so welcome to my talk thanks to be here late appreciate that
so today I'm going to talk about a tool that i bought that I build a smart
buster
so I'm Patrick Matthew my information are there and everything will be on my
get up so I I'll just release it in the next few days
um so when my im co-founder of our access i work as a intense investor a
purple team at security compass I'm Canadian French Canadian so sorry for
everything and run that I say that so I start mostly acting and made nineties
I've been in this for that long i did a college and university degree and I'm
technically in bug bounties and that all came mostly from bug bounty as you will
see the problem at the problem that i had so that anyone has heard of this
before a Rubicon except you guys at now that's cool i almost put your name but
cool alright so what is very smart buster
so it's a plug-in inside burp an extension and the main objective is to
replace their Buster and zerbe
so by doing tons of 10 tests and bug bounty at this idea came up so why is
that i did want to add a smart those tools as there buster and their be are
pretty straightforward with word list so the plug-in the way works a will
technically just use the URL that is sent true burp when you proxy and i use
this information to create smart request like I will show you
so the state of the tall currently has been released at the demo labs at Def
Con last month and there's a working version on get up then the goal today is
really to let you guys know about the tool what it's doing but also to have
the community join in to add more features to it and there's a lot of to
do a lot of things that I had in mind which are not done yet but i will
explain you and the code is really documented so I'm kind of freak with
this i add a lot of to deuce comments everywhere so it's really easy to get in
and add stuff to it so why but white at all
I'm so like I said after doing a lot of men test web application test using the
Buster and their be you quickly find out that the tool those tools are really low
efficiency there's no application context at all it's just a wordless that
it's bush and trying to brute-force directories and file so there's no logic
option there's no techniques be nothing and there's a ton of files that devs and
system in and others that will wrongly up upload those to their server but when
they upload these files usually they will have specific names which makes
sense with the application in the website and the wordless I that are used
for derby and there Buster or bass techniques beyond the robots.txt file
from that on top 1000 of addicts our website so these wet these lists of
directories and files are based on website which are not the website you're
testing so you're doing tons of unwanted check and at some example if you look
into the files you'll see directories like /a test bob or something like this
which is a test that somewhere Bob did but you're testing this inside education
which is not related to people named Bob right
so there's also the problem that when you use their Buster the you need to do
manual input so if there's directory that exists you need to tell him tell
the tool to check this specific directories it's not checking file
extension and it's not checking the current context of what you're browsing
to weather website got so it's not checking the filenames directories the
domain name and etc and another one which is my in- of to do is it's not
also checking the technology of the website you're looking at
so if you want it that's a website which is PHP why will you look for PSP file
right so like i said what i want to do is add context to the brute force tool
add a stealth mode limit the number of requests if you want to be a more style
for to slow things down offer a simple and documenting code so you guys can
join in and at add features to the code other objective like i said its
application context so my tool when ice when your browser website variable get
the URL inside the URL if there's a directory a filename and extension it
will use those those things to brute-force other similar file based on
this so it's a dynamic content and that's what makes the Lee at the
difference here so but the feature that I add mostly when I do a request it's at
first it will check for specific files that exists but only ons so when you you
go to a victim . com site it will go and check the robots.txt gather all the the
swallow directories and file and we'll test if those file exists then I have a
spider option the spider option will spider the number of URL that you
defined first and we'll gather nouns and verbs
on the page is spidering and you can reuse those words that I've been written
on the website to apart and brute force more directories and file names inside
this website then I also check for the sitemap suicide my contains everything
of the website so you can set like check and number of URL inside the sitemap i
use the current directories the current file i have a list of prefix and suffix
so if you got filed at PHP i will do file as suffix that PHP and the suffix
I'm brute-forcing things that make sense like I will show you and I got the
suffix to so suffix file that the HP i do also the same with the extension so
that dot PHP . something or . something else so i will just switch it but based
on the file you just browse to so it's making sense in the context and the fun
thing is you don't it's the difference well from their buses that you don't run
the tools you just activated in verb and your browser website and that's it
while you browse it takes the URL do the brute force in the background and give
you results so you just browse through your panties to your stuff and then you
get results at the same time it's not stranded and in works in the pro version
and the non-pro version of birth which is really interesting question yes so
inside verbal show you right after at ya
the question is how do we activate inside verb the plug-in so inside bird
there's an extension tab and it's a Python file that you just put their you
click activate and that's it it's really simple
