of the border. [Audience laughs] - Like the Singapore border. - I got started in my career
fortunate enough to work with one of the groups that do some fun problems.
government and then how many letters did three years around town might be
allegedly that's what they told me I thought I was a security engineer and a
rate team up well one of the big investment banks back in Australia where
I cry every single time I need a test because miserable and then I left
so let's talk about what website are in a modern context because the concept of
wife has been around since I want to say the early 90s I was dealing with wife's
as an armchair hacker 94 95 they've been around as long as computers about public
IP addresses more or less a lot of us are really familiar with this kind of
basic law it's usually in that box that you have on Prem it's it's effectively
using the same methodology that it has always been using since the 90s which is
it does inspection of your post body content and it looks for
suspicious-looking strings of information to say alright is this
simply sqli something like that and then it just alerts you most mostly all it
can do is just do some IP blacklisting at absolute best or it just lets you
know and then all you do is you go and blacklist the a piece of your firewall
which you know we all know is the most irritating thing to have to do because
you know it's not going to do anything it's gonna stop they're gonna come back
from somewhere else but that's what your incident response process says you
should do this we're gonna do do and then who here spends most of their days
playing IP address black whack-a-mole just right and it's working on game yeah
it's a great game got me this far I guess I made me the all-time high score
it just it it's stupid it doesn't work and we'll get into my later it does it
can sometimes do very basic behavioral analysis and that's you know you're
talking frequency analysis you're talking hey this we've seen this IP
address make five posts in the last three seconds that's probably something
automated that's probably an attack you should probably do something about it
and that's the best you're going to get out of this is just guessing based on
that it'll do some kind of fake fingerprinting based on like user agent
and I think she DB header order and content and say like oh we know this is
the same person because the user agents the same or it's not the same person
because the user agent changed so there's no way it could be the same
person right what you can't make user agents know is that maybe we'll talk
about that later but we'll dive into that weird fuzzy realm of faking HTTP
header data later it gets crazy kids but overall they're they're extremely
trivial to bypass in most cases because you can just go low and slow and head
right in you can do plenty really cool obfuscation of your post data to bypass
the screen inspections of the lots are doing on my favorite examples is who's
he's asking on that great super simple excellent SQL
who's who's used the loft bypass mechanism with an SQL map we've seen
this it check it out just do it for no reason it's a it's a quick switch next
time you're running SQL map just turn on the waffle option station or the waffle
I know something station I know it's really hard to tell here this now that's
even worse coolest thing so basically it just it adds in all kinds of
uninterpreted data in the strings that the waffle look said it goes nope that's
deaf but it doesn't look like this girl needs probably fine go ahead and come on
in so i'm brown basic wasps aren't really useful anymore they're just been
annoying stats up your day but doesn't mean i'm compliant insecure yes the more
sophisticated class we've been seeing yes so there was you know a big surge
and stuff like cloud-based wafts right when we realized going prem on sucks and
it's not scalable a few companies decide the right let's let's put this in the
cloud because that's how we solve every single problem these days you want to
list a few that may know what okay because i'm a shit on my yeah yeah so
it's a mostly mostly reverse proxy sometimes you know they're more
sophisticated dollar bob check that you know you can set HTTP headers because
again only browsers can responsibly set cookies and other headers that they're
they're challenged for and they'll cream also piece together fingerprints on
particularly the HTTP layers so looking at right wall you know this has you know
content type except user agent and then whatever header that's kind of finger
grid on that mint see if we can track them around again you're trying to track
someone based on something that can be changed with a single line of code
yeah they're creating fingerprinting based on things that are they used to be
smooth and easily rotated with every single request or could easily come from
maturity different companies you may see this kind of block built into maybe the
CDN that you have already the hive kind of
they're whatever they call it off when you turn that and it's like now I have a
wife I guess and fun fact they usually reversible and what security was it
almost all of the apps are actually one security with a few custom rules yeah
and a few extra rules and a few extra line items on your bill yeah it's just
not security so this is predominantly over or we could be talking about okay
but yet either or they're both pretty much useless these days for the reasons
that we mentioned they rely on information willingly provided by the
client which we should always assume is malicious and then they trust it and
they go no this looks fine to me problem must be somewhere else so let's let's
talk about how to fight best things as a penetration tester or something else
someone who's testing your defenses for one reason or another we're not going to
