3 ms·

Having had zero interest in hacking since the late nineties, it is facinating to see how “institutionalized” hacking has become. People used to bark at script k

Having had zero interest in hacking since the late nineties, it is facinating to see how “institutionalized” hacking has become. People used to bark at script kiddies, but the slick tools presented here seem way beyond what was available back then. Very cool.

rjh29 5y ago
There is still creativity at the edges (devising new exploits, figuring out how to defeat an input santiser) but day-to-day pentesting work is pretty mundane: you go through all the ports, services, API endpoints looking for standard vulnerablities (CSRF, XSS, SQL injection), look for common login and session issues, if you see XML or file upload you try some standard ways of subverting those, and you test for access control or application logic errors. Proxies like Burp can make it easy to intercept and modify requests or replay them with different sessions.
- brightball 5y ago
  It seems like it’s the type of think that should be taught in CS programs at this point (if it’s not already).
  - robin_reala 5y ago
    Well, maybe SE programmes. There’s some CS in security work, but not at a basic level.
_448 5y ago
Even with slick tools, sometimes the crackers do get it wrong. Few days ago I was reading on Check Point a technical analysis of cyber attack on Iranian state television. And the security analysts who were analysing the data were all dealing with debug-mode files left behind after the attack! There was no attempt by the crackers to clean-up the binaries before releasing it on the target. BTW, there could be a motive behind this as well, to let the victim know deliberately who they were and how they were doing it. But this is very rare, and only useful if it is a one-off attack. But the attack that was analysed by Check Point was that from repeat offenders, so to me it looked like someone who had just taken an online cracking 101 lessons and targeted few state institutions of a country :)
- haxnotcrax 5y ago
doopy1 5y ago
I think these days security testing is just glorified QA. The secret sauce is developing your own methodology, which at the end of the days is a mega comprehensive checklist.
- ozim 5y ago
  Well yes and no. Being a football player is also applying comprehensive checklist, question is who does it faster and is able to execute it. Like I do understand all the exploits but executing them and executing them quickly or iterating over possible solution space is taking me 4 days on HTB easy boxes. There are people who break really hard boxes in matter of hours or even minutes. So for me it is comparison like I am playing soccer with my neighborhood friends and playing premier league. Like I do know the moves that should be done but I do not have reflexes built for that and building those reflexes takes years of focusing on playing football. Having reflexes on which exploit to choose or which tool you should pick up to go through with hack is something like that and you need years to build it up.
deleted 5y ago
[deleted]

rjh29 5y ago

There is still creativity at the edges (devising new exploits, figuring out how to defeat an input santiser) but day-to-day pentesting work is pretty mundane: you go through all the ports, services, API endpoints looking for standard vulnerablities (CSRF, XSS, SQL injection), look for common login and session issues, if you see XML or file upload you try some standard ways of subverting those, and you test for access control or application logic errors. Proxies like Burp can make it easy to intercept and modify requests or replay them with different sessions.

brightball 5y ago
It seems like it’s the type of think that should be taught in CS programs at this point (if it’s not already).
- robin_reala 5y ago
  Well, maybe SE programmes. There’s some CS in security work, but not at a basic level.

_448 5y ago

Even with slick tools, sometimes the crackers do get it wrong. Few days ago I was reading on Check Point a technical analysis of cyber attack on Iranian state television. And the security analysts who were analysing the data were all dealing with debug-mode files left behind after the attack! There was no attempt by the crackers to clean-up the binaries before releasing it on the target. BTW, there could be a motive behind this as well, to let the victim know deliberately who they were and how they were doing it. But this is very rare, and only useful if it is a one-off attack. But the attack that was analysed by Check Point was that from repeat offenders, so to me it looked like someone who had just taken an online cracking 101 lessons and targeted few state institutions of a country :)

haxnotcrax 5y ago

doopy1 5y ago

I think these days security testing is just glorified QA. The secret sauce is developing your own methodology, which at the end of the days is a mega comprehensive checklist.

ozim 5y ago
Well yes and no. Being a football player is also applying comprehensive checklist, question is who does it faster and is able to execute it. Like I do understand all the exploits but executing them and executing them quickly or iterating over possible solution space is taking me 4 days on HTB easy boxes. There are people who break really hard boxes in matter of hours or even minutes. So for me it is comparison like I am playing soccer with my neighborhood friends and playing premier league. Like I do know the moves that should be done but I do not have reflexes built for that and building those reflexes takes years of focusing on playing football. Having reflexes on which exploit to choose or which tool you should pick up to go through with hack is something like that and you need years to build it up.

deleted 5y ago

[deleted]