so I said it works in the non pro version which is interesting I and even
the multi Tradeworks so it's doing tons of requests I it's not limited like
maybe the some feature of verb are I add the log so everything is log into a file
and everything is based on an ini file that you got configuration right there
and finally the data jisun which are all the directories file extension etre that
the tool is using so if we look at how things are done so inside the code I the
bird extender is the at last that you extend to gather request from birth in
Python or Java fewer of code in Java so at first you get a function which is
register extender callbacks and inside this one each time there's a request
this code will execute so from there at the code and request the function
process
HTTP message for any request or response so inside a code i just put it if that's
a request made by you what while you browse do my smart request function and
it will go user URL parse it and do the request based on it i create order class
which are the spider the lugger the requester which is the melted red glass
to create other requests on a cue the URL data is a parser of the URL and I
got the requester worker which our base with the the motrin
so like I said the process HTTP message really intercept everything and if you
look at the colors really the important thing is to check where the request
comes from because burb each time you do a request inside the tool it tells you
from where it's coming so you need to check that it's not coming from yourself
because it will just loop infinity which I totally did at first was not a good
idea so smart request will do get smart data so it will execute the code to get
the robots.txt the spy during the sitemap ons and then it will create a
dynamic content based on the domain name the file name directories all this is
put inside accused that the requester we'll just go in it empty it and create
request to check if the file exists or not the other thing is the application
context is not just a file name so it's also the domain name and what's really
lacking inside there buster and derby is that if you want to check a victim . com
maybe this is a Sandman upload the file which is victim . zip or something I
dish which is maybe a dump of the database right so i use the domain name
and any sub domain related to it and I tried them all with all the XX extension
that I got in my file so each directory that I go out try this
so if the end then put this file at the rude or at the / something out
technically find it one of the two which is really interesting but needs to be
added to the tool is the application technology so at a check at of what the
website is is it running on a patchy is it
sharepoint is a PHP is be whatever
and based on this technology have a specific Jason file doing checks for
this a specific technology which will be really interesting and mostly when I
look at sharepoint I it got a tons of web services which people often forget
and those services usually are not restricted not authenticated and when
you request those they will give you like all the usernames all the emails
everything internally and even sometimes just gave you access to upload or browse
the internal website even from external when it's an intranet web site seeing
that so happens so the focus stealth-action there's a configuration
to into the configuration file to limit the number of requests everything is
there at this the only thing missing right now it's just that if I'm like
stop after five or something like this and like I said the code is really
simple with tons of comments &
this is the way that how the code works internally so maybe it's a bit small so
obviously that the burb fight and file will get the GC and file with the data
the configuration file when it get the configuration file
it's getting all the information like I said the state static one and documents
one and we'll go for extension directories and files so you got the
example here like explain a bit earlier like filed an extension that injection .
or file . injection . so it's checking everything like this this is the the
configuration file so the number of tears the padding file extension number
of page two requests with the spider which function to call so the smart
things to add to the tools like just giving up the possibility to use a
specific word file wordlist like there buster is doing or using the spider mode
only or something like this and really important is the in scope so inside burp
you got the ad to scope option right now it by default it's on if you don't add
the websites to the scope
nothing will happen if you remove this option anything like you do we'll ask
and everything
problem is if you go and test the website
usually there's 32 maybe 15 website which our third parties and request
jisun java and feed xml javascript tons of things that are not on the website
you're testing and the tons of requests and I'm doing will go on all those sites
so one request might turn into so right now with the option with add to scope
it's around 5 550 request for one click
so if you don't do this you might go and do 5000 click request for one click
which is the website won't like right the in your file type so you got the
gift gee peg those kind of file if you want to reject something you can add it
there and technical things which is the training / by default you always add a
slash at the end when it's a directory but some website or configure so weirdly
that you can remove this option if needed
so this is explained this is what the data file looks like so inside the
extension section you can see . . back that swept all PHP s you get a small
description the file prefix so what's interesting in prefix I look at
everything
linux windows 7 and 10 and look for copy of and when you do a copy paste of a
filing the same directory what it's happening so you can see in prefix and
suffix so dash copy or copy space copy or a copy of old just a tiled just a dot
sometime so all those files based on you 12 and windows if someone do a copy base
and uploaded by error to the website
this will be catch and the interesting part is that you can catch those files
