10 ms·

So You Want To Be A Breaker, Part 1: Web Security

261 points by daeken 14y ago

tptacek 14y ago
If this stuff fascinates you and you're a solid software developer and you'd be interested in having this be your full-time job for awhile and you're willing to sink a little bit of your own time into ramping up, give us a ping. We'll help you get there. This page has a lot of info on how we recruit. We're getting pretty good at turning systems programmers into breakers, and we love hiring from HN: http://www.matasano.com/careers/ http://www.matasano.com/careers/ The great thing about this field is that it's always changing. A long-term dev job gives you a chance to master two or three different technology stacks. Your next three projects at an appsec shop might each be just two weeks apart, and each will use radically different technologies. Even (maybe even especially) with web software. You could join one startup... or spend a couple years beating up all of all the startups. Also: I understand why Cody didn't write it this way, but the reality is, if you're going to test web apps, Burp is the standard tool. You can use things like mitmproxy or even WebScarab, but most people end up in Burp. Burp is also extremely valuable for testing even if you're not doing appsec full-time.
- tptacek 14y ago
  Oh, hey! And if you'd like to learn to break crypto at the same time as you work through Cody's web recommendations --- even if you don't want to be an appsec person --- mail sean at matasano dot com. He's got a pretty kick-ass set of ~40 crypto-breaking exercises. Something like 200 people have started them over the past 6 months; only a few people have made it through the end. (They aren't deliberately hard; they just cover a lot of ground --- you're starting with basic substitution ciphers and ending with RSA signature block forgeries). I helped design them, and I'm really happy with how they came out. They're neat. You should see how many sets you can get through. I hope it goes without saying that if you crush Sean's crypto challenges for fun and are interested in being a full-time appsec person, you will have our full and undivided attention. :)
  - jcr 14y ago
    As one of the 200 incompletes mentioned, I gotta say Sean Devlin at Matasano is top notch. The puzzles are fun, possibly too much fun. It's easy to wander off into the weeds and spend a lot of time thinking through and testing the non-puzzle implications. I hope to get through the puzzles eventually, but I'm terribly slow and it will take me a very long time. Even if you're a sec-idiot like me, the puzzles are a wonderful way to spend time learning.
    - tptacek 14y ago
      \o/
      - switch33 14y ago
        Any idea why he's doing this stuff only primarily by e-mail? It'd be great if this stuff was online like in a blog or whatnot. I'd like to take the time and look over the crypto challenges.
        tptacek 14y ago
        We want to actually teach people how to do stuff, instead of giving people something they can toss around in message board and twitter arguments; we also want to track (in a macro sense) how people do with them, and to be able to tell people when we add more challenges (I'm working on 42-48 next week).
        switch33 14y ago
        I like that answer. \O/ Also sent an e-mail.
        losvedir 14y ago
        This sounds like an amazing win-win scenario you've got here. People can have fun and learn more about security and cryptography, and you guys get a channel from which to hire the best and brightest. I sent Sean an email. Even if I'm not in that latter category, it still sounds like a great chance to learn a little something about a field which intimidates but interests me.
- daeken 14y ago
  > Also: I understand why Cody didn't write it this way, but the reality is, if you're going to test web apps, Burp is the standard tool. You can use things like mitmproxy or even WebScarab, but most people end up in Burp. Burp is also extremely valuable for testing even if you're not doing appsec full-time. I actually forgot to update that -- it was on my list of edits. Done now, thanks!
  - tptacek 14y ago
    I feel like I could justify the expense of Burp for a random freelance developer, even if they weren't billing out as a security tester. Like, I feel like we could convince Patrick McKenzie that it was worth his money. What do you think?
    - daeken 14y ago
      Justifying the expense wouldn't be difficult at all. However, I think the free version is Just Fine (TM) unless you need stuff like the scanner or intruder (intruder works in Burp Free, but is limited to something like 1 request/second).
      - tptacek 14y ago
