before i get started i want to say thank
you to the recon village for having me
and today i want to talk about the
future of asset management
i really want to ask if we're really
there yet and if that industry has
completely grown
before we get started i'm going to talk
about our agenda like i said i'm going
to talk about asset management different
ways you can actually look for these
assets
some of my personal benchmarking i've
done some research i've done myself
and we're going to kind of live example
and then we're going to
wrap this up and hopefully i can do some
do's and don'ts and give you
a overview of what i think should be
done in order to accomplish this
but before all that i want to introduce
myself my name is ben sadigapoor
and most people online know me as
nahamsek i have been hacking for
as long as i can remember as a young
teenager
but i've been professionally doing bug
bounties
since 2014-15 and i've been really
focusing on recon
with even a bigger focus on discovering
assets and extending my
attack surface when it comes down to
looking at an organization
from an external point of view so let's
dive into it
uh bear with me it's kind of weird doing
these live presentations i'm trying to
make sure i have my notes
the recording is going fine so bear with
me as i look around
and we'll jump right into it so if
you're not familiar with
attack surface management it is a thing
a lot of companies are getting into the
space
but it's kind of a fancy term for
knowing what your organization has on
the internet
so do you know what every domain that
you own every subdomain and that sort of
stuff and having an inventory of it and
there are big companies out there
like risk iq i think i would say it's
balbix randori coal fire
those are the big ones that i've heard
of and i think risk iq is in the process
of getting
acquired by microsoft it was already
acquired by microsoft whatever it is
there's also census census and shodhan
those two aren't really
doing asset management but they could be
used for that kind of stuff if you want
to do it internally they're kind of
expensive
but they do have that uh data for you to
use and get a list of your assets that
may be out there
depending on how they are scanning the
entire internet
so before i get started and dive into
all this i want to ask everybody in the
audience in the chat
you can drop this in discord but let us
know in the chat if
you know what your company has on the
internet do you know
everything just web assets that you have
a good inventory
and you know 100 of everything your
developers have launched
and it's currently on the internet so
that includes
the root domains that includes your
subdomains your ip addresses
your c2 instances your s3 or your
storages that you're using
if you're running stuff on heroku app
github pages and that sort of stuff that
also include
acquisition so if you are a big company
and you require some other companies or
some other startup
do you know what you have on there so
if you said yes this meme is for you
i don't buy it and i'm talking about
this based on personal experience
all right so the reason why i asked this
is because
having these assets externally being
visible to the entire internet comes
with a lot of
possible vulnerabilities that include
subdomain and dangling dns records
it could be expired domains so for
example if you've
purchased companyxyz.com for a side
project
did you uh renew that domain did you use
it ever again or is it still being used
in production
if you're using dev staging environments
meant to be internal are they
are they exposed to the internet your
continuous integration and development
are those
tooling internal and exposed you have
your back end
applications with a bunch of outdated
software probably because you think it's
supposed to be internal
you have your admin panels with
guessable passwords or maybe in some
cases
there's no even authentication involved
so a lot of these could be things that
are happening again these are things
that i have seen based on my own
personal experience as a bug bounty
hunter and a pen tester
um so i'm talking about a lot of
experience here the things that i've
seen
again there's a lot of times when i
approach a company and
i show them the things that i found and
they come back and they tell me that
um they didn't even know that that
belonged to them or that domain belonged
to them or this asset was externally
exposed and i'm not saying this you know
oh we didn't know this belonged to us to
make fun of the engineers or the
security teams but it's just mostly
it's a reality of a big organization or
a security
or organization of its own with a
security team that hasn't done
any inventory of all the assets they own
and again like i said it's not really
your fault because this whole thing is
incredibly messy
it's it's not easy to do it's not easy
to track inventory and the bigger the
organization
gets the harder it gets to think about
big organizations that
you see out there like google oracle
apple we'll talk about a little bit but
i think that's really really messy first
of all it requires a lot of skills
to operate and track assets so if you're
doing this in-house you might have a
dedicated team that's working on some
sort of project
to keep these things uh to track these