ask you guys why you're doing this but you're all here because we're super
interested in that here's the bare minimums you need this is something you
should be doing every single time against every single external target
that you have regardless of your knowledge of what's going on there
this is when you're writing your curl scripts this is when you're writing your
Python request script something like this this is what you just need to
always do and I'll go through some examples but I think you have to see
step first up here who here has a without business that totally lets them
block residential IDs don't be shy it's literally nobody right nobody's business
is going on the clock residential I think why because the potential for that
being a paying customer is super high so what should we be doing if we're trying
to break into somewhere use residential I'd nice well how my residential it
means what's that residual IP cost like for you what kind
suppose Comcast want that 60 bucks per ID per month it's insane for this we're
like one Comcast and then public I'd be at the game I drop these Comcast
business and she's like 100 bucks a month minimum and then you got a five to
ten bucks per that's nuts so then the other got one I beat to our piece well
something else you can do is just rent an entire IP block from any other
companies that are out there that let you least those two of my favorites are
monkey socks and who wants to guess where monkey socks Illuminati get the
residential a piece from free VPN three free VPNs we're gonna wait it's not
malware what do we call that this potentially unwanted program
so is he most of us the service did you agree to it he said yes yes crawl to me
check the checkbox this is super easy check the Terms of Service we'll check
the Terms of Service and everything you run right that's that's every Monday and
Tuesday my weakest is reading the Terms of Service and whether or not they
monkey socks Illuminati have some really fun ones that say by using personnel
illuminati wishes says who is hold on BPM goodness hole up at the end it's
commonly used to get television shows in other countries most often especially if
you're watching sports cricket football
part of the Terms of Service says hey by using our free VPN you agree to let us
use your computer as effectively a negative exit note just like a tor exit
note so that random crap comes out of it you're effectively allowing botnets to
use you as one of their sources you're hosting malware
you're hosting malicious activity from your home and you have no idea because
you're just watching a cricket match in India monkey socks is super cool because
they actually have an SDK that they sell and then if you want to make a free app
firt and you know the free android app but you still want to monetize it you
throw the money monkey socks SDK in and what it does
that re uses existing connections in your phone to also do this thing then
they use as an exit node for these botnets so this is how like so many
Android phones are operating as these botnet appeals like how is it happening
but Bauman's not infected the phones aren't infected you agree to install
this software in that the app is required to put this little blurb inside
that's easier by you to check the monkey stocks XDK it actually provides the text
early clue that says please add this two terms of service that's the most
terrifying thing and it makes the hair the bathroom that bristle this is going
on so they may be so illuminati is jolla VPN so you go to them you got a monkey
socks you go I need X number of residential like these for this amount
of time you came a couple of bucks and now you are loaded up with effectively
on black list of all my keys eventually Goethe says bars to give you a refund
easy are enemies of laws and you can pay me more and get mobile of residential
networks as well yeah guaranteed that's great if you look at a request that
comes through the hole of a peon yeah there's literally an X that's all ahead
up so it's very difficult to detect if you want to block the whole uh VPN
appease you can look for that next sexuality being hunter but you're still
at risk of running into the business because also locking Hannah's used for
legitimate legitimate purposes very good you are at risk of blocking users so
that's it have fun fighting that fight so now we have effectively have an
infinite number of unblockable IDs we've defeated the only line of defense pretty
much everyone in this room said they have against this is the IP waggle your
dad okay I think you leave loominatee is super easy to like plug into almost any
app that you build like even burning during the job plumbing which is
phenomenal yeah it's it's the best there's there's
JavaScript libraries it's Python libraries for loominatee don't worry
about it I'm not even going to demo the code it's super simple and also you know
there's time after that make sure you're rotating your user agent this is a thing
you can do who does so like everyone's smooth their user agent right there's
like an infinite number of plug-ins for every single browser out there that lets
you create your user agent who knows how many use valid user agents there are
known to be out there me neither it's in the thousands I compile the list it's um
I give up so you need a list of all user agents at a flight text for minutes I
make it happen later because I use it rotate that so much loft based
blacklisting go and whitelisting operates just based on user agent or
user agent and one other easily smooth the whole thing so you can hide yourself
from being detected as like the same person so you're dodging behavioral
analysis by every time you send a new request is from a new ID with a new user
agent header nothing catches it or if everything you're doing is getting