        Burp Intruder is the fuzzer inside of Burp. All the Burp-like tools let you capture requests your browser sends, edit them, and replay them. Burp Intruder lets you take a captured request and set up rules to send hundreds or thousands of variant requests. I am weird among Matasanos (and ex-Matasanos :|) in that I live inside of Burp Intruder; I use it instead of Repeater. Why replay a request once when I can replay it 1000 times? So for me, non-crippled Intruder isn't optional. I wish Burp didn't have a Scanner. I might pay $25 more for a branded version of Burp that specifically didn't have that feature, so I could reassure clients I wasn't ever using it.
        daeken 14y ago
        Huh, yeah, I've never seen anyone use intruder like that. I might use it once every other engagement, whereas I use repeater 24/7.
- MichaelGG 14y ago
  Is the work at Matasano (and security consulting in general) mostly attacking web apps? How often do you get to use tools such as IDA Pro to reverse binaries? Either way, it must be fun doing that full time. Nothing in the world comes quite close to the feeling of breaking someone's system. The building excitement and anticipation as you realise you might just have found a place where they don't properly encode one protocol into another. The intense satisfaction when you get to demo an exploit. Unlike the rest of app dev, you can prove your attack is right.
  - tptacek 14y ago
    We definitely do both things. You wouldn't want to work here if you hated web apps. You wouldn't need to know your way around IDA Pro on day 1 (for reasons that will become clear in a few months, you'd be comfortable with the basics of assembly language within a month or so of starting).
  - m0nastic 14y ago
    I've been a security consultant for ~13 years or so (predominantly application focused), and I'd say that all other things being equal, a good portion of it is web apps. That's mostly just an artifact of the fact that so much software over the past ten years is web-based. I'd say maybe 80% of the client work I've done has been web-based (with maybe 10-15% non-web application, and the remainder network stuff). But it's not the same everywhere. I would posit that one of the differentiators is the size of the company (i.e.: bigger security firms probably do more web-based stuff than more boutique places, mostly due to the clients that big firms service). At the last place I worked, I ran a 10-person consulting division, and it was maybe 50/50 web app/non web-app testing. We were eventually acquired by a giant telco (two actually), and fast-forward a couple years, and the now 200-person consulting division is mostly doing PCI-related web-app testing (I have since left, although I think I stayed longer than I should have). The larger the company, the larger your clients (generally), and the less agility of your sales process (ie: sales people tend to have a much easier time selling web application testing, as there is a huge number of clients who need it, and it's easy to put together statements of work around it). So my advice, if you're interested in the more interesting types of security work, is to look for a small-to-medium-sized place. Actually, regardless of the type of security work you're interested in, I'd recommend a smaller firm. I've worked at enough of both to think that there's a certain size (either of head count or revenue) where you start to do less interesting work.
- WA 14y ago
  I worked as an IT security consultant for a bit over a year and found it rather boring after a while. In theory, you do lots of interesting and different things, get to know many different technologies. Maybe it was just the job I was working at, but the actual penetration testing became pretty boring after a few months. While it sounds compelling to beat up startups, startups are probably not the clients. Our consulting day rates were very expensive and usually only large corporations or the government could afford it. You just go and check for the top OWASP vulnerabilities. Sometimes, it requires some creativity, but oftentimes, you get a "feeling" for a web app after a while. Many PHP projects, many open source software projects that got a few custom made plugins. And then it's a bit dull. Testing every single parameter of a web app with many attack vectors... I have to admit that there was one guy at our company who did a lot of reverse engineering, iOS security, testing a DRM system for an ebook online library (key takeaway: you can't control the client. DRM makes it harder, but it is never impossible to crack the system as long as the hardware is not custom made or something), stuff like that. So this was quite challenging and changing, but this was rare. One gem I want to add to the original post: If you're interested in SQL injection, check out sqlmap. That tool is a real breaker and worked wonders for us and we downloaded entire databases by having a tiny little sql injection vulnerability in the signup form of a newsletter or something like that.
  - tptacek 14y ago