things and keep an inventory on it there
is no way i provide 100
coverage if you're doing a vendor for
example there's no way they're going to
give you 100 of coverage
that's not really going to be um
realistic because you're deploying
things every day if you're not scanning
every hour they might miss something
that you deployed for an hour ago and
it's been up for 12 hours and it's gone
down those are things that they can't
track
and again like i said it's incredibly
hard to scale these things for a large
organization like google apple oracle
think about like yahoo and amazon for
example um yahoo is not you know as big
as it used to be anymore
they've been divided into different
companies but think about amazon's case
amazon itself has
a ton of different
regional sites so if you're working with
amazon.com itself within the united
states
that alone has its own application own
microservices
versus the original stuff that could
come with
the portion of amazon for india or
amazon.de
for other countries each have different
backends they each have different
requirements dependencies
things that support it and each of these
different assets
could be in a different cloud account it
could just be hosted on a completely
different amazon account
than amazon.com itself because another
team another sub org owns it and that
just
gets bigger and bigger that list goes on
forever and it just makes an
entire scope of tracking assets a lot
larger
and a lot bigger obviously i'm not
saying like amazon or yahoo google have
these issues but
if you don't get ahead of it very early
on it's going to be very hard to
track later and you have to make sure
you implement things properly so
things that are supposed to be
internally visible only as they stay
internal
so you don't have to worry about so much
of tracking and keeping them locked down
so i said this again not your fault if
you're a security engineer you're
watching this you're on a security team
you're a cia whoever you are this is not
your fault
um you just have to figure that
especially if you're new to this company
so just let's
just think about the scenario you are
the new head of security
you are a security engineer you just got
this job at this new brand new startup
you learn the in and out of your
organization you learn all your policies
you learn how to improve a few things
you see all your pitfalls things that
need to be
improved and built on four years goes by
how does it look like now did you face
any reworks did you have to move
from an in-house space or an environment
to the cloud did you have to switch
providers from azure to aws because
you got a better deal or your budget was
cut in half whatever that reasoning
could be
how did you track everything how are you
tracking everything as you go how are
you tracking everything that needs to be
moved from one provider to another
there's a lot of things that could
happen in a few years
and if you don't have the right
processes in place that is going to be
extremely hard
to keep track of so that's just an
example of it why it's messy why it's
hard
and obviously more teams and more people
in charge people come and go they leave
things will get messy again even even
more messy
and vendors are also a big part of this
they need to step it up
we should talk about uh why the vendors
aren't doing a proper job of doing it
yet i'm here i'm not here to bash of any
vendors anybody that i mentioned
throughout the stock
isn't the part of the problem it's just
this is a very young and new
industry but the only thing is i've
realized is they're either
really good at focusing on being a good
at one aspect of this
asset management game or they offer a
large variety of
what i call unfinished products so
either they're really really good at
scanning the entire internet
but they don't give you good data they
don't have a good way of allowing you to
ingest that data or
look look at that data or the reporting
for it or they do a bunch of different
things like they scan
ports they pull certificates uh they
look for phones based on cves whatever
it is outdated software they do all this
stuff but
it's unfinished it's not fully done yet
and the ones that do actually do this
they're very very expensive they cost a
lot of money
one of the vendors that i know a friend
of mine works with
um i think they pay about twenty
thousand dollars a year and that's just
to get
access to an api just an api gives you
data for twenty thousand dollars
no no real reporting nothing like that
it's just very expensive
it's also hard to get real-time data so
by by that i mean the scan times are
either too long
it takes a few days to scan it and it's
not their fault again because there's a
lot of ipads
there's a lot of data out there to be
brought in and they also rely
they also rely on organizations knowing
what they own
so if an organization itself doesn't
know what main domains they own or what
sub domains they own what environments
they have
it makes it harder for them in a lot of
cases from what i hear is
the cso header security the cto whoever
is in charge goes into this vendor
meeting and says
i don't know what i have figured it out
that no that's not how it should be
there's gotta be that bridge that's uh
built between the two vendors and the
