[Music]
yeah I can can jump right into it here
um afternoon everyone welcome to the
presentation watching the Watchers
analyzing URL scanning Solutions at
scale all of the images throughout the
presentation for the most part um our
marketing guy helped with some fun ones
you guys will laugh those but most of
them are generated by Dolly the prompt
for this one and most of the other ones
you you'll see um was let's see make me
a red honey pot with a cyber security
theme and have honey leaking out of the
side did not spell honey right once
the so um yeah quick quick about me uh
Nicholas ay director of technical
operations at SP security and a more so
hacker at heart right um I really enjoy
python a lot of this is uh python work
and then kind of some some JavaScript
stuff um Candy I most of my friends and
family can attest to that um and really
like running just did my first like
marathon length run like a month ago now
so that's become a big hobby for me
outside of all this so um before we dive
into like the topic at hand I kind of
want to touch on a bigger IDE in cyber
security um there a little bit of
animosity between Defenders and uh the
red team right and I'm just going to go
with it because I'm one of the red team
guys but uh you you'll hear quotes kind
of in the the Twitter cyber security Z
guys Defenders only have to make one
mistake for the red team to win and
while that is true to a certain extent I
uh I think the blue team has a lot more
money and a lot more tools that they're
sitting on in comparison to US it's you
live and die by your data as a Defender
right you have Sim edrs everything is
kind of feeding a central sock whereas
uh I'll just jump to this slide here and
it's the great explanation right um
you're on the blue team you've got all
of these these tools to work with and
big budgets where as uh you find
especially in uh smaller consultancies
or even red teams like giant Enterprises
you're you're working with about
$3.50 right so dysfunctional open source
tools things you're having to fixed and
work on C2 solutions by we put crazies
in here if anybody follows Twitter I
think we all know who we're talking
about blog articles Twitter feeds which
can't knock them they kind of make up
our our job we're super helpful and
maybe in-house software Solutions if you
have the the time and resources one of
the cool things about the sprocket is
this is not a plug it's just more like
something I really really enjoy about
the the organization right where we're
at the company um get a lot of time for
research and development and we work
with clients continuously so when I work
right I test against clients we do some
hacking but we also spend a lot of time
on research and development because
things are changing so frequently I
think everybody in the room here knows
that we get to kind of cater to that do
some cool stuff um so coming up against
all of the those giant Security
Solutions the the question is how do we
take on that Enterprise software the
giant crowd strike license all these
these different things um build inhouse
software Solutions right and they're
still just about as hacky and
dysfunctional as uh um you know I'm
showing here but uh they work for us
right so um on the slide there there's
my slack picture um driver seat and
Casey are wonderful CEO in the side of
car there and this is big thanks to Owen
our marketing guy said put Casey and me
in a truck and this is me what he did so
um then with all that in mind uh let's
talk about white fishing sucks um they
yep there we go uh it's uh it's got a
lot more difficult so I uh the analogy I
like to use and if anybody was at Deep
608 I used it there but uh big fans of
Leed Zeppelin or Bob Dylan right you sit
now and you wish man I could have wish I
could have been there when when he first
performed or I was in like a little
light club watching watching perform for
the first time well I wish I was a
tester when they were sending out 100
fishing emails and getting 100 call
backs with their pays um that is the the
day I dream for right U Casey here in
the crowd they talk about shell hurting
they had so many shells coming in on
social engineering engagements that they
were like having to manage them
differently so um kind of exciting but
not the case anymore right so the big
question we're asking constantly now is
why aren't my fishing emails Landing in
users inboxes and we ask ourselves that
but it hurts more when you have to have
especially with our continuous testing
we do it you know quarterly or more
frequently and um nowadays uh one thing
to keep in mind in the past when we
talking about the good old days with
with the Bob Dylan LED Ze first concert
days um attachments were a thing right
you could well honestly you could get a
beacon out of cobal strike attach it to
an email and send it to somebody
probably were um nowadays uh you it's a
big no no to even create like a
malicious document and throw it into an
email and send it out the door right
it's not going to make it past an email
Gateway the message vulnerability that
was talked about in Outlook a couple
weeks ago now um was an exception and
the the threat actors that did that
focused on message files specifically
because that's one of the only files
that's still circulating internally at
at organizations um so what we do now um
is instead of attaching a malicious
payload or or something like that in
instead we create a link and we either
post our file there and we'll send it to
the user or we'll create a landing page
so we pl the Gite login page or whatever
