HOW AUTOMATION & DATA PLAYS A GOOD ROLE IN PENTESTING - Gravithon

Transcript

1. Introduction ◦ Security Engineer @ Novelship ◦ Top Hacker @ NordVpn ◦ Synack Red Team Member ◦ Full Stack Developer ◦ CTF Player & Author ◦ YouTube Content Creator ◦ Speaker At Various Cyber Security Events ◦ Course Instructor For 70+ Hours Course On Bug Bounty / WebApp Pen testing @CyberXplore
2. AGENDA FOR TODAY Quick Intro To Pen- testing Red Team Vs Blue Team Explaining Few Hacking Terms For Beginners Knowing More About Reconnaissance/ Information Gathering Understanding How Automation Helps In Cyber Security ! Understanding Importance Of Data In Automation ! Can We Depend On Automation? ACase Study QNA With Audience
6. 5 PHASES OF PENETRATION TESTING
8. Famous Hacking Terms 1- BUG 2- Vulnerability 3- Payload 4- Exploit 5- Reconnaissance (Passive & Active) 6- RAT & Malware
9. Knowing More About Information Gathering ! ◦ 1- Whois Search ◦ 2- Historical DNS Records ◦ 3- Collecting Emails ◦ 4- Subdomain Enumeration ◦ 5- Wayback Machine ◦ 6- Technology Fingerprinting ◦ 7- Javascript To Target More Attack Surface ◦ 8- Data Breaches Are Goldmine ◦ 9- Do You Know How To Use Search Engine Effectively ◦ 10- Code Repos Like Github , Bitbucket , Gitlab ◦ 11- Pastebin & Open Trello Board
10. A QUICK GAME TIME (1-2 MIN)
12. Role Of Automation In Cyber Security ◦ It Makes Easier To Do Information Gathering ◦ Easy Attack Surface Management ◦ Saves Time ◦ Quick Report & Alerts Helping Incident Response Team ◦ Easy Exploitation Of Common Vulnerabilites ◦ Automate Exploits Workflow With Help Of AI ◦ Most Helpful On Big Targets
13. Importance Of Data In Automation & Cyber Security ◦ Helps Understanding What's New In Web Application & What Changed ! ◦ If You Found Any CVE Or Zero Day It's Easier To Locate Many Assets And Do Quick Report . ◦ How About Having Hashed Password Of Company Employees . ◦ Greatest Benefit Out Of Data Is How Organized It Is . I Feel That Most People With Good Automation Lacks So Many Simple & Good Vulnerabilities Because Of Lack Of Good Data Visualizations . Because How They Store Data is Mostly In Text Format , Json Format Instead Of Database So They Can't Query And Do Something. More Out Of It .
14. Having Data Is Biggest Weapon When It Comes To Cyber Security . There Are So Many Possibilities. We should treat personal electronic data with the same care and respect as weapons-grade plutonium – it is dangerous, long-lasting and once it has leaked there’s no getting it back.
15. CAN WE DEPEND ON AUTOMATION ?
16. A BIG NOOO !
17. A CASE STUDY
18. A THIRD-PARTY VENDOR ISSUE
19. QUESTIONS & ANSWER TIME