consumer
to make sure everything and everyone's
getting a full coverage of some sort or
getting close as we can
to providing full coverage so what do we
do now
well before i jump into the text i'm
going to go back before i answer this
question i wanted to actually
show you what it looks like from an
attacker's point of view and how you
approach a company and
i'm gonna walk through that process and
this is going to also touch on a limited
number of tools techniques and methods
that are out there
and i'm going to try and give you as
high level as i can without diving into
too much details
but i think it's something that we need
to talk about first
so the first thing is we're going to
look at the organization's structure
so again if i mention evil corp i'm not
calling any corporations evil
it's just the easiest name to come up
with but let's say evil corp owns
evilcorp.com
this is a large corporation they already
have
thousands of subdomains and internal
domains they could have
evil corp internal or it could have
evilcorp.net and some peoplecope.com for
their internal or corporate websites
evoke takes off
they have a ton of money investors are
happy they want to
take more of the market share so what do
they do they acquire evil startup
evil startup happens to be a big
infrastructure of its own they have a
lot of stuff on their own they have a
lot of domains i have a lot of sub
domains
and let's not even talk about the ascent
and the ip blocks that they may own
because that itself is another part of
this whole entire thing
that we have to take a look and we
repeat this cycle they buy more and more
and more and more
startups or other companies and that
scale
gets larger and larger and larger and
larger and it's very common in tech
companies especially
to see these uh mergers or acquisitions
to happen so we have to think about
how big this thing could become as an
example we can see that uber
has six acquisitions as far as i could
find this is
in the past 12 years the biggest and
most recent one was
their acquired post mates and postmates
i'm talking about experience here they
have a large infrastructure of their own
and i don't know what kareem is but
that's another entire organization of
its own to worry about and uber itself
is huge you have uber.com uber internals
and they have a bunch of different ip
addresses so that itself is huge
that's only with six acquisitions right
apple
i don't know what these two companies
are but apple's infrastructure alone i
think it's
somewhere between uh last i pulled a
number one and i think it comes down in
a few slides is
they have about 70 000
uh domains or you know sub domains that
has a keyword apple in it
and that's just apple.com alone and it
doesn't include
anything like um icloud or anything like
that either
so they have a hundred unfortunate
acquisitions their
as10 is giant it's one point something
million iphones
as far as i remember it's huge just
think about it like this is
giant company like apple itself and
they're not even the biggest one yet
there's also google google has 225
acquisitions
they have companies like uh point t and
app sheet and
more recent ones or more bigger ones
that i know of the waze looker
google itself you know google doc google
drive google sheets
uh scholar gmail all these micro apps i
have they're also huge they have a ton
of back ends
they probably have a huge infrastructure
also as well so you just can imagine
how much work that i've done to keep an
inventory to make sure things are not
being exposed
i'm not saying google apple these
companies actually know every
supplement or domain they own they may
or they may not but they have done the
right things the right approaches to
make sure things are gated enough
so the outside world doesn't see some of
these domains or sub-domains internal
services
or their corporate dev site whatever it
is they're not being visible
by the outside world so we're going to
talk about ocean and this is uh
i want to talk about acquisitions first
just to paint that picture of how big an
organization gets
and then how do i as a hacker can
identify all of these domains
if i'm lucky or if i have the right
tools so osan's a big part of it
now we're going to talk about a company
i like to work with a lot
i've hacked them a few times but they
also have a great bug binding program
great team
another great infrastructure it's a huge
infrastructure with a ton of
acquisitions
paypal so look at paypal obviously
they're on paypal.com
but what are some of the other domains
they own what are their acquisitions
what are their internal domains what are
their corporate domains
and what are some of the methods that we
can use easily using osen or some
tooling that are open source
and find more and more of these assets
well
let's take a look at the whois data for
paypal.com and this is really important
they have
the organization for the registrar for
the administrative contact
it's paypal inc and the email address
right here
our starting point is going to be
hostmaster paypal.com
that is great information to have and
now again i'm not saying that every time
we
go into a who is on a domain they're
going to have this data for us
but in a lot of cases some companies
have this email for the registrar and
again it could be