it might be and stick that in an email
the tag path right now kind of looks
like right I build for report and then
the user responds and then eventually I
get them on the lure and I send them a
link they click it and enter for thing
that's tough um Security Solutions have
gotten really good at scanning those
URLs that you're inserting in an email
um the the great kind of examp this this
wonderful flowchart or graph here detail
shows kind of how that process happens
so I sent offici email the link is
identified in Mission email it's
ingested by that email gameway firewall
whatever whatever's in place they scan
it and then look for specific indicators
to determine right um if there's
malicious content there they might hash
the the Google login page and look for
specific changes on your clone login
page and domain they're like relatively
complex um and then they determine based
on that if they want to block you um and
so what uh uh well yeah so with all that
in mind right how does that crawler
itself work when uh you send that email
the links in there they crawl it access
it um very similar to box in the real
world um the analogy or thing I always
referenced a couple weeks ago saw a
LinkedIn job posting for an antibot
front developer because they get their
shoes bought so often people are buying
thousands and pairs of shoes under the
hood the Crawlers that accessing links
and scan them in emails for basically
the same one they use headless Chrome if
anybody's unfamiliar headless Chrome is
just that it's Chrome without a Google
so it you can programmatically
orchestrate Chrome to perform different
actions and nice thing about that is you
can render a full page so in the past
right um scanning Solutions and other
their Crawlers they just curl or make an
HTTP request and they get the raw HTML
and they look at that for indicators now
with headless Chrome and because
attackers are getting more Savvy to that
they gotten very Savvy to it um you have
to actually fully render the web page to
to see what's there um headless Chrome
emulate user clicks interaction form
input so if you wanted to access a login
page um you can um yeah they can
simulate like
user and scale millions of
URL right so um how do crawlers get
detected this is kind of you start to
think about like all right this is how
the Security Solutions are scanning by
Links how are defenders in the real
world detecting that that b right almost
exactly the same kind of process of
collecting information from website well
we got trer detection Frameworks um
everybody in here is probably familiar
with web application firewalls or check
box on PCI DSS Stu so Cloud Player Cloud
front HD and the way they do this
fingerprinting to determine if right
headless Chrome is accessing their
website or a website versus a real user
is they build all of these detection
methods if you go to the chromium or
like play right or selenium you go to
their GitHub page and look at the issues
where are thousands of them saying I
can't fight past Cloud flare with this
right um and I feel so bad for those
development but this one here by the way
the image I told Dolly said show me a
visual representation of a web
application fire wall and put honey
leaking on the side of it so that's what
it came back to me um but regardless so
we we looked from a big picture how
those Bots are detected under the hood
there's all of these different like
people source code of Chrome but and
said headless Chrome does X Y and Z and
then people try to bypass that it's
really the same cat Mouse game between
these crawler detection Frameworks or
web appication firewall Frameworks and
the the bers as it is like us trying to
write payloads to bypass EDR it's just
back and forth and back and forth and
have a ton of appreciation for the guys
that do it um as long as they're doing
things properly right so uh how do we
bypass those scanning Solutions in
fishing emails right now um this is kind
of important to note because all of
these are becoming Antiquated and very
easily detected nowadays so HTML
smuggling won't go to it in too much
depth it's not what you guys are used to
with the web application testing um port
swiger and they had all that that
research instead HTML smuggling you take
a file you embed it in basic support Cod
it Crypt it story in
JavaScript whole thing P redirect rules
a project I wrote a long time ago did
this
um it's called sneaky proxy basically
when I send a link in an email I put a
reverse proxy in front of it and I say
if the IP that this request is coming
from is associated with AWS or gcp
that's probably not the end user
accessing my um and then I'll skip over
the last one cuz it's very very
anecdotal but uh kind of neat so all of
this St that was a lot of information
but um
basically the the problem that we were
having with social engineering was I
would get a user on the line I'd send
them emails back and forth I'd even use
the o365 like web interface instead of
some automated method by the time I went
to send them a link that had a payload
or a g Suite loging page on it it didn't
land in their inbox so it looks like I
never followed up the client would would
say something like well we never we saw
it blocked on our Gateway is because the
URL that was being sent was getting
detected somehow um and the security
solution was blocking it for whatever
reason so you can say two different
things right you can play the cat and
mouse game between these Security
Solutions and your url so you can try to
figure out if I put an emoji in the
