Thinking Like an Attacker

Transcript

1. Thinking Like an Attacker
 (Hacking Your Own Organisation)
2. # whoami • Nick Le Mouton (@noodlesnz) • CTO Drugs.com • Developer • Security • Operations
6. Googlebot
7. A2:2017 Broken Authentication
9. • Disconnect between security and developers • Security find vulnerabilities • Developers fix vulnerabilities • Security often don’t impart how they found the vulnerabilities in the first place
10. • Best position to attack an application • Shift Mindset • Logic and knowledge
13. Object Injection Example • A8:2017 Insecure Deserialization
16. GuzzleHttp\Cookie\CookieJar
17. Payload
20. Blind XSS • A7:2017-Cross-Site Scripting (XSS) • Security scan shows no XSS vulnerability
21. XSS Hunter
22. So How Can I Do That? • Offensive Security Courses • Hack Yourself First by Troy Hunt (pluralsight.com) • https://infosec101.nz/
23. • Start hacking things, find out what works and what doesn’t • Damn Vulnerable Web Application (DVWA) • OWASP Juice Shop Project
24. CTFs • CTFLearn.com • Find upcoming online CTFs on ctftime.org • Read write ups at ctftime.org/writeups
25. Thank You