at BalCCon2k17 METHODOLOGY FOR VULNERABILITY RESEARCH AND EXPLOIT - - PowerPoint PPT Presentation

▶
at balccon2k17 methodology for vulnerability
SMART_READER_LITE
LIVE PREVIEW

at BalCCon2k17 METHODOLOGY FOR VULNERABILITY RESEARCH AND EXPLOIT - - PowerPoint PPT Presentation

May 01, 2023 732 likes •938 views

at BalCCon2k17 METHODOLOGY FOR VULNERABILITY RESEARCH AND EXPLOIT DEVELOPMENT Presenter m-r Mane Piperevski BalCCon2k17 Novi Sad, Serbia 2017 WORLD OF BUGS BalCCon2k17 Novi Sad, Serbia 2017 HOW DIFFICULT IS VULNERABILITY RESEARCH? Learning

slide-1
SLIDE 1

BalCCon2k17 at

slide-2
SLIDE 2

METHODOLOGY FOR VULNERABILITY RESEARCH AND EXPLOIT DEVELOPMENT

Presenter m-r Mane Piperevski

BalCCon2k17 Novi Sad, Serbia 2017

slide-3
SLIDE 3

WORLD OF BUGS

BalCCon2k17 Novi Sad, Serbia 2017

slide-4
SLIDE 4

BalCCon2k17 Novi Sad, Serbia 2017

HOW DIFFICULT IS VULNERABILITY RESEARCH?

1.

Learning used technology

2.

Learning hacking tools and techniques

3.

Choosing the right approach method

4.

Found one … What next???

5.

How much money will I earn?

6.

How much money should I spend?

slide-5
SLIDE 5

BalCCon2k17 Novi Sad, Serbia 2017

HOW DIFFICULT IS VULNERABILITY RESEARCH?

All Things are Difficult Before they are Easy

slide-6
SLIDE 6

BalCCon2k17 Novi Sad, Serbia 2017

METHODOLOGY FOR VULNERABILITY RESEARCH AND EXPLOIT DEVELOPMENT

Approach method Way to find a door First doorstep activity Ending infinity Engineering Exploit Code

slide-7
SLIDE 7

BalCCon2k17 Novi Sad, Serbia 2017

METHODOLOGY FOR VULNERABILITY RESEARCH AND EXPLOIT DEVELOPMENT

Don’t forget to do this before you begin

slide-8
SLIDE 8

BalCCon2k17 Novi Sad, Serbia 2017

METHODOLOGY PHASE 1 APPROACH METHOD

Vendor dependent

Automated testing

  • Loud
  • Detectable
  • Non Efficient

Manual testing

  • Quiet
  • Intelligent
  • Time Consuming

Knowledge Base

slide-9
SLIDE 9

BalCCon2k17 Novi Sad, Serbia 2017

METHODOLOGY PHASE 2 WAY TO FIND A DOOR

If possible, try them all

Enumeration

  • Discover Inputs
  • Discover Activities
  • Discover the Surface

Thinking

  • Business Process Overview
  • Identify hidden opportunities

Diffing

  • Identify differences
  • Discover how they differ
  • Time Consuming

Target Door Entries

slide-10
SLIDE 10

BalCCon2k17 Novi Sad, Serbia 2017

METHODOLOGY PHASE 3 FIRST DOORSTEP ACTIVITY

If applicable, try them all

Bruteforce

  • Use of Fuzzing
  • Easily Detectable
  • Inefficient on Production Env.

Hapax

  • Unique Activity
  • It can be done only once
  • Related with business logic

Incantation

  • Predefined set of activities
  • Smart Fuzzing
  • Related with business logic

Target Door Entries

Tested without outcome

Discovered Vulnerabilities

slide-11
SLIDE 11

BalCCon2k17 Novi Sad, Serbia 2017

METHODOLOGY PHASE 3 FIRST DOORSTEP ACTIVITY

slide-12
SLIDE 12

BalCCon2k17 Novi Sad, Serbia 2017

METHODOLOGY PHASE 3 FIRST DOORSTEP ACTIVITY

slide-13
SLIDE 13

BalCCon2k17 Novi Sad, Serbia 2017

METHODOLOGY PHASE 4 ENDING INFINITY

Lucky choice

Bonanza

  • Time Solve Problem
  • Look from Different Point
  • New Ideas/Techniques

Breakdown

  • Review the Logic
  • Make Mind Map
  • Repeat previous steps again

Target Door Entries

Dead End

Discovered Vulnerabilities

slide-14
SLIDE 14

BalCCon2k17 Novi Sad, Serbia 2017

METHODOLOGY PHASE 5 ENGINEERING EXPLOIT CODE

Depends on the goal Totum meaning totally

  • Develop from scratch
  • Custom modules
  • Opportunity to sell it

Pars meaning partly

  • Use of Metasploit
  • Proof of concept
  • Short time to build

Unique Exploit Exploit Module

slide-15
SLIDE 15

BalCCon2k17 Novi Sad, Serbia 2017

DIAGRAM VIEW

Approach Method Way to find a door First doorstep activity Ending infinity Engineering Exploit Code

Avoid Detection? Yes No Automated Testing Manual Testing Knowledge Base Enumeration Diffing Thinking Target Door Entry s Bruteforce Incantation Hapax Target Door Entry s Tested without outcome Discovered Vulnerabilities Bonanza Breakdown Target Door Entry s Dead End Discovered Vulnerabilities Totum Pars Unique Exploit Exploit Module
slide-16
SLIDE 16

BalCCon2k17 Novi Sad, Serbia 2017

FUTURE DEVELOPMENT AND VISION

  • Building testing guide for every element
  • Create multiple practical examples
  • Create OWASP project
  • Vulnerability Research and Exploit Development Methodology
slide-17
SLIDE 17

BalCCon2k17 Novi Sad, Serbia 2017

PRACTICAL EXAMPLE

  • Desktop Standalone Application
  • Поинт Финансии

(http://www.point.com.mk/)

  • Microsoft Technologies
  • Use of tools
  • Sysinternals Suite of tools
  • x64dbg
  • Recommended starting point
slide-18
SLIDE 18

BalCCon2k17 Novi Sad, Serbia 2017

QUESTIONS !!!

slide-19
SLIDE 19

BalCCon2k17 Novi Sad, Serbia 2017

THANKS FOR ATTENTION