Using OSINT to Attack Web Applications

A mostly demo filled talk given at the 2015 OWASP Boston Application Security Conference (BASC). The general idea is that we can use OSINT tools to find known vulnerabilities in web applications that are exposed to the internet. This can be useful to identify sites that may be vulnerable to known vulnerabilities, as well as to find vulnerabilities in a specific target web site.

Transcript

1. Using OSINT to Attack Web Applications
2. Casey Dunham
8. Disclaimer This presentation is for personal enjoyment only. Views expressed are those of the author (that’s me) and do not reflect the opinion of any organization I am affiliated with.
10. What is OSINT?
11. Open-source intelligence (OSINT) is intelligence collected from publicly available sources
12. i.e.
15. What Information Can We Find?
34. Thank You!
35. @CaseyDunham
36. http://www.guidepointsecurity.com http://www.hackersforcharity.org http://www.googleguide.com https://www.exploit-db.com https://www.paterva.com https://www.shodan.io https://www.punkspider.org http://register.automatingosint.com http://www.social-engineer.org