masked sometimes it can be protected but
in this case it's not
great what we're going to do is we're
going to find a
website like view dns info this one
costs a little bit of money i'm sure
there's better tools out there for it
um but this is one that i found that was
very very helpful so you go to this you
can do a reverse who is look up right
so cool we can do the registrant name
we're going to skip that one for now
too much work but just for the sake of
this conversation for the sake of this
presentation
i'm going to look at the email address
of it the registrar so i'm going to go
in there i'm going to type in host
master
at paypal.com we're going to push go and
it's going to come back with
3962 domains that this company has
collected
through the reverse who is lookup that
belongs to
paypal.com me as a bug money hunter
adversary whatever you want to call it
500 of these are free and accessible to
me
and i can just spend 50 bucks and get a
whole list of almost 4 000 domains that
belongs to this company
and that just starts at the start of my
day to start up my work
but you can see there is a accept venmo
which hints that they own venmo
they have some paypal stuff they have
some funding domains
you can go through their list and find a
lot of different information
personally for me the notable ones was
paypal.com duh that's a that's an
obvious one that's one that we know they
own they also
i also saw something like paypal dash
corp um paypal is actually very well
known for having
uh domains that either end in dash
paypal or start with paypal dash so it
could be
paypal dash marketing dot com paypal
dash corp as you can see on the screen
they're also on paypalcorp.com
braintree is one of their other
acquisitions or domains
they have bill me later and obviously
venmo being another big one
well we know that this is not the entire
list based on ranger alone
we can see there's bain braintree.com
braintree api
there's the tools and they also have the
gateway so there's a lot of domains that
probably have the keyword braintree
within it that we can find later on as
we do more research
and excuse me and they all probably have
a ton of subdomains too i know
paypal itself is huge but braintree
tools is an internal one that's huge
but this is just to paint a picture of
how big and how messy this could get
well lucky for us there is a certificate
transparency search transparency
which is an open framework for
monitoring ssl certificates so as soon
as a certificate is
issued to a domain it gets indexed
through one of these different
frameworks uh showdown does it
they allow you to do it through showdown
they're not specifically you know doing
this but should allows you to search for
it
uh census allows to do the same thing
for a limited number of queries but i
think you can pay them like a thousand
or something dollars a month i'm not
sure how much um but you can pay them
some money they'll give you access to it
store.ssh is free but they don't give
you a lot of data it's still use
useful to me personally as a hacker
search spotter and also google and
facebook have also gone
into the uh search transparency game so
you can use it actually with facebook
the cool thing is
on my phone i get push notifications of
some of these companies
that i have set up an alarm so it tells
me when a new certificate was identified
which is great because i can monitor it
now on my phone
well then when it comes down to looking
at a certificate there's a few things
that are very very important
at least for from my perspective and
things that i look at when it comes
down to identifying assets the first one
is
the subject organization this is the
organization that owns this certificate
based on the public key
the subject common name which represents
the server name that's being protected
by the certificate which is the host
name in a lot of cases
and also there's the subject
organizational unit this is the
department or the acquisition so in the
example right here as you can see the
organization itself is paypal
the organization unit is venmo
production
and this was issued to common name
ops.venmo.com and actually
if you pull this up and scroll all the
way down there's a ton of different
domains that's also listed
at the same time so but it's a good
information to have it helps you
identify and narrow down more of your
search
so i mentioned census one of my favorite
tools to use
it's nothing new but it allows you to
look based on the organization name so
all you do is part subject organization
you type in paypal inc brings you about
eight thousand domains
great or eight thousand assets and you
can see paypal inc
and braintree down there and also right
here qa.zoom or xom however you say that
that's a domain that i didn't know about
in my previous slides that also came up
great that's awesome we found more even
more assets that belongs to paypal
we can also do the organizational unit
so paypal itself is paypal production i
typed in paypal
it gave me secops paypal corp roca or
roca paypal.com
excuse me paypal inc.com and another
additional 3 000 domains some of it may
be the same as the previous one but it's
just to show there are different ways
you can actually identify these
just going through the certificates that
are on census itself