title of the page they might not
detected or crash to have this chrome
instance or you can fingerprint the
solutions that are crawling your fishing
page the same way that web application
Fireballs fingerprint box crawling the
Nike login page or what whatever so what
htd pot is um a honey hom make solution
um is a framework wrote in fast API it
uses a little bit of JavaScript and then
has a last SE on back in for a database
what uh went ahead and did right or
actually trying to see where it makes
most sense to to explain this right so
um just for anybody who doesn't know
real quick check the cables to me I I
feel like every presentation here this
whole past couple days people have been
like talking about um sorry if it's a
cliche at this point but um just the
explanation of what honey pot is and
that's where the HTT HTT pot came from
as an idea so honey pot up there at the
internet right decoy system or network
set up to simulate a vulnerable Target
ATT track C attackers and then the
defender right they look at the logs
from that honey pot they say uh so and
so is trying to group Force the SSH
service on our honey pot um HTTP is what
I don't think anybody's ever kind of
coined this before but a reverse honey
pot so basically instead of tricking um
or instead of trying to catch an
attacker I'm trying to like catch the
Defenders out where I send a link and an
email right the the email is scanned by
the security solution and I fingerprint
them the same way that a web application
playball would fingerprint a box the
website so um it simulates antibot
Solutions in a very hack way you saw the
truck with Casey and I in it right it's
not it's not quite there but um it does
some really really cool stuff um and it
it uh I'll kind of jump into each
individual aspect but uh fast API
application the uh security solution
crawls that link and when they crawl
that link a bunch of JavaScript executes
and the information that the JavaScript
collects gets posted off to an elastic
search database for review and Analysis
with the ultimate goal of building T IND
ators to determine if a security
solution is actually accessing your your
fishing URL and then blck them or
redirect them to another location so to
them the URL and your email looks buty
right
so it's going to hurt when we get to the
end of the findings too even worse um so
uh what I did is uh built this
application uh hosted a web page
including 50 plus different checks to
collect information about the actual
headless Chrome instance from the
scanning Solutions accessing my URL um
when that information is collected it's
dur the last search so I get the pretty
grabs in uh inom and then uh the
individual routes do some fun stuff but
I I want to make sure we get to finding
so I'm just going to break down the the
meat and potatoes of uh of the whole
project here I will not one apologies if
the red is a little bit difficult to see
there uh but uh there is a Easter
throughout the back half of this
presentation here so if anybody wants to
have fun looking for it the fact that
I'm mentioning it on this slide probably
doesn't help my much but um so what
happens right uh with the hcpt there is
an endpoint or web endpoint on the
generate right when you hit the generate
m point or gen all I I went ahead and I
said what Security Solutions and
specifically email Gateway Security
Solutions are out there that uh people
are using in ni every so that list there
um we've got like a very Pro Point ma Fe
a lot of the companies I didn't even
know offer the solution on there um and
then in addition we've got buyus total
and URL scan and only publicly free
platforms that you can ask to scan a URL
just keep that in mind right um at least
as far as I could I could tell that also
have an API that you can varation so um
when I hit that generate all
endpoint a unique URL similar to the
ones shown there are U spit out in a
Json array there is a provider so the
goal of this R is generate a URL with
unique values that whenever it's
submitted to a platform like this I can
track it right I can say understanding
this uu ID uniquely and only once or is
it being accessed multiple times over
the course of weeks or months um but
we've got our providers so I know who
this URL is being sent to and I'll show
you guys on the submit how this actually
happens or it's translated
um and then we got a unique ID that is
correlated with this generation event
that's occurring when I generate these
URLs and then a time stamp so I can link
from generation point to actual
ingestion bya security solution and then
subsequently like The Crawling action
back to the generator EV so you can do
some time based analysis on how quickly
you can kind of analyze your link right
so um then we've got a submit Endo so
all of the URLs that are using that
generation endpoint and now that I'm
doing this I'm thinking a video of this
might be a little more more work a
little bit better here but um the fast
API application when you hit the for/
submit endpoint there's several
functions that do the actual submissions
to uh these different services so those
unique URLs are taken one um is
submitted to virus total and just their
API so really kind of um simple python
here we just went to the virus total
documentation on their API point and uh
with that generated URL submitted it off
to them so they would go and scan it
forced them to scan it which
subsequently result in me getting the
data from them um and uh then uh We've
also got so this is the fun part but you
get into a little bit of a gray area so
