The Bug Hunter's Methodology - Application Analysis | Jason Haddix

TL;DR

This talk introduces the Buck Hunters Methodology for application hacking, focusing on tools, techniques, and areas to look for vulnerabilities, rather than specific attack patterns.

Transcript

my name is jason haddix you may have heard of me through that awesome introduction by our streaming panel so that's cool i'm here today as your keynote and today we're going to talk about application hacking and my methodology i call it the buck hunters methodology uh i dropped this talk uh about a month ago at another con uh nahom con and i've mad... Read More

Key Insights

• 🎵 Key Insight 1: The speaker's methodology for application hacking is called the "Bug Hunters Methodology" and includes recon, application analysis, and content discovery.
• 🔥 Key Insight 2: The speaker emphasizes the importance of focusing on where to look for bugs rather than teaching specific hacking techniques.
• 💡 Key Insight 3: The mental hurdles faced when approaching bug bounty programs include client reputation, pre-testing expectations, the complexity of the application, and assumptions about open source software.
• 📚 Key Insight 4: Recommended print resources for bug bounty hunters include "The Web Application Hacker's Handbook" and "Real-World Bug Hunting" among others.
• 🌍 Key Insight 5: Resources for live hacking experiences include platforms like PentesterLab, Web Security Academy, and Hack The Box.
• 👥 Key Insight 6: The speaker recommends following specific people on Twitter for updates and insights on bug bounty hunting, with a list of recommended individuals and a Twitter list provided.
• 🚀 Key Insight 7: The speaker discusses the importance of overcoming mental hurdles and advocates that every application has bugs waiting to be discovered.
• ⚙️ Key Insight 8: The speaker shares key techniques and tools for pre-manual testing, automation, content discovery, application analysis, spidering, JavaScript parsing, parameter analysis, heat mapping, and note-taking.

Questions & Answers

Q: What is the Buck Hunters Methodology and how does it differ from other hacking methodologies?

The Buck Hunters Methodology, introduced in this talk, is a specific approach to application hacking that focuses on tools, techniques, and areas to look for vulnerabilities, rather than providing specific attack patterns like other methodologies such as OWASP Top 10.

Q: What are some common mental hurdles that bug bounty hunters face when approaching large or well-known applications?

The speaker mentions several mental hurdles, including client reputation, the perception of extensive pre-testing, the complexity of large applications, the belief that open-source software has already been thoroughly tested, and the tendency to only test the surface level of an application.

Q: What are some recommended resources for beginners in bug bounty hunting?

The speaker suggests several print resources, including "The Web Application Hacker's Handbook" and "Real-World Bug Hunting." They also recommend online resources, such as Pentester Lab, Web Security Academy, Hack The Box, and the OWASP Vulnerable Web Application Directory.

Q: How can bug bounty hunters keep up with changes and updates in target applications?

The speaker advises subscribing to the target's newsletter, joining their affiliate program for insider access, regularly checking for conference talks and updates from the target company, and using tools like change detection.io to monitor domains for code changes.

Q: What are some important aspects to consider when analyzing parameters in an application?

The speaker emphasizes the significance of parameter analysis, specifically looking at how the application passes data, how it refers to users, user levels/multi-tenancy, unique threat models, past security research, and how the application framework handles different vulnerabilities.

Q: How can bug hunters effectively utilize content discovery and spidering while analyzing an application?

Content discovery tools like wfuzz, ffuf, gobuster, and others can be useful in finding endpoints and parameters within an application. Spidering through tools like ZAP, Burp, HatCrawler, and GoSpider helps analyze the site's structure and discover various paths and parameters.

Q: What role does JavaScript parsing play in application hacking, and what tools are recommended for this task?

JavaScript parsing helps in identifying endpoints and parameters embedded in JavaScript code. Tools like LinkFinder, Grep-Extract, and Burp plugins like GaP and grep have been recommended for parsing JavaScript in both inline code and external JavaScript files.

Summary & Key Takeaways

• Speaker shares their methodology for application hacking, called the Buck Hunters Methodology.

• The talk covers topics like bug bounty resources, mental hurdles in approaching complex applications, pre-manual testing, content discovery, and application analysis.

• The speaker highlights the importance of parameter analysis, spidering, JavaScript parsing, and heat mapping as crucial steps in finding vulnerabilities within applications.