all right there's also the common name
the common name is a really
weird hit or miss one depending on the
organization but you can always look for
the common name you can type in
paypal.com paypal whatever you want to
look for
that's a great way to look for it not
really as helpful as the previous two
but it still gives you some data and it
shows you uh which ones have expired
which ones have been
um issued by digicert versus various
side and that
sort of stuff and the good thing about
this if you go back you can actually
do the tag or you can actually certain
sort them by the issuer which is
great because if you do if you see the
pattern
that is being used in a particular asset
it helps you narrow it down even more
so this is also the is one that i use
religiously
it actually has i think has a better
functionality for searching than most
other ones like census have which allows
you to actually search by any of these
fields through the certificate the
common name email address the unit name
organization name the dns name and
anything that you want to search for is
awesome it also gives you some more data
and the search can also
add output equals to json i believe
and that gives you a json blob of the
same exact data and it tells you when it
was logged
um it was the first time they've seen it
it was the last time you can see it
you can sort by it and all that good
stuff it's a great tool to use
but it also gives you some decent data
it doesn't give you the ip address i
think showdown is one of the only ones
that does it
now there's the tool that i use also
does a similar thing i just it's good to
have the ip address but it's not
required because
sometimes these are probably more than
likely internal like i hope these
qa sites on paypal itself uh content
transform.cuba.paypal.com more likely
internal
but you never know well there's also
recon tools you can use
amaz is one of the best ones i think
personally big shout outs to uh
obasp foundation and the team to support
this
adopting it also jeff foley and everyone
that works with him
done an amazing job i'm not here to sell
you on a mask but there's a bunch of
different tools you can use
subfinder i think the guys at this
project discover that's some really good
work
there's a ton of them you can use but a
mouse is a good one because
it actually allows you to uh do a bunch
of things there
so these are the three things that i
think are very very useful
when it comes down to using tooling like
a mass the first one is
intel which it gives you actually it
collects intel
and for enumeration so if you type in
collect intel
on organization paypal it looks for all
the domains it has in this you know in
its tool set with all the different
sources it has and then you can feed it
into a new later on
and it will perform enumeration on uh
these
different uh network mappings or
subdomains and domains that you have
found
through the intel and then next you can
uh visualize it so it actually gives you
a really nice looking graph
that shows you how things are connected
um there's also like
uh some dns stuff you can do with it um
to see if it resolves there is a tracker
there's a db thing and there's a bunch
of different other things you can do
with it but these are the top three
things that i found was really really
helpful using hamas
um the way they collect their data with
a pneum itself
it's through dns so they do some brute
forcing they do some reverse testing
they do some walking
there's zone transfer there's a bunch of
different things you can go on their
github page and actually see a lot of
this functionality
there's also the scraping they look at
ask.com but do
all these different search uh sites
doc.go dns dumpster and so on
they look at certificates we cover this
already but you can connect it to
facebook api google search spot or
sh they actually have a bunch of apis so
if you use some sort of an api you have
a key for
alien vault search spotter i mentioned
that earlier but
any of these different apis that a
vendor you may have a key to you can
feed it into this
through the conflict file i think and it
will pull from it and also it goes after
web archive so if you're not familiar
with wayback
or archive.org it actually goes to it
you can see the websites from 10 years
ago 2006 maybe even further like 20
years ago
and it collects data based on that as
well amazing stuff you can do with it it
just goes beyond just the regular
searching there is a lot of good
weaknesses and strengths for this
the biggest strength is it gathers a ton
of information it gives you domains it
looks like asn's they look for a bunch
of different things with different
methods
that include unit certificates brute
forcing apis there's multiple sources
uh they allow you to do a scripting
engine of its own we can write some
additional tooling and do other stuff
with it
but it has its downfall it has its
weaknesses you can't rely on a single
tool first of all as an organization
even as a hacker person i don't just
rely on a mass it's a great tool don't
get me wrong but
it's not 100 giving you 100 coverage
it's really slow against large
organizations just because it's not
because
it's not so much that they're slow and
they've built it to be slow but
the more data you have the more time