blocked you may be attacking a very lockdown edge device that may have user
agent whitelisting set up where they're expecting only say some kind of
automated process that they've built to connect which as a custom user agent or
uses some penance it's very specific user agent you can scroll through 4,000
user agents until you find the ones that are a lot there and then go from there
typically monitoring software is a good place to start with that oh yeah yeah
any kind of like heart be there uptime monitoring software smooth those smooth
those user agents because everyone whiteness
because we need them to get in to make sure our websites out well now you're
telling them but that's who I am and they just blindly trust this crap
because they use it before the symposium as well and again rotate all of this
every time you make a request if it's possible for what you're doing sometimes
that'll break a few things but definitely give it a try also this is
something I see a lot of people miss U's cookies and there's there's that so
that's a wide recommendation authorized sessions so the sessions you can walk to
and then get you know your session cookie from that often has a lot more
lenient behavioral analytics going on behind that you can often get away get
away with a lot more requests per IP or this and that if you have a valid
authenticated cookie going on there and usually it's as easy as just putting a
fake account on whatever the site is and then grab them to Cody in rolling
sometimes there are certain session cookies that are absolutely required or
you're not getting anything so that's of course critical but also watch out for
these sneaky sophisticated web cookies that a few vendors use where they'll
inject them into the responses and then your browser will start using them
regularly and then actually helps them track your behavior so even if you are
rotating everything else the fact that you keep sending back this cookie with
every single request lets them know hey this is still the same person and it
starts wrapping up your analytics totals and then you're going to be busted so
that takes a little inspection and eyeballing of the traffic that you have
going back and forth but that's very much one of the options that simply want
to use and sometimes it is as simple as just making sure you don't provide that
cookie when you send the next require for requesting like certain cloud-based
watch providers or just if they cookies not there it assumes you're new but then
again some requirement so this is where it takes a little bit of playing around
I think the end of that yeah we'll talk about in a bit but you can call them
they sweeten something like a phantom cast or
like endless growth a puppet to you where you can what page hopefully
because outlet shopping straight into another tool
yeah well that's look at that later on so this is again this is all the basic
stuff this is what you should at least be doing and this is in any code you're
writing this is your little JavaScript your curly or Python whatever at the
very least do this and this is going to bypass what percentage of these
sophisticated locks I think basically all of them it's it's ridiculous this is
something that we discovered recently and it's just it's ridiculous how many
people don't try this how many attacks out there a human at Bob are just not
employing these tactics that are super easy to do and then they go up I guess
they have defenses that we can't get past and they just go away if we saw
someone try to bring false credentials on website which they should have
probably Samantha needs to make literally using Python as the easier and
you know yeah just do the fuck you ain't for Python request library so what I
will do for you here and I know it's kind of hard to see but I'm gonna try
walking through to anyway I have who was anybody half cuz Canada last year
probably not that's it so I was at Heco's Canada last November and I
computers I know this is tough but I'll just okay so I've got an open mic github
there is a Python script I wrote so you scrape the fentanyl public few remembers
the whole fennel debacle that happened last summer where the everyone was like
oh my god the feed is public I can everyone can see what I'm spending money
on and who I'm sending money to and then I was like yes
like fine and all the media got on them and memo was like yeah the users want us
to stop it we'll stop it and then they didn't anyway so I wrote it to a bet
we'll scrape that public feed but venmo has a lot of controls going on to
prevent you from doing them because that okay so if you check out my github look
at the deep end mo Michael it's been more than even a scraper and in there
you'll see not only I wrote a system here on top that goes in and
authenticates against their login page and actually exploit something I found
where they will issue an authenticated session token prior to a new account
being confirmed so effectively you can just flooded with new account creation
all day and it will give you valid session tokens even if you don't go into
your email and confirm it so you flood it which is fake email addresses and
fake information you do need a phone number that hasn't been used over and I
you can go look at my head cuz can't even talk it really goes through this
but I ended up accidentally blacklisting wait just thousands of people's phone
numbers so if you try to find register for Bend on your phone it was like this
numbers already in use apologies I hope any event owe you another cookie and
then he used that and I found that that let me use way more requests to the API
per IP address versus not having that so it makes you have to rotate those like
diesel s less which is super handy and then further down can you guys see this