there's two portions like I said there's
the API end points fire St RL fan but I
also needed to force mail Gateway
Solutions without a public um without a
public URL scan to actually access these
unique URLs so um that config file there
is actually domains out on the internet
companies that run these different mail
gateways and what I said was what if I
just send an email to them with this
unique URL in it even to a junk email
address and as soon as it lands in the
inbox it hits the Gateway it's going to
get crawled it doesn't matter if I put
the iar string in there whatever it is
they're still going to check my URL so
um that config file there on the side um
so so for example max.com is using G for
their mail Gateway and play wall on the
side we've got just interaction with the
mail gun API to send emails off with
those unique URLs this is what the page
looks like very complicated fishing
email that get sent over um if you look
up literally
a stock marketing email on GitHub I
think this is the one you find uh every
time an email is sent to these providers
that URL variable it's using J INX with
fast API to actually like dynamically
render the URL in there a URL inserted
or this unique URL for that specific
provider is inserted into the
unsubscribed first year and URL path
right there so um not all of them are
clickable uh and the hope is right when
I send an email to match.com with a link
that is specific to Gite right it lands
in the inbox or hits the Gateway they
crawl it and I collect my information um
it's going to make more sense right here
U hi Mom by the way and uh so uh when
the users go to that link uh embedded in
the body of the page it's really just a
blank page they crawl to the lake and a
bunch of different JavaScript is
actually executed to collect information
about the the solution or whatever the
you know uh whatever the Headless Chrome
instance is actually doing to crawl my
page so um there's a bunch of great
examples at the end of actually what the
key indicators were but just to kind of
give some thoughts on what these checks
are doing cuz there's a large number of
them um one for example is a checking to
see if local debuging ports are open for
Chrome so it actually performs a local
port scan of the server that's accessing
me so I can see any are there it also
looks for like AB debugging ports that
you would see on Android or straighted
Android instances it will look at user
agent headers it'll look at TCP
mismatches and I'll explain that a
little bit um try to launch web workers
do all these really really kind of neat
stuff that um I stole from somebody
borrow from somebody that I'll show a
little later on it's also leveraging
fingerprint. JS which is a service for
detecting boxs but I use them to
fingerprint all these Security Solutions
just for fun let's see if I can do it um
and uh so let's let's skip on here
there's a couple boring end points so
once those URLs are draw by the scanning
Solutions uh it's goes to a loading
collect endpoint basically it structures
the data that we're generating for those
headless Chrome instances Security
Solutions are generating for me packages
it up nicely Json and ships it off to to
elastic search um now really been fun
stu um and the the really interesting
parts and probably where I'll I'll spend
most of my time this might be one of my
favorite Dolly images that got uh
generated by the way but um so like I
said earlier on uh we leveraged elastic
search very heavily to collect and store
all this information and the tool was
actually ran twice daily over the course
of like 3 to four months and it's still
running to this day so every day a
couple times a day emails get sent out
to every domain in that list of domains
with unique URLs and then in addition um
the URLs get submitted to virus total
and URL Scan they scan it and throw them
in here so we're getting quite a bit of
that I think is about I don't know it's
like 12200 hits at this point so
different data points to learn about
these different crawlers um one big
thing before I get into the findings uh
you know that big virus total page where
they show you here's all the companies
four or five of them actually scan the
URLs you put in there uh I'm pretty sure
most of them just look at the Domain and
the domain's reputation uh you can see
right as the these requests start to
come in and crawling my link right uh
the amount of requests what virus total
will do interestingly enough is it'll
issue like 20 head requests to the link
to make sure it's up and valid and then
from there they'll dispatch its
different crawlers um really what we
found is there's actually a very small
subset of services out there that crawl
these links so um one of the yeah but
I'll uh jump over to kind of we'll get
into the findings here right so um one
of the one of the big indicators that we
were collecting when a crawler would
access any URL that we had in an email
was the source IP so in the past or at
least if you read around on the internet
the easiest quickest way to determine if
a bot is accessing the URL is to look at
where the traffic is originating from so
you and me right we don't come from a
data center a known data center IP range
we're not our traffic is not originating
from an AWS IP or jur I understand that
it can in certain instances um
especially if you're like hosting Works
spaces there but generally right obh
hosting should not be accessing your l
so um when we look at the amount of
results that came through here um there
was actually only one company and we'll