it's going to take for this to digest
run intel or and get that intel run
enumeration on it
and then finish that thing up you know
if you're doing 20 domains and each have
a thousand two thousand domains it's
going to take a very long time
it's not on umass but it's just one of
its weaknesses because it's a single
tool
especially if you rely on it and again
it might miss some of the newly
developed
or deployed apps or domains it may not
show up i did a benchmark on the domains
it could find based on the who is
and it was missing a ton and again it's
still a new tool i think it's only been
around for a few years
uh but it's getting there and also let's
be honest does every domain and every
subdomain have a certificate
i think it's becoming a best practice to
do it on default but i've seen a lot of
domains
a lot of sub domains at least that may
still not be protected by an ssl cert so
that's another one
it's not so much a mass weakness but
it's a part of the
part of the game especially when it
comes down to certificates
so this is at a high level what it looks
like when you want to enumerate
what i'm doing here is i'm just saying
hey i don't want you to get any intel i
have a domain that i want to
specifically go after
i want you to enumerate give me the
source an ip address
i will talk about the ipad just in a sec
but
this gives me where it's coming from so
i know obstacle venmo is coming from
search spotter
versus scope.qa.venmo it came from
hacker target for example
and this is just vanilla umass i don't
have any keys or any of my
data imported into it but it's just to
show it gives you this
beautiful data and it's very very
helpful when it comes down to it
but before i go further i want to
quickly do a recap i know i threw a lot
of stuff at you
um but the the the things that we talked
about if i can get it out
the first thing that we talked about was
the reverse lookup based on the
registrar's email
that's very helpful if you're lucky if
it's not protected you can get some
really good data
it's not that expensive you can also use
some tools i'm sure the one that i
showed isn't the only one
but that's a really good starting point
then you can pull sub domains based on
certificate transparency great
we can use tools like amass to gather
more info automate visualize etc
then we can use at what ip addresses are
coming out i mentioned
asn a bunch of times and the cool thing
about asn is if you have the block of
asn so if you see
that a mask comes back and says like hey
they own this
autonomous number that they have you
know this is this
asn number that they have
you can actually have a mass enumerate
more data and gather more intel on that
as number and you can find more domains
and subdomains and internal tools
based on that we'll talk about the asm
thing a little bit i actually
scanned the entire ipv4 that i really
want to talk about in a little bit
but that's a really good place to start
and see what's being deployed every day
or every week
within those ip blocks that you own and
you just repeat this process and use
other tools
that's what we talked about so far there
are other options i just brought this up
scanning the ipv4 space which is one of
my
favorite things to talk about and this
is one of the things i've been obsessed
with for years
uh but before i jump into this actually
i want to say a big thank you to a few
people
uh one of them being zayat
going by zai is an amazing hacker he's
been a good friend of mine
uh we experimented with this a little
bit
at a very small scale and then i met
tanner aka staticflow he actually helped
me with a lot of this data
we did a talk on scanning the entire
ipv4 and finding some bugs for fun
which led to hacking apple and a few
other big orgs you can check that out
later it's on youtube but
it's a very cool thing when it comes
down to scanning the ipv4
there's some pros and cons the pro is
you're in control how frequent you want
to scan data for you can control that
you want to do it every day
you want to scan it every week takes us
three hours so i can literally scan
three hours and then reset that scan
immediately to see if there's more
changes you can actually store and
access the data
um searching is very important and i
will talk about that a little bit
but you are in control of how you ingest
that data
and how you can access it and how you
can search through it and also what and
where you collect the data is really
important
a lot of organizations are scanning for
443 a lot of companies
focus on 443 but we also went as far as
scanning for eight four four three eight
thousand eight eight eight ten thousand
four four four three and some other
ports
and that even gave us more data because
some of these ips just had nothing on
him on 443
versus that 8443 there was a lot of good
data that we could come up with
the cons of it it's um it's messy i've
been saying everything is messy today
but
it requires a lot of engineering effort
it's time consuming it takes a lot of
time to get a good build going it took
us
over a year to figure out how to bring
down the cost and how to do it
uh fast we made a really big mistake at
some point and we sent the wrong
requests and we got a ton of nasty grams
and a ton of pissed off people that
didn't understand we're doing this for