at all there's this a total waste of time
okay well so I need for the way down there's another function in there that
shows you that rotates on the user-agent header so you can go ahead and grab that
for my code and plug that into whatever you have you can grab most of this and
plug that into whatever you have and it's going to be useful and I even have
the full list of like 5,000 some user agents inside that github so you can
just literally grab this block of code and now that's your user agents which
are rotator I did that for you so that's enough of the super boring code demo
that no one can see let's let's go back to time I wonder what's next is this
useful you guys digging this yeah are you guys surprised at how easy is that
this is and upset no I like to know who
already has ideas of what they're gonna use this for now I didn't know when he
wants to put a hand up alright so like that's all your basic stuff that's
that's gonna get you past well I guess we said it literally everything
basically everything but anyway let's talk about some advanced stuff you can
do in 2021 then stuff no longer works I guess I don't know they disrupt so when
someone disrupts this industry like someone we know who has a new idea of
how to defend against these attacks maybe we'll talk about that later Hoshi
you see this is the the man they busted into the convenience store with a bunch
of ostriches and Lucien are craftsmen totally expected how do you fight
against it even if you are armed and ready for someone to break in
a luchador busting with a bunch of ostriches you're not ready you just
don't understand splitting this workout yeah this is enough so yeah so the trick
is the trick here is to be both Volusion torn and the ostriches write that down
we come at them with everything that was not expected so say you're up against
something that you just can't get around you can't figure out how it's blocking
in this is going to be basically your attempt at this is going to be the hard
and slow path but it's got to be what's necessary at this point this is
information that's what you're looking at mostly here is your general edge
enumeration process and then even before the event esters in here cool think it's
more over here that's me so this is this is a contempt if you're
not familiar all these this is not a figure out what's going on on the
clients edge and everybody's running blue team you just need inventory this
is also something you should be doing instead of just trusting what IT gives
you as a list of servers they have this thing to the internet you gonna want to
find the essence that the target owns and you can usually do that by two to
three really quick errand well because we know Zarin this should be everybody
so Aaron is the american Registry of Internet numbers that keeps track of who
owns what IP addresses mostly so it's a great place for the query for Americans
at least you find domains owned by the target and then you plug them back in
Aaron again you just compile all these IP blocks that they have but he just
kind of lives like you've lost and will get everything that's out there and then
you maneuvering everything that's up that as a web web server listening
because we're talking about HTTP here we're talking about layer seven class
and then you go from there I wrote a tool and a couple of companies
ago called stand here again scam Canada's up on my github
to do most of this enumeration when you're dealing with massive global
entities so it's up there and you can use that and it does the air lookups and
it gives you a whole ton of flat classes here's all the web servers and you can
take that list of web servers and you can plug it into an audit some
automation your browser to load all those pages and then what you're going
to do is going to look for the forms you're going to look for whatever you're
trying to exploit is it a login portal is it a customer loyalty program portal
is it something where you have a text box where you just want to fill out a
bunch of information into that site you're going to go through DNS as well
and this is pretty much the same thing but then you've got your reverse lookup
on the IPS that you discover that are listening you find out keys that are up
in those air locks your reverse up keys to find domain or subdomain that were
registered to those and start doing this process again against no see where those
ended ups and then also like look at the nomenclature used in these can you guess
other server names that might this company might use based on the ones
you're already looking and trying furring a lot of this stuff look at gns
history look at try to do dns zone transfers who knows what a sudden
transference this is super common you can believe how many public DNS servers
are susceptible to its own transfers effectively allows you to dump every
registered name for every IP address that they have you just ask for it it
goes to there you go and so there you go and then you and then you can even start
doing your dad's name fuzzing there's no end of tools out there that'll let you
do that and that's just literally punching like throwing everything in a
DNS server and seeing what responds to the purpose of this is we're trying to
find the the actual edge of this company not that reported edge you're trying to
find the origin servers because you're going to try to attack those directly
instead of having your traffic forced through the wall so what you're doing is
you've got the super-complicated wofe that's just stopping every attempt you
have so go around it figure out how to route your traffic around it by doing
this if you can find an origin and if you can get a packet to that virgin you
beat the lock it's used it's out of the picture you're talking
right to the origin and that's a real common to because a lot of people don't