talk about sentury link that range there
but there was only one company um
originating from Source IPS that weren't
associated with dat So in theory here
right all I really have to do if I want
to block a security solution from
scanning my page or at least to clean up
maybe 75% of them from getting to my
fishing page is to check where the
source IP is coming from and redirect
anybody who's coming from Google's like
hosting infrastructure um it feels like
cheating it's really easy that is what
that's what sneaky proxies that I
mentioned earlier on are those reverse
proxies we're trying to do um this way
we look a little bit more intelligent
about it but um that's kind of one of
the de facto methods right now is to
look for stuff like this so this isn't
like round break information here as
much as yeah I'm not going to call my
other slides but um the more interesting
thing is and uh this was popularized by
has anybody heard of cof before p0f it's
an older TCP uh connection
fingerprinting
tool no h so then we got one H um so uh
back in the day right um I believe it
was a kind of a same Developers s map or
somebody spun off from there if I'm
wrong you can tell me afterwards um
there was a method right when a TCP
connection is initiated to any port
service whatever it might be um there's
special indicators about that network
connection that are being made that
could be linked to a certain operating
system so P back in the day what it did
is it collected fingerprints for large
numbers of different operating systems
and their TCP connections that a making
and if anything connected to Paw it
could say with a very high confidence
that it was a Microsoft Windows 7 system
connecting and it was on this version so
you can look super specific with it you
can also look for Android systems
whatever you like so um what somebody
has written s is a tool called stardex
um I don't like saying it it's it's
like it's like having to mentioned socks
con the other night um
and but uh what zard does is it
basically uh is
a a framework for looking at the TCP
connections that are coming inbound to
an HTP server or web server and then
comparing the TCP fingerprint of that
that connection to the user agent that's
being recorded by the web request so
what you see with a lot of these
crawlers they're not you know they're
not done right they will s their user
agent to a Windows system because I
could just redirect Linux or something
in my my user I could say if a user
agent has Linux in it redirect it
headless chome would have that by
default so they go ahead and change it
but what you can do is look for a TCP
mismatch right and this is like super
super interesting to mean at Le so um
what you'll see is they'll report that
they're running as Windows the TCP
fingerprint that's being initiated the
TCB connection being initiated is
associated with Linux system so you know
they're lying about who they are so one
of the big things we found here right is
a virus total semantic um really kind of
bad you would think oh these other guys
are doing it right over here no they're
just saying that they're L they're not
even lying about it so um that's kind of
interesting and semantic you bounces
around so this one is really interesting
found that a large majority of the
connections or TCP connections being
made to the HTP pot landing page were
lying about who they are so they're
saying they're windows but they're
actually Linux and that's enough to say
right my end users no end users that
were fishing dayto day unless you a
really fun company to work with um are
using Linux on their workstations so
this is another big indicator that a bot
is crawling efficiently versus right a
real real life user um another neat
thing and not as much of a indicator
it's also one of the the older methods
but right we're located in the US um
when these uh crawlers would access to
the links right you could associate that
it with a GE location um pretty pretty
simple stuff uh but uh you know you'll
look at some of these providers and most
of them are us Myers total is an
interesting beast in and of itself and
we can talk about that in a little bit
but URL scan for example is exclusively
going to be a Europe European countries
with L so what you can say is an add the
level of protection on your fishing LS
in theory right um any request that's
coming from an IP that's um outside of
the US just blocking it redirecting it
so it's simple it's not always going to
work that that way and we'll look at it
a little bit more later but um overall
companies seemed actually relatively
consistent with this uh they probably
can dynamically choose the location that
the request is coming from based on the
submission
user but um and then this is my favorite
thing out of all the research um and
it's a little bit complicated so um in
addition to all that stuff that we found
in browsers right you have uh think web
workers of JavaScript and one of our
front end deps is in here and he might
like tear me up at the end it explain
this wrong I'm hoping I don't but um
with uh uh web workers right it's like a
containerized or separate thread that
you can launch with JavaScript in the
browser so you can tell Chrome right
when a user loads this page spin up a
web worker so we can run some extra code
over here and then uh we can kind of
push it back to the main thread and use
it um with web workers they actually
report the platform that they're running
in so it's a web rer platform stream um
now when I report my user agent just
like I mentioned earlier right the user