    We work with lots of startups. We work with big companies, too, but that work is disproportionately with big west coast tech companies. The "east coast" BigCo work we do touches on trading protocols and order routing systems, which is fun for a lot of other reasons (wider application domain for findings, extremely high impact, complicated systems with message-oriented middleware, non-web inputs). We do zero government work. I don't feel like we're along in appsec shops for having this mix. I think one possible difference is between pure appsec shops like us, iSec Partners, IOActive, and Stach & Liu, versus general security practices. The work at general security practices might be more of a drag. It's also the case that network security, being a race to the bottom (with Nessus and Metasploit "scanner jockies" and the like) is actively trying to push up into appsec. Maybe the web appsec work at a place like that is boring? We take it pretty seriously. We avoid tools like sqlmap. I'm answering this on the off chance that the conversation is a good glimpse into the working life of an appsec pentester (since that's what Cody's writing about).
- n2dasun 14y ago
  I wish you guys had openings in the DC area. I've been interested in this stuff since college, when I would try reverse engineering using Fravia+'s tutorials. That's how I learned assembly programming.
  - tptacek 14y ago
    Me too! There are a bunch of people I'd love to drag into the company from DC. But we're sticking with NYC, Chicago, and Mountain View. Always happy to relocate people! :)
    - phaus 14y ago
      I wouldn't mind going to the west coast, but my family hates moving. Do you know of any similar organizations in the DC/MD/VA area? I'm sure the government has a bunch, but I'd eventually like to get out of the gov side of things.
- pandaexpress 14y ago
  Matasano's site mentions office culture. Are remote employees impossible to work out? I'd LOVE to get into this sort of thing, but I'm not a US citizen and I don't qualify for any visas. If I get in touch, would you point me towards some resources even if it won't lead to employment?
  - tptacek 14y ago
    Of course I will!
    - pandaexpress 14y ago
      Fantastic! I dropped you (and Sean) a line.
- windexh8er 14y ago
  "...you're a solid software developer..." I think that's the area it's hard to break if you're already engulfed into security. I've been in architecture, research and pentesting across a lot of shops but I've always felt like minimum viable exploitation was all most places were after. Fast forward years and you end up in something you don't feel like you've transitioned into something deeper. Sure, you can go there on your own but it has limited viability unless you're path forward is Pwn2Own or bounties in general. I'd love to work for the Matasanos of the world but feel like I may be locked out based on the initial hurdle of being more proficient in code as a first class skill vs having a more honed skilkset in finding flaws on the systems as a whole. Also tracking the relevant things within the security landscape is a skill in and of itself and since most orgs don't understand how to find and cultivate that talent it open the doors foe the Risk.IO of the world. Sure, I've done some reverse engineering, lots of (easy) pentesting and am proficient in Python. I've designed many F100 systems as it pertains to the security construct, yet I can't see a path forward to digging in deeper with those like Matasano. So @tptacek, any advice? The money is excellent on this side of the fence, but the real challenges are, seemingly, few and far between. Edit: I need to stop writing posts from phone/tablet (spelling).
- livingontheedge 14y ago
  DON'T WORK FOR MATASANO!!! Reasons below: #1 Lack of honesty. Seriously, they promised releasing those crypto challenges publicly 2 years ago (Blackhat 11: Crypto for Pentesters) and never done so: https://twitter.com/matasano/status/101714851633700864 https://twitter.com/matasano/status/101714851633700864. And now they're using them as a recruiting tool. #2 Lack of humility: Matasano guys seem to disregard common tools like Burp scanner or Sqlmap. It's fine to cherry-pick tools to suite your needs; but if you choose to disregard them completely just because you feel they're associated with "Security Rookies" then you're more than likely to miss something, consequently disservice your client (they expect you, as a consultant, to find the most vulnerabilities regardless of tools used). Matasano may have better fuzzer/scanner, but since they don't publicly release them, I found that going around and bashing other security tools to position themselves higher than their competitors is a sign of arrogance. Go work for other companies, I don't want you HN people turn out to be like them! For those of you who emailed sean at matasano dot com but haven't received any response, go play with Trustwave crypto challeges: https://github.com/SpiderLabs/CryptOMG https://github.com/SpiderLabs/CryptOMG - And yes they don't have BS subscription model.