put up proper firewall rules in front of those origins they say oh we got a lock
protecting this web server now and all that traffic goes through there and it
stops all the bots but they didn't think to make sure only that wall can talk to
the origin so I could just go to the origin done do you have this one yeah
rabbit notes is super useful when some of your attacks again through
but you know optimally like 10 or 15 requests they stop when you build a
distributed system it's very very difficult you know you can literally the
global system to actually sync every single edge node from like a just
something as simple as how many requests in a Chinese name so if you can map out
all the edge notes for a given cloud-based solution and smash them
sequentially as soon as one gets locked you may or may not find that you will
get more requests through than you initially put you shouldn't and some of
these may be up like a 15 minute rotation and you may be able to do again
every 15 minutes yeah so it's not actual round-robin were
you sending one request per note per woth know that you found each time
you're sending all them to one and then once that starts blocking then you send
it to the next because of that delay in syncing all of the block information
between the three of them and that's usually they're not 15 minutes well for
somebody who's on it's a 15-minute delay that sync happens every 15 minutes so
you can plug the first lock moment get blocked just go to the next one who has
no idea that that same vendor has blocked you
elsewhere because they only sync every 15 minutes and then this negative sign
because it's often like I'm massive list and as you just need to paint one
additional Center UID and you do it all again on the emptiness origin side of
things as well that's probably the one of the best techniques like if you could
use DNS these three chicks and figure out what the origin server may be there
may be other ways to do it if you do some googly but yes it's very reasonable
because doesn't matter how good you want in black bees if you can just access
that stuff directly talking about your LDAP rules themselves
CBN's who who managed the CDN der has managed a CDN in the past you're
familiar with the CDN set up not many people go what if you're a real quick
CBN's are content they're basically used to take the load off your origin servers
they cache a whole bunch of stuff but it's it's your images and videos and
crap that you don't want to have to constantly serve as these high bandwidth
items then also don't change that outside of your website so your traffic
will hit the CDN first and the CDN will give them all the images and prepa that
would be for and then it will send the rest of the requests that it can fulfill
that's your word it knows what I mean by origin by the way that's so origin means
the web servers the web's the actual web server running on your edge that serves
that when you update the website that's the thing that gets updated yeah one of
these simians have gone really really sophisticated and people have started
putting their whacks at that same way up one of them will get some problems but
common implementation profiles which is something you definitely check for is
different particles maybe hitting different origin zones will be treated
slightly differently in more than not they'll actually have different
configurations for amount of security and blogging perspective so if you can
test many /login may be treated completely differently to slash register
for example if they different back-end apps yeah what he's saying is there's
rules per URL path and CDNs and oftentimes those are
implemented to troubleshoot an issue like given a web application you find
that when the requests were coming through the CDN it wasn't fulfilling
them properly so you quickly one listed it in your CD and slash web so that it
would just work anyone stopping any customers and you'll get to that later
or the web app team is currently trying to figure out what the problem is it in
the meantime we've white listed all of that and so you can use that to find
these natural white listed URL paths so you can follow us through individual URL
paths and find that oh wait my traffic gets through of my hip this look for so
look for other wordles or other pages or paths within that same
domain and maybe hosting something else you can use for your goal so say you're
trying to find a login that you want a brief force look for other portals on
that domain that may have these white listed path rules going on so you might
be getting blocked at one and they find something else in it small things in the
same database so that's great and then also it's been white listed for whatever
reason maybe it's a super old portal that was created to support your your
ie6 users which are still out there and you come across these things bananas and
long story short for whatever reason you had to whitelist it
so like fuzzing URL paths the super important here don't don't give up just
because you're getting blocked right out of the gate again some may be accidental
or intentionally unprotected we've all accidentally made whitelisting rules
right with all accidentally made it blacklisting rules that let way too many
people in or stop too many people from getting in we've all done it it happens
a lot it's out there assume it's out there go find it the other side of it as
well as most of the time at least in organizations I've been a part of is
whenever there's a new code push the wife I'll have to go back
learning mode because there may be use data and like boy you feel Stinson if
you can figure out what your organization's doing these pushes that
could be put up to time you will attest because that all behavioral analytics