agent will say Windows 10 Ed whatever it
is but there's no ly in your webw
platform kind of sound that's a pointny
sentence
probably uh the uh what ends up
happening when a user would or a
security solution would CW my link I
would say SP web worker and return data
from it and I'd ask it specifically to
return the web worker platform string so
there's a bunch of different things you
can ask it for like um the user agent of
the web worker you can ask it for um
yeah the operating system version I
think but the platform is what tells you
if it's Linux right or Linux Arm System
that little sliver right there by the
way is Google um they seem to do a lot
of their crawling with um Android
systems so they don't they spin up
headless Chrome they must be really good
at virtualizing it internally because
it's cheaper and more effective for them
to do it at the scale um but regardless
uh if you look here out of all the
Security Solutions that crawled the link
the thousands and thousands of them not
a single one lied about the platform
they were running out so they all and as
far as I know it's actually not possible
in the current version of headless
Chrome to do that I might be wrong there
might be other methods especially
because the latest version of headless
Chrome tries to yeah it's a little
different but um so you can bypass
basically what this is saying you can
bypass every security solution Under the
Sun crawling your URLs by spinning up a
web worker asking for its platform and
if it contains the word Linux in it go
away like and so it's about maybe 10 15
lines of JavaScript to to bypass every
single one of them which uh if we
will'll talk about some sources but
there is actually a guy it wasn't about
kind of bypassing security stuff but um
that said this would be the indicator
for years to come uh probably 2 3 years
ago and he's kind of seems to actually
be right um
so with that all in mind I want to talk
about my favorite uh security solution
scanning my URLs throughout this entire
process um this is not a pretty Cabana
graph but um proof points interesting so
it looks like at least from my
perspective they bought a residential IP
range um to scan all these URLs from but
unfortunately they leave headless Chrome
in their user it so no matter what like
uh they they went to all this effort to
hide where their traffic was originating
from but they didn't really try to hide
anything else it seems to be um you can
kind of start to learn about the
internal processes of these security
companies by looking at like the
maturity of these different products
right Microsoft and Google seem to be
not great at this but getting relatively
good at kind of checking for this sort
of stuff not great still but proof point
it almost feels like an afterthought Ted
onto their product and while proof
points email Gateway there to check for
fishing emails is excellent um this
process right here definitely leaves
like a a lot to be desired um and so
just kind of thought that was
interesting wanted to call it out if
you're going to write URL scanner out
there or you're just going to bot a
website and buy thousands of pairs of
Nike shoes um change your user agent at
least right from head Chrome which is by
default
um so with all this right what do we do
with them well what I want to do or
accomplish as an attacker is I want to
send fishing emails with URLs that don't
get scanmed by Security Solutions the
user clicks them I get their username
and password and I can go do the fun
stuff right um so what we we need to do
we need to take all the findings here
the last kind of three four slides and
there's actually bunch of other stuff
fun stuff you can do here uh and uh
write some JavaScript to embed in my
fishing page so the goal would be right
or this is kind of a snippet of that
JavaScript but the goal is right to
check for this code will check for if
the IP that uh the connection is
originated from the fish world is a data
center associate with tour a known proxy
VN um I don't know where the provider in
this API is getting that is a user field
but it's worth checking for right and
then additionally looking at the TCP
fingerprint of that connection like I
talked about um both are can be credited
to that URL that we can't pronounce and
I've never heard anybody pronounce it in
real life so if anybody knows what it is
but um to check uh it says OS mismatch
but that's basically looking at the TCP
fingerprint that's happening and
comparing it to the user agent determine
if they're lying about who they are and
then finally is Linux or not web workers
up there spins up a web worker like I
talked about and checks it platform
string within that web workers Linux if
any of these uh match on my fishing page
so I can run this JavaScript before the
HTML the page is actually rendered if uh
they match on any of these send them to
creep js. api. web. analysis we'll talk
about that guy in a minute but I just
want to help him out right with data um
the uh code here can be found on our uh
website it's going to be linked it's
it's not great check just team Ro it I'm
not a front end developer but it works
um the apis there are they get rate
limited and that sort of thing but it's
a cool proof of concept so anybody here
who's actually you know you guys are
doing testing and you want to leverage
this effici that's a place you can start
working um I'll talk about like the
future of this right at the end of the
present ation but um and I'll show you
the link how to get there um at the end