  - daeken 14y ago
    So, I'm ex-Matasano and now work for Accuvant LABS (a competitor). While I'd love to snag awesome people to join up on my side, I completely disagree here. Matasano is a great company and they do do good work. #1 they should remedy for sure, but #2 I disagree with -- they hold the same opinion I've found in other high-end consulting shops, just more vocally.
    - livingontheedge 14y ago
      "We avoid tools like sqlmap" "I wish Burp didn't have a Scanner. I might pay $25 more for a branded version of Burp that specifically didn't have that feature, so I could reassure clients I wasn't ever using it." Tell me, how do you expect to find MOST instances of SQL Injection or XSS without using tools? Do you manually tamper with every cookie parameters? Unless Matasano has better tools and release them publicly, then I am interested in hearing about them.
jfolkins 14y ago
Tutorial I wrote on how to setup* BURP using OSX. http://www.acloudtree.com/how-to-configure-burp-and-chrome-for-https-ssl-packet-inspection-and-web-site-debugging-on-mac-osx/ http://www.acloudtree.com/how-to-configure-burp-and-chrome-f...
- rdl 14y ago
  I've always preferred keeping all that stuff in a VM (usually linux).
  - daeken 14y ago
    I have a Windows VM that's snapshotted with all of my favorite tools. When I need to test something, I do so and then roll back. No mess, no cross-pollination of tests.
    - rdl 14y ago
      Yeah, I do the same thing with snapshots (and in some cases you're supposed to do work only on client/government-provided equipment, so moving a VM over is helpful).
passfree 14y ago
Or you can forget this java madness and go with Websecurify Suite (https://suite.websecurify.com https://suite.websecurify.com). It works from the browser and it is a lot faster.
- tptacek 14y ago
  I tried to see what this was and kept getting asked to sign into Google; I saw a page that mentioned "Subscriptions" and "Google Wallet", and thought to myself, "this is probably not going to talk me out of Burp Suite". I don't like Java applications any more than you do, but it happens that the best web testing application is built in Java; I'm not going to not use it out of pique.
  - nbpoole 14y ago
    Hmm, a majority of passfree's account's submissions (20/25) appear to be for websecurify.com. Combined with the dismissal of Burp as "java madness," seems like a socketpuppet on behalf of the company.
    - daeken 14y ago
      Every one of them is either about it or a link to the site itself.
Slimbo 14y ago
This guide is exactly what I've been looking for, thanks Cody. Been on the receiving end of some very talented pentesters, and really want to learn more about how on earth they find the things they do. Want to make sure I catch your future editions, do you have anything I can sign up for notification? Can't find an RSS feed on your blog.
- daeken 14y ago
  I'm probably going to set up a mailing list soon, but if you drop me an email at cody.brocious@gmail.com I'll make sure to let you know when I put out the others. Glad you found it useful! Oh, also, follow me on twitter, as I'll certainly link it there. https://twitter.com/daeken https://twitter.com/daeken
- Serplat 14y ago
  I second the need for an RSS feed. I was actually a bit surprised when I couldn't find one.
  - daeken 14y ago
    It's something I thought about for a while and just decided it wasn't worth it. I just switched away from Posterous (c.f. https://news.ycombinator.com/item?id=5388857 https://news.ycombinator.com/item?id=5388857 ) and when I was building the new blog, I looked at my RSS subscribers and realized only 15 people actually use it. Just wasn't worth building.
    - bigiain 14y ago
      FWIW, it looks like I'm at least the 3rd person today who would have added your rss feed if it existed...
      - defrndr 14y ago
        And I'll be the 4th.
DelvarWorld 14y ago
what is this nerd talking about this article has nothing to do with breakdancing
pgambling 14y ago
Is "Breaker" in the title a Dark Tower reference?
- daeken 14y ago
  No, but "So You Want To Be A ..." is a reference to http://en.wikipedia.org/wiki/Quest_for_Glory:_So_You_Want_to_Be_a_Hero http://en.wikipedia.org/wiki/Quest_for_Glory:_So_You_Want_to...
deleted 14y ago
[deleted]
edem 14y ago
So the official term for this kind of occupation is "breaker"?
- daeken 14y ago
  Security consultant, pentester, breaker. I prefer the latter.
Fa773NM0nK 14y ago
Great List. From now on, every time I write web code I'll use this as a check list!
jbackus 14y ago
No LFI/RFI mention? http://en.wikipedia.org/wiki/File_inclusion_vulnerability http://en.wikipedia.org/wiki/File_inclusion_vulnerability