just set back to zero and you can start again yeah fun stuff
and then like finally try to find a name like if you're trying to say this is
mostly for scraping data but also can't often and use for authentication
sometimes or pretty much anything if there's an API that lets you do what you
want to do try hitting the API instead write something that interacts directly
that API often times you'll find that API is not protected the full website
the web application will be protected and then the API is just completely open
facing the internet because they don't expect you to connect to it because only
mobile app is supposed to protect her only the register official mobile app is
supposed to connect to this API so we don't have to protect it
there's a lot of class that can't even fill some API traffic like they just
like on JSON what it's meant to be application code of Jason he's the guy
with the app so it's fine let Jason it's great yeah so look with the API I'm like
yeah like Sam said oftentimes it's geared or the clients or the customers
may not support API protection don't hit it that's it then you hit that with curl
at that point you don't have to write take shit yeah or do whatever do
whatever you want yeah like again most mobile apps use an API that has to be
hosted on the Internet and everyone's going to be mobile apps for stupid
reasons now so let's see what we're gonna find the origins we talked about
that you're using tips for finding the or
a lot of times these origins are obfuscated and they can be outdated by
using 1/2 or some kind of UUID and so if you can at least find a few of these
when you're doing this DNS lookups this DNS zone transfers whatever it is where
are these weird ripples or characters there's probably intentionally an
obfuscated origin server trying to figure out what the nomenclature is for
that is it a type of passionately generate then you can you know start
just generating hashes and brute forcing it at that point if it's you're kind of
pushing your luck at this point but it's something you can do yeah if they're
running on like a public cloud provider what you can also do is just smash that
public cloud providers IP space below balances with the HTTP host him that
you're expecting to send or from them what eventually you'll get a hit and
then this gets this gets a little weird because it's contradictory like I said
before you can look for and block these a lot of these wasps will inject
JavaScript into the responses that are fingerprinting mechanisms or something
of that sort and they required those to be run to prove that you're an actual
human being inside a real browser instead of curl instead of Python
requests oh thanks in the example mean when cloud flies that need to be
checking your browser yeah the little three bouncing falls it takes like eight
years to complete that's what that's doing it's running some JavaScript in
your browser to make sure your browser the browser if you can find that and
just make it not run sometimes depending on the vendor it just lets you in just
goes cool so you know you're running to the whole thing just say when you see
this just ignore or some of them require you to run that JavaScript so try that
as well it's right not blocking and actually executing it and then it'll
often give you back a cookie for your session for completing that little task
and then you have to sure that she provide that cookie that
you were given with every session so try that or unleash the box this is bliss is
way creepier you can't see in a super demon tariff make you stare at this so
failing all that you're scripting isn't working your JavaScript your etc just
you can't figure out what's going on something else you can do is actually
just try automating an actual browser and there's a lot of cool stuff out
there that does this zombie chance and phantom jsr zombie James I think is no
longer supported Vantage asks is I think that supported by their creators anymore
but still super widely used tons of documentation out there tons are good
with Google information and how to use is out there headless chrome is probably
the most popular it's a yeah headless carbon puppet to you yeah headless
chrome and puppeteer learn to use these too this is this is devastating because
headless pro is an effectively chrome but head listen okay and then puppeteers
an external utility that feeds headless from instructions on how to operate and
to most everything getting the requests from endless growth it just appears it's
a normal human being using Chrome does everything prune does it processes the
JavaScript it responds properly it accepts the cookies it properly sends
those cookies back when needed it does it does anything that JavaScript tells
it it's super hard to detect that it's a headless chrome version instead of an
actual chrome version unless you're us so yeah that's just try ever who's used
to tender scrub before anyone how that's cool yeah isn't it devastating doesn't
it just work it's great stuff highly recommended scriptable is about
expertise on campus good you can spin up effective leaves many instances as you
have system resources for so you can have a hundred thousand separate browser
assistance coming from and that doesn't necessarily look like
weird behaviors because when you think about say a college campus or a hotel
chain or something you're going to get hundreds of thousands of connections
coming from a single IP so it's not that big of a deal
and we definitely see that a lot I mentioned the rent man because I'm used
to rap back that's me because they most people never hear this and they really
like it but I recognize is a it's a web app vulnerability scanner that uses fans
of j/s to do all the stuff to bypass a lot of that stuff and look like a real