but I want to give like major credits to
some people with all this cuz I I know
we're coming up on time a little bit but
uh one one of my favorite presentations
of all time uh is called proof putting
and it's a talk of derbycon I think from
maybe 2018 where a couple of researchers
and we just looked the other day uh one
of them is at n video doing ml stuff and
I forget for the other researchers but
they basically did something very
similar but with proof points email
Gateway where they sent it millions and
millions of emails and looked at the
headers that were being returned and
determined like why that email was being
deemed malicious and they completely
revers their model for detecting U
malicious emails um very very cool talk
um and it's something that I've has had
this idea in the back of my mind for
like a few years since I saw it
originally um this detecting scraping
Services blog article that is the same
uh fellow I think his name is equal kind
of like my name and that made those apis
that are right there he is I don't want
to say a bad guy but his goal is to you
know scrape websites and and actually at
scale like buy products and do the
nefarious stuff right um but uh his he
has this like deep interest in bypassing
these different Security Solutions
whatevers um again uh just real quick
for anybody typing this stuff in uh the
link at the end of the slides will have
references for all these two so you can
um find the the actual URLs for these
pages and finally and most importantly
um I could not have done this without
the evading uh link standing article and
black hat presentation from aite um I
think 2018 as well Circ 2018 they did it
they did a very similar thing but with
po um and so they have a GitHub repo
that they release po that I talked about
earlier
um gith GitHub Reco that they released
and uh very similar framework I if you
go look at my project folder and my
laptop you'll see that there are about
four or five iterations of this project
before it came to fruition and so a lot
of the original ones or my original
attempts at this were Forks of the the
code that they wrote so it's like very
fascinating cool work and I think uh the
the author that wrote it was a little
bit ahead of their time is very very
cool all three of these
um and then some more inspiration right
um one I'm just the same guy who wrote
the detecting scraping article uh that's
on the left there um the website's
awesome we pass it around internally all
the time you find nuggets on there that
again you like never thought of before
the the guy has to like bypass web
application firewalls has a raise of
4gte Dos that he uses to make the
network requests and like mobile phones
it's unreal like how in-depth that like
part of the industry is if it's like a
multi industry and then on the right um
if you guys haven't gone to this website
definitely should um it's a little odd
it's called it's framew called creep JS
uh it fingerprints your browser
connection and creates a a unique hatch
for that uh that connection and it does
like I think he has listed on there how
many uh different fingerprint checks it
is but if you send headless Chrome
instance I don't care how hard you try
to bypass it it it's an overall score
that's assigned to a web request that's
made to this service and U they'll be
able to give you like a a rating so you
get like an F if you're like proof point
would have got minus right that's good
example and your normal browser might
get a b or something like that as you
return to the page more and more your
score will upgrade because you move your
mouse around on the page all these
different things um that is in the
JavaScript that we have on the website
who I'm sending all of the Bots to um he
has a endpoint that just doesn't display
any web UI but instead just classifies
the request and the more data he has the
better the fingerprinting can get on on
the creep JS page um you guys can change
that of course something you want to but
um very interesting nevertheless so
what's next um one the the fellas who
did the proof pudding um work we really
want to replicate it um I've been
looking to do it already so in instead
of just focusing on proof point however
uh there is a company now and website
called kif fish uh.com it's a researcher
based out of
Australia and he scraped the entire
internet to look at email gateways that
when you send them an email to an
invalid address they bounce back the uh
the email and when they bounce that
email back they include headers right
and those headers email headers are
parsable you can look at them and
determine why the email Gateway deemed
it was malicious or not so if you
collected thousands and thousands and
thousands of domains uh that were
vulnerable to that type of attack and
you could procedurally generate fishing
emails or normal conversational emails
and send them to those gateways parse
the headers throw them in elastic search
and use some ml you could determine the
exact it's like people talk about right
there's one B that can unlock every
iPhone probably out there because of the
you know dist right um same sort of
thing there's probably one thing you can
do with fishing emails that'll bypass
every single one of them and that's the
ultimate goal here right we just at
sprocket we don't want to worry about
fishing anymore I just want to send my
email and I want it to work and land in
the inbox I want the failure to be on
the part of me as the tester to create
my pretext properly not worrying about
the security solution um and that same