261 points by daeken 14y ago

If this stuff fascinates you and you're a solid software developer and you'd be interested in having this be your full-time job for awhile and you're willing to sink a little bit of your own time into ramping up, give us a ping. We'll help you get there. This page has a lot of info on how we recruit. We're getting pretty good at turning systems programmers into breakers, and we love hiring from HN: http://www.matasano.com/careers/ http://www.matasano.com/careers/ The great thing about this field is that it's always changing. A long-term dev job gives you a chance to master two or three different technology stacks. Your next three projects at an appsec shop might each be just two weeks apart, and each will use radically different technologies. Even (maybe even especially) with web software. You could join one startup... or spend a couple years beating up all of all the startups. Also: I understand why Cody didn't write it this way, but the reality is, if you're going to test web apps, Burp is the standard tool. You can use things like mitmproxy or even WebScarab, but most people end up in Burp. Burp is also extremely valuable for testing even if you're not doing appsec full-time.

tptacek 14y ago
Oh, hey! And if you'd like to learn to break crypto at the same time as you work through Cody's web recommendations --- even if you don't want to be an appsec person --- mail sean at matasano dot com. He's got a pretty kick-ass set of ~40 crypto-breaking exercises. Something like 200 people have started them over the past 6 months; only a few people have made it through the end. (They aren't deliberately hard; they just cover a lot of ground --- you're starting with basic substitution ciphers and ending with RSA signature block forgeries). I helped design them, and I'm really happy with how they came out. They're neat. You should see how many sets you can get through. I hope it goes without saying that if you crush Sean's crypto challenges for fun and are interested in being a full-time appsec person, you will have our full and undivided attention. :)
- jcr 14y ago
  As one of the 200 incompletes mentioned, I gotta say Sean Devlin at Matasano is top notch. The puzzles are fun, possibly too much fun. It's easy to wander off into the weeds and spend a lot of time thinking through and testing the non-puzzle implications. I hope to get through the puzzles eventually, but I'm terribly slow and it will take me a very long time. Even if you're a sec-idiot like me, the puzzles are a wonderful way to spend time learning.
  - tptacek 14y ago
    \o/
    - switch33 14y ago
      Any idea why he's doing this stuff only primarily by e-mail? It'd be great if this stuff was online like in a blog or whatnot. I'd like to take the time and look over the crypto challenges.
      - tptacek 14y ago
        We want to actually teach people how to do stuff, instead of giving people something they can toss around in message board and twitter arguments; we also want to track (in a macro sense) how people do with them, and to be able to tell people when we add more challenges (I'm working on 42-48 next week).
        switch33 14y ago
        I like that answer. \O/ Also sent an e-mail.
        losvedir 14y ago
        This sounds like an amazing win-win scenario you've got here. People can have fun and learn more about security and cryptography, and you guys get a channel from which to hire the best and brightest. I sent Sean an email. Even if I'm not in that latter category, it still sounds like a great chance to learn a little something about a field which intimidates but interests me.
daeken 14y ago
> Also: I understand why Cody didn't write it this way, but the reality is, if you're going to test web apps, Burp is the standard tool. You can use things like mitmproxy or even WebScarab, but most people end up in Burp. Burp is also extremely valuable for testing even if you're not doing appsec full-time. I actually forgot to update that -- it was on my list of edits. Done now, thanks!
- tptacek 14y ago
  I feel like I could justify the expense of Burp for a random freelance developer, even if they weren't billing out as a security tester. Like, I feel like we could convince Patrick McKenzie that it was worth his money. What do you think?
  - daeken 14y ago
    Justifying the expense wouldn't be difficult at all. However, I think the free version is Just Fine (TM) unless you need stuff like the scanner or intruder (intruder works in Burp Free, but is limited to something like 1 request/second).
    - tptacek 14y ago
      Burp Intruder is the fuzzer inside of Burp. All the Burp-like tools let you capture requests your browser sends, edit them, and replay them. Burp Intruder lets you take a captured request and set up rules to send hundreds or thousands of variant requests. I am weird among Matasanos (and ex-Matasanos :|) in that I live inside of Burp Intruder; I use it instead of Repeater. Why replay a request once when I can replay it 1000 times? So for me, non-crippled Intruder isn't optional. I wish Burp didn't have a Scanner. I might pay $25 more for a branded version of Burp that specifically didn't have that feature, so I could reassure clients I wasn't ever using it.