human beings here even if we get a lot more accurate data but our data out of
website you're scanning versus something that would have things in front of it to
stop it from doing this and again the puppeteer in this garden is also
plug-ins for Illuminati say you yeah Illuminati has that business model down
like they said yeah we'll give you some places will give you a public IP or
residential IPs and say they're here here's an undocumented ABI maybe I need
to hit to get them good luck before I don't know we'll just give you some
numbers and they're years and you have to figure out what to do at this point
so many people use Illuminati but there's been so many tools and libraries
to just leverage it so that even like the most beginner of engineers can stick
that into whatever script they're using so check it out but also they snuck in I
hate them so like now that you've got this like phantom Jas puppets here
headless chrome nonsense attacking you that nothing that you currently own can
detect and block what can you do about this you can use this is super - no
switch we've created a product and Cassata called poly form that is so
insanely good at fingerprinting the the the client-side environment on the very
first HTTP requests that it can tell if any of these tools are being used and
also any automation tools that we're not aware of something home them we can
detect gift something is being automated client-side
on that first request and that's really important to prevent against scrapers if
you guys work for a retail site a list excitement car listings hotel listings
if you're selling Easy's that sort of thing we can catch those price scrapers
and stop them right out of the gate and then some secret sauce I know I'm not
getting any sales pitch up here if you want to talk about their hangout later
I'll do some business cards up here so you can grab them that's awful but
that's what you have to do you have to do something to fingerprint and find the
automation that's running client site and you have to look for that you can't
trust the data provided in the HTTP headers you can't trust anything
willingly provided clients item you can't we come up with a number of people
who have built some really interesting in-house protections against this but in
the end they come up short because we've spent years and literally millions of
dollars figuring this problem oh but but but that's the end the bottom line is
don't trust the information you're willingly provided to go get the
information you need and don't get it by asking get it by figuring it out
client-side and that's the most coos I can give you on that so if you want to
find out what exactly the defenses you are also currently running and Fred of
your websites are able to handle what they're not able to handle so that you
can at least start focusing your efforts where they need to be we're gonna drop
this today this is super fun we've made this website called bat or bot Bank so
Mac is a common female name in Australia I just love this name it's backer bot
and you can throw in any website you like down there and on our end it spins
up a whole bunch of instances of various types of attacks everything from your
basic purl bot all the way up to sophisticated puppeteer running headless
Chrome and it'll spit you guys who try to send your phone right now the mobile
site totally works it's back to our lot dot Quezada dot IO Becker Bob decided
that IO I'll show you guys how this works we've
been playing this for a few dates here just waiting to satisfying to just run
on random websites yeah so only run this on websites you oh sorry that was the
actual website okay there it is only one of this on websites you have
permission to run it as you want me and I just work here
what a question try that yes give it a shot she wants
that time build a bomb to maybe Daniel and then once you're sufficiently
furious give me a call so yes it stand there and then sixty few
seconds it spins up a whole bunch of crap and attacks the site and then watch
how simple this output this is so we see that heritage Network totally random
site that I just guessed a word equipment it's an actual site sorry I
didn't mean to do that
so we see here it's acceptable the simple bots attacks that's your curl
that's your Python that's literally a commis agent hello yeah this is yeah
this is the most like this is that we did nothing to discuss what we were
doing attack it did blog fake a Googlebot so there's tons of stuff out
there that pretends to be SEO bots given them failed everything else I'm
wondering if this site actually should intentionally walking SEO BOTS maybe
yeah and then it is susceptible to fake browser tab which is like your phantom
jets etc and then it's acceptable cut the heavens chrome attack so these
people are hosed they have almost no defenses against any kind of like
automated scripting going on I don't know it's fine don't worry about it
yeah and so this tool we have is it can protect against all these things it's
insanely effective it's hilarious I've estimated I spend about 28 percent of my
day laughing and all of the bots that we stop all the automation so we say BOTS
but it's really any kind of automated tool tool kids that are going on so got
its we have our product up in front of Kassadin and io go ahead and try a look
at it if you find a way around it you win the prize hit me up to find out
what the prices might involve a black bag and a knight and a ride a really
cool car but yeah take a crack at it and if you would like to have that
production front of your site definitely it's not gonna throw some business cards
up here and we'll be on the hall to talk later and answer any questions you guys
got because we're totally out of time so I hope this was useful overall thank you
guys so much and I will see you the rest of Cybercom
you