kind of issue reflects in like payload
developers or adversary simulation guys
and the lesson you can do the same thing
here with payload development um it
really can expand into anything and the
cool part is again sprocket right we
have to do this continuously so I can
collect this data at scale over time at
like a yeah massive scale look at this
data and then not only can you bypass
these Security Solutions once you can
bypass them continuously as they become
wise to this these sort of by te me um
and so at the end of the day goal is
let's we want to stop guessing I want to
stop like going on Twitter and saying
you send a email like I said with the
Emoji and the subject line then you'll
bypass proof point or if you load your
payload the specific way then you know
it'll bypass this EDR and like we're
sick of playing that game and it's not
the game that the Defenders are playing
right and so I I think a lot of firms
are going to start wising up to this and
and working with it uh I think a lot of
the internal red teams with more
resources than like smaller
consultancies or consultancies in
general have um probably already started
moving this way um but we need to have
the data that the Defenders do because
I'm sure that advanced persistent
threats are very very um skilled like
threat actors out there like tons of
resources are doing the same SE Um this
can be expanded to password spraying
right so how 0365 detects me password
spraying their endpoint and uh
Additionally the JavaScript that's used
here and one of the more dangerous uh
use cases for it is if you have your C2
and it's communicating over http and you
stick this JavaScript on that page right
the crawler for crowd strike or whatever
it is to determine if that's malicious
or not it can bounce it so not only is
this applicable to emails but it's also
applicable to like C2 Frameworks and
it's extremely powerful for that reason
um and uh additionally I I think if
anybody does take the JavaScript we have
on the site and expand on it um it's a
secret gist on GitHub so it's not let's
keep it close to our hearts everybody in
this room if we can hold on to it for a
little longer until I have modify it
that'd be be awesome but I didn't want
to share it with everybody but if anyone
makes any improvements or has any ideas
here with it would love to talk because
we kind of have an internal version that
we'll use and uh has a lot more checks
and stuff that uh we'll use as fishing
links and and emails but um I think
there's a lot of potential here to
include captures use cloud I could just
go on and on with it's very very
interesting so yeah um thank you for
watching uh we're at 45 minutes uh and
if you guys want to access thee
presentation so the pdf version of this
here or additionally get that code or
links to the references that I talked
about throughout the presentation
they're all going to be on that page and
so yeah and then yeah there's me and a
helmet up in the corner that I did not
realize that but yeah uh any questions
from anybody in the crowd yeah could you
tell us your success rate prior to your
research acccess after the research and
what your recommendation for the blue is
after you so um one uh I cannot I'm
going to be honest I can't tell you our
research before and after because up
until I started doing this I wasn't
thinking about offensive security the
same way so this changed a lot of my my
thinking right where I'm like collecting
data about our campaigns in this fashion
is actually really important um the guys
in the proof putting talk actually talk
about this like inex where they they say
like uh you know red teams over time
their engagements need to be collecting
success and failures um and and so I I
really we're starting to leverage that I
would say the the rate of success is
higher not significantly right because
it's still we still have to tackle the
gateways um to answer the question about
uh Defenders
or what they can do uh call up their
your datway or your your provider and
tell them to fix this um that's about
the only option you have I would assume
there's other Solutions out there for
products specifically for this that
could be leveraged but the fact that
virus total scanning these links like
every provider in there isn't capable of
working around this says to me that this
is like an industry wide problem
so any other
questions
yeah so here's my thought to that I
haven't fully implemented it yet but uh
I think it would probably be the work
around so you assign a score basically
where you say if you match on two of
these but not the other or you know um
instead of bouncing them off the page or
sending them somewhere else
alternatively spin this up in a cloud
flare worker or a standalone worker and
redirect them to a capture page so if
they improve they you know they
successfully pass the capture let them
keep going if they don't then they're
definitely bot so you assign a level of
confidence to the inbound prend web
request and then go from there to
prevent you know false positives false
negatives here um I think that's that's
probably the direction we we'll go in
with it alternatively and because right
you said we have clients that are all
AWS workspaces so this can work there um
I think you tailor to your environment a
little bit so your target client and
then additionally um there are ton I'm
not going to release the data that I
collected here but these are not the
only three indicators to to finance
right we want to leverage this stuff for
as long as we possibly can so
defin
[Applause]
[Music]