      - daeken 14y ago
        Huh, yeah, I've never seen anyone use intruder like that. I might use it once every other engagement, whereas I use repeater 24/7.
MichaelGG 14y ago
Is the work at Matasano (and security consulting in general) mostly attacking web apps? How often do you get to use tools such as IDA Pro to reverse binaries? Either way, it must be fun doing that full time. Nothing in the world comes quite close to the feeling of breaking someone's system. The building excitement and anticipation as you realise you might just have found a place where they don't properly encode one protocol into another. The intense satisfaction when you get to demo an exploit. Unlike the rest of app dev, you can prove your attack is right.
- tptacek 14y ago
  We definitely do both things. You wouldn't want to work here if you hated web apps. You wouldn't need to know your way around IDA Pro on day 1 (for reasons that will become clear in a few months, you'd be comfortable with the basics of assembly language within a month or so of starting).
- m0nastic 14y ago
  I've been a security consultant for ~13 years or so (predominantly application focused), and I'd say that all other things being equal, a good portion of it is web apps. That's mostly just an artifact of the fact that so much software over the past ten years is web-based. I'd say maybe 80% of the client work I've done has been web-based (with maybe 10-15% non-web application, and the remainder network stuff). But it's not the same everywhere. I would posit that one of the differentiators is the size of the company (i.e.: bigger security firms probably do more web-based stuff than more boutique places, mostly due to the clients that big firms service). At the last place I worked, I ran a 10-person consulting division, and it was maybe 50/50 web app/non web-app testing. We were eventually acquired by a giant telco (two actually), and fast-forward a couple years, and the now 200-person consulting division is mostly doing PCI-related web-app testing (I have since left, although I think I stayed longer than I should have). The larger the company, the larger your clients (generally), and the less agility of your sales process (ie: sales people tend to have a much easier time selling web application testing, as there is a huge number of clients who need it, and it's easy to put together statements of work around it). So my advice, if you're interested in the more interesting types of security work, is to look for a small-to-medium-sized place. Actually, regardless of the type of security work you're interested in, I'd recommend a smaller firm. I've worked at enough of both to think that there's a certain size (either of head count or revenue) where you start to do less interesting work.
WA 14y ago
I worked as an IT security consultant for a bit over a year and found it rather boring after a while. In theory, you do lots of interesting and different things, get to know many different technologies. Maybe it was just the job I was working at, but the actual penetration testing became pretty boring after a few months. While it sounds compelling to beat up startups, startups are probably not the clients. Our consulting day rates were very expensive and usually only large corporations or the government could afford it. You just go and check for the top OWASP vulnerabilities. Sometimes, it requires some creativity, but oftentimes, you get a "feeling" for a web app after a while. Many PHP projects, many open source software projects that got a few custom made plugins. And then it's a bit dull. Testing every single parameter of a web app with many attack vectors... I have to admit that there was one guy at our company who did a lot of reverse engineering, iOS security, testing a DRM system for an ebook online library (key takeaway: you can't control the client. DRM makes it harder, but it is never impossible to crack the system as long as the hardware is not custom made or something), stuff like that. So this was quite challenging and changing, but this was rare. One gem I want to add to the original post: If you're interested in SQL injection, check out sqlmap. That tool is a real breaker and worked wonders for us and we downloaded entire databases by having a tiny little sql injection vulnerability in the signup form of a newsletter or something like that.
- tptacek 14y ago
  We work with lots of startups. We work with big companies, too, but that work is disproportionately with big west coast tech companies. The "east coast" BigCo work we do touches on trading protocols and order routing systems, which is fun for a lot of other reasons (wider application domain for findings, extremely high impact, complicated systems with message-oriented middleware, non-web inputs). We do zero government work. I don't feel like we're along in appsec shops for having this mix. I think one possible difference is between pure appsec shops like us, iSec Partners, IOActive, and Stach & Liu, versus general security practices. The work at general security practices might be more of a drag. It's also the case that network security, being a race to the bottom (with Nessus and Metasploit "scanner jockies" and the like) is actively trying to push up into appsec. Maybe the web appsec work at a place like that is boring? We take it pretty seriously. We avoid tools like sqlmap. I'm answering this on the off chance that the conversation is a good glimpse into the working life of an appsec pentester (since that's what Cody's writing about).
