4 ms·

So, I'm ex-Matasano and now work for Accuvant LABS (a competitor). While I'd love to snag awesome people to join up on my side, I completely disagree here. Ma

by daeken 14y ago

So, I'm ex-Matasano and now work for Accuvant LABS (a competitor). While I'd love to snag awesome people to join up on my side, I completely disagree here. Matasano is a great company and they do do good work. #1 they should remedy for sure, but #2 I disagree with -- they hold the same opinion I've found in other high-end consulting shops, just more vocally.

livingontheedge 14y ago
"We avoid tools like sqlmap" "I wish Burp didn't have a Scanner. I might pay $25 more for a branded version of Burp that specifically didn't have that feature, so I could reassure clients I wasn't ever using it." Tell me, how do you expect to find MOST instances of SQL Injection or XSS without using tools? Do you manually tamper with every cookie parameters? Unless Matasano has better tools and release them publicly, then I am interested in hearing about them.
- tptacek 14y ago
  My gosh. Actually understand every cookie parameter, instead of running some tool to generate a list of obvious SQL injection vulnerabilities? Next they'll say they actually base64-decode every cookie too. How do they find time to sleep? We automate lots of things. We just don't automate things that remove judgement from testers. I've been a vuln researcher since 1995 and so have my partners. I was a lead dev on the industry's second commercial vulnerability scanner (Ballista), and Jeremy worked at ISS on the first. I think we know what we're talking about. Here is what we've learned: when you give a smart tester a tool that purports to find "low hanging fruit" vulnerability X, testers get worse at finding vulnerability X on their own. They subconsciously lean on the tool. They make assumptions about what kind of vulnerability the tool will find that they shouldn't waste time looking for. They gradually start getting worse at finding even the clever variations of X. So the challenge is to find ways to eliminate drudgery (for instance, in comparing large numbers of responses from a web app to a run of different metacharacter input vectors across every parameter) without introducing things that degrade tester judgement. Burp Intruder: Fine (though we do better internally for some things). Burp Scanner: Not Fine.
- livingontheedge 14y ago
   You can script the scanner to auto-decode B64 cookie once you found them: http://blog.portswigger.net/2012/12/sample-burp-suite-extension-custom-scan.html http://blog.portswigger.net/2012/12/sample-burp-suite-extens... It all boils down to: how can you be so sure if your tool/process is finding most vulnerabilities than others, and can you prove it? If I were your client, I would be very worried by now.
  - tptacek 14y ago
    You've got me. I've only ever tested up to 49 dynamic forms, and only 42 insertion points.

by daeken 14y ago

livingontheedge 14y ago

"We avoid tools like sqlmap" "I wish Burp didn't have a Scanner. I might pay $25 more for a branded version of Burp that specifically didn't have that feature, so I could reassure clients I wasn't ever using it." Tell me, how do you expect to find MOST instances of SQL Injection or XSS without using tools? Do you manually tamper with every cookie parameters? Unless Matasano has better tools and release them publicly, then I am interested in hearing about them.

tptacek 14y ago
My gosh. Actually understand every cookie parameter, instead of running some tool to generate a list of obvious SQL injection vulnerabilities? Next they'll say they actually base64-decode every cookie too. How do they find time to sleep? We automate lots of things. We just don't automate things that remove judgement from testers. I've been a vuln researcher since 1995 and so have my partners. I was a lead dev on the industry's second commercial vulnerability scanner (Ballista), and Jeremy worked at ISS on the first. I think we know what we're talking about. Here is what we've learned: when you give a smart tester a tool that purports to find "low hanging fruit" vulnerability X, testers get worse at finding vulnerability X on their own. They subconsciously lean on the tool. They make assumptions about what kind of vulnerability the tool will find that they shouldn't waste time looking for. They gradually start getting worse at finding even the clever variations of X. So the challenge is to find ways to eliminate drudgery (for instance, in comparing large numbers of responses from a web app to a run of different metacharacter input vectors across every parameter) without introducing things that degrade tester judgement. Burp Intruder: Fine (though we do better internally for some things). Burp Scanner: Not Fine.
livingontheedge 14y ago
 You can script the scanner to auto-decode B64 cookie once you found them: http://blog.portswigger.net/2012/12/sample-burp-suite-extension-custom-scan.html http://blog.portswigger.net/2012/12/sample-burp-suite-extens... It all boils down to: how can you be so sure if your tool/process is finding most vulnerabilities than others, and can you prove it? If I were your client, I would be very worried by now.
- tptacek 14y ago
  You've got me. I've only ever tested up to 49 dynamic forms, and only 42 insertion points.