because of the context of the application in the current URL which you
cannot find with a specific static list of there buster and then you got files
and directories that you look for a config file that gets doctors and all
those things at my data file is not that huge it can be ad but the most critical
stuff is there
yep
so when you run that all income in line while anywhere that you output the
results from the extender you will see something like this so by default you
got the verbals option which tell you what function has been tested and
whether URL is so you can see a request prefix for this file so it added I'll
and then it added . it that you can see all index of copy of copy 1234 and at
the end you see this file exists and the the code that is returned so 43 at 200
maybe a 44 or something like this but the thing is they might be false
positives to problem is that I web well sysadmin and server configuration won't
be the same for the 44 errors the problem
well by default the RFP tells you that when there's a page that doesn't exist
you need to return a 44 but nobody mostly do it and so you get a 2 unread
which is a file that exists but inside the text of the page it will tell you
that this is a page that doesn't exist or it's a four-for-one intex so i'll
just show you right after what i did with this next step of the tools like I
said a technology check adding also this come from a comment from defcon adding a
concept of community data that is sent to an animus service web services so if
you all use the tool and you find a directory which is $OPERAND / config it
will just tell the web services like we found / config it's a real data that
exists out there and we can have like a ranking so if there's 3,000 people
finding this dietary it might be like everywhere
the trance peed by default it's just a tread that it's intense and it might not
be liked by people that you test the website so i need to add a tread speed
limit the aspiring is getting the nouns and numbers like i said but i'm not
using it right now so just a function to go over it and yeah for sure there's
some small technical fix to do sorry I and like I said the 44 needs to be fixed
but technically it's mostly working so this is the code it's a bit small but
what it's doing for the false positive verification of the 44 i get i create a
md5 hash random one doesn't matter and I request this ash on the website so
website.com / the ash i'm pretty sure that this will never exist right and you
use this result to see if the page what the page give you as an error so if the
reader response status is 44
it's a normal case every 44 is considered normal
if it returns you a tree or something you base your the fact that tree
hundreds error might be false positive so I just want to add a message like
this might be false positive because it's mostly impossible to guess what the
cum deep the code is doing on the website behind and if the responses are
200 so the most wrong 1i use beautiful soup which is an API that parse HTML and
I look for text which is like page not phone or 44 or something like this if
you want to if you testing a website that says that X which is not in the
code you a dish with this code and that's it
so Nicole is there
the only difference that the only thing that needs to be done is at if based on
this to say in the results like this
this might be the false-positive the technology the way to do it is like i
said if the server is that she do a passage checks if it's sure . do the
shirt . checks which peed do those checks and technically just doing at
last with this kind of function based on data decent file which has all the
directories and files to look should be easy
the community data like i said and some technical fix so right now i'm using a
ini file for configuration I didn't do a gooey inside verb i don't like coding
javac we so I just didn't do it but it's welcome if someone want to help i want
my colleagues send me the configuration of the ini ini inside agree so I just
need to add it by also want a box with the results not just getting results and
inside the console it's not that great right now and any ideas that you might
have are welcome for sure so that covers it
any question alright i'll just try to do a small demo quickly i got a few minutes
left so inside the directory
I gotta try running and you can see that at the root there's copy of index that
HTML index that back-to-back file HTML . back the normal HTML file and I got a
conflict directory with web.config inside it so when you go inside burb you
go to the extender you add the burp smarter file which is a Python one you
load it and that's it
you need to do like I said the ad to scope so right now the local Lowe's is
add right there and when you go here so the results will just appear in this
page if everything works when you do the cliq nothing works
yeah as usual
yeah I know did the same thing at DEFCON how they go
so those are all the things that it looks at four on the website so all the
directories all the extension for the smart domain so it's looking for look
allows that dark that zip that are that whatever then the request file so the
specific at critical files that i need to look at and there's tons of those and
at the end it tells you that those are two really exists or not and those are
false positive because this is a cali and everything that runs on that she
which is like . HT access is returning as a 4-3 even if the file exists or not
you got this one which URL exist which is a slash config so that works and it's
during other yeah so when you go to the website and you try / config which will
give you this awesome directory so it will tell you that inside / config
there's the web.config file which is there but again the . HD access the
false-positive came up here so the only things to add will be maybe like when
it's of oratory add a warning saying maybe it's not maybe it's a false
positive
so that's the demo is kind of boring I mean it's just giving you results right
so but it works thank you
so I'm going to be here for anybody have any questions thanks again