n2dasun 14y ago
I wish you guys had openings in the DC area. I've been interested in this stuff since college, when I would try reverse engineering using Fravia+'s tutorials. That's how I learned assembly programming.
- tptacek 14y ago
  Me too! There are a bunch of people I'd love to drag into the company from DC. But we're sticking with NYC, Chicago, and Mountain View. Always happy to relocate people! :)
  - phaus 14y ago
    I wouldn't mind going to the west coast, but my family hates moving. Do you know of any similar organizations in the DC/MD/VA area? I'm sure the government has a bunch, but I'd eventually like to get out of the gov side of things.
pandaexpress 14y ago
Matasano's site mentions office culture. Are remote employees impossible to work out? I'd LOVE to get into this sort of thing, but I'm not a US citizen and I don't qualify for any visas. If I get in touch, would you point me towards some resources even if it won't lead to employment?
- tptacek 14y ago
  Of course I will!
  - pandaexpress 14y ago
    Fantastic! I dropped you (and Sean) a line.
windexh8er 14y ago
"...you're a solid software developer..." I think that's the area it's hard to break if you're already engulfed into security. I've been in architecture, research and pentesting across a lot of shops but I've always felt like minimum viable exploitation was all most places were after. Fast forward years and you end up in something you don't feel like you've transitioned into something deeper. Sure, you can go there on your own but it has limited viability unless you're path forward is Pwn2Own or bounties in general. I'd love to work for the Matasanos of the world but feel like I may be locked out based on the initial hurdle of being more proficient in code as a first class skill vs having a more honed skilkset in finding flaws on the systems as a whole. Also tracking the relevant things within the security landscape is a skill in and of itself and since most orgs don't understand how to find and cultivate that talent it open the doors foe the Risk.IO of the world. Sure, I've done some reverse engineering, lots of (easy) pentesting and am proficient in Python. I've designed many F100 systems as it pertains to the security construct, yet I can't see a path forward to digging in deeper with those like Matasano. So @tptacek, any advice? The money is excellent on this side of the fence, but the real challenges are, seemingly, few and far between. Edit: I need to stop writing posts from phone/tablet (spelling).
livingontheedge 14y ago
DON'T WORK FOR MATASANO!!! Reasons below: #1 Lack of honesty. Seriously, they promised releasing those crypto challenges publicly 2 years ago (Blackhat 11: Crypto for Pentesters) and never done so: https://twitter.com/matasano/status/101714851633700864 https://twitter.com/matasano/status/101714851633700864. And now they're using them as a recruiting tool. #2 Lack of humility: Matasano guys seem to disregard common tools like Burp scanner or Sqlmap. It's fine to cherry-pick tools to suite your needs; but if you choose to disregard them completely just because you feel they're associated with "Security Rookies" then you're more than likely to miss something, consequently disservice your client (they expect you, as a consultant, to find the most vulnerabilities regardless of tools used). Matasano may have better fuzzer/scanner, but since they don't publicly release them, I found that going around and bashing other security tools to position themselves higher than their competitors is a sign of arrogance. Go work for other companies, I don't want you HN people turn out to be like them! For those of you who emailed sean at matasano dot com but haven't received any response, go play with Trustwave crypto challeges: https://github.com/SpiderLabs/CryptOMG https://github.com/SpiderLabs/CryptOMG - And yes they don't have BS subscription model.
- daeken 14y ago
  So, I'm ex-Matasano and now work for Accuvant LABS (a competitor). While I'd love to snag awesome people to join up on my side, I completely disagree here. Matasano is a great company and they do do good work. #1 they should remedy for sure, but #2 I disagree with -- they hold the same opinion I've found in other high-end consulting shops, just more vocally.
  - livingontheedge 14y ago
    "We avoid tools like sqlmap" "I wish Burp didn't have a Scanner. I might pay $25 more for a branded version of Burp that specifically didn't have that feature, so I could reassure clients I wasn't ever using it." Tell me, how do you expect to find MOST instances of SQL Injection or XSS without using tools? Do you manually tamper with every cookie parameters? Unless Matasano has better tools and release them publicly, then I am interested in hearing about them.

jfolkins 14y ago

Tutorial I wrote on how to setup* BURP using OSX. http://www.acloudtree.com/how-to-configure-burp-and-chrome-for-https-ssl-packet-inspection-and-web-site-debugging-on-mac-osx/ http://www.acloudtree.com/how-to-configure-burp-and-chrome-f...

rdl 14y ago
I've always preferred keeping all that stuff in a VM (usually linux).
- daeken 14y ago
  I have a Windows VM that's snapshotted with all of my favorite tools. When I need to test something, I do so and then roll back. No mess, no cross-pollination of tests.
  - rdl 14y ago
    Yeah, I do the same thing with snapshots (and in some cases you're supposed to do work only on client/government-provided equipment, so moving a VM over is helpful).

passfree 14y ago

Or you can forget this java madness and go with Websecurify Suite (https://suite.websecurify.com https://suite.websecurify.com). It works from the browser and it is a lot faster.

tptacek 14y ago
I tried to see what this was and kept getting asked to sign into Google; I saw a page that mentioned "Subscriptions" and "Google Wallet", and thought to myself, "this is probably not going to talk me out of Burp Suite". I don't like Java applications any more than you do, but it happens that the best web testing application is built in Java; I'm not going to not use it out of pique.
- nbpoole 14y ago
  Hmm, a majority of passfree's account's submissions (20/25) appear to be for websecurify.com. Combined with the dismissal of Burp as "java madness," seems like a socketpuppet on behalf of the company.
  - daeken 14y ago
    Every one of them is either about it or a link to the site itself.

Slimbo 14y ago

This guide is exactly what I've been looking for, thanks Cody. Been on the receiving end of some very talented pentesters, and really want to learn more about how on earth they find the things they do. Want to make sure I catch your future editions, do you have anything I can sign up for notification? Can't find an RSS feed on your blog.

daeken 14y ago
I'm probably going to set up a mailing list soon, but if you drop me an email at cody.brocious@gmail.com I'll make sure to let you know when I put out the others. Glad you found it useful! Oh, also, follow me on twitter, as I'll certainly link it there. https://twitter.com/daeken https://twitter.com/daeken
Serplat 14y ago
I second the need for an RSS feed. I was actually a bit surprised when I couldn't find one.
- daeken 14y ago
  It's something I thought about for a while and just decided it wasn't worth it. I just switched away from Posterous (c.f. https://news.ycombinator.com/item?id=5388857 https://news.ycombinator.com/item?id=5388857 ) and when I was building the new blog, I looked at my RSS subscribers and realized only 15 people actually use it. Just wasn't worth building.
  - bigiain 14y ago
    FWIW, it looks like I'm at least the 3rd person today who would have added your rss feed if it existed...
    - defrndr 14y ago
      And I'll be the 4th.

DelvarWorld 14y ago

what is this nerd talking about this article has nothing to do with breakdancing

pgambling 14y ago

Is "Breaker" in the title a Dark Tower reference?

daeken 14y ago
No, but "So You Want To Be A ..." is a reference to http://en.wikipedia.org/wiki/Quest_for_Glory:_So_You_Want_to_Be_a_Hero http://en.wikipedia.org/wiki/Quest_for_Glory:_So_You_Want_to...

deleted 14y ago

[deleted]

edem 14y ago

So the official term for this kind of occupation is "breaker"?

daeken 14y ago
Security consultant, pentester, breaker. I prefer the latter.

Fa773NM0nK 14y ago

Great List. From now on, every time I write web code I'll use this as a check list!

jbackus 14y ago

No LFI/RFI mention? http://en.wikipedia.org/wiki/File_inclusion_vulnerability http://en.wikipedia.org/wiki/File_inclusion_vulnerability