research
we're not trying to hack into your
company we're just collecting data on
your certificates but
that could be a part of it and it's also
very expensive i mentioned
um and how you ingest that data could be
very hard if you don't have the right
people to do it
but also there's always this question
that i ask even when you work with a
vendor
you have the data now what what are you
specifically looking for how are you
going to organize it
how are you going to prioritize what
you're going after
but this is my personal use case for me
personally it gave me
more access and accurate data from the
sources that i've
you know that i've scanned the first
thing was i can search for
any keyword in any domain or any
subdomain so i could just
type in give me everything that has
paypal in it
and i could also say give me everything
that has jenkins in it for example which
i'll show those in a little bit
i can also search based on the
organization so i can say hey show me
every certificate that's been issued by
the organization paypal
we should give me more domains in our
case we scan daily almost in most cases
and we choose what pores to scan
sometimes we'll do eight four four three
sometimes into four four three
just because we wanna see what data we
get i also like to do
um i wanna access the ip i wanna know
where did i get this certificate
what ip does it belong to that's very
important especially if it's a corporate
domain or an internal asset
then i know what it's out there we're
not going to get into that a lot i just
want to highlight why it's so important
and obviously this also doesn't give me
100 coverage
but it's still the closest that's come
because i can also
look at the different results so if i
scan today or this morning and i rescan
again at nights
and it takes me three hours to do each
gain what are the differences between
the two
what change for paypal.com from this
scan
versus the other scan that i just did
was it a new asset that came out what's
the new domain that came up those are
very very
interesting to look at and i think that
also gets missed
by a lot of vendors because they're
scanning every few days
and i actually did a little bit of
research on this last year we found some
really cool stuff that were coming up on
a tuesday
and by friday it was gone we could no
longer see it it was no longer
accessible it was either put behind some
firewall or it was completely taken down
so there's some cool stuff to think
about especially when it comes to
looking at what assets you own
so one of the things that i was talking
about is in this case i'm just looking
for everything that's
has the root domain so the braintree
domain
the root domain so whatever.com.net
doesn't matter what it ends with but i
want to make sure the domain itself has
the word braintree
so you can see in that tool it's one of
the domains it's braintree
payment uh braintree.tools also came up
a few times
but i'm just saying look at the
subdomain data before the root domain
and look at everything that has dev so
it came up with developers
dev dot branch dot api and blue front
door qa dave
something uh sorry blue front door qa
dev
dot brain tree whatever that domain is
so it's giving me some really good data
uh based on brilliant the keyword dev i
could just switch out there for api i
could switch out there for
internal corp whatever that is so i have
the freedom of searching however i want
for whatever i want and it shows me the
ip address
next thing is looking at sending word
paypal i want to see the apis
is what is onpaypal.com that has the
keyword api so there is
course.api again think about the domains
the text in there it's multiple domains
not everything it's not showing the
entire row for us in the screenshot but
there are multiple domains in there in
some cases
but there's api dash s api dash a a
api api-aa-3t
and it shows me the iep i just where to
collect it from
i did a count i just want to kind of
show how messy it is just for apples
when you look at the rdn for apple right
here it shows
almost 60 000 domains of matched apple
that's a lot of domains
if you are a big organization like apple
itself so that's another option of
things you can do
i'll talk a little bit but this is the
last thing i want to show is jenkins i
this is nothing to do with this talk but
i want to show how scary it is that
so many people's uh jenkins and simpsons
are being shown publicly almost
11 000 13 thousand or twelve thousand of
them but
i wanted to show you how messy it gets
for some of these organizations
but also having good data what i was
demonstrating there
you don't have to go to the extreme of
scanning of ipv4 you can scan your isn
you can ingest the data from somebody
else but having the freedom of
knowing what you're doing with this data
how are you going to utilize this data
what are you going to search for how are
you going to search for this data
these companies are going to give you a
report but it doesn't necessarily mean
it's complete or it's what your team is
is in need of so you want to also know
different ways and things that you can
do with this data
to find things that may be useful to you
imagine if your dev sites are being
publicly accessible if they're publicly
accessible and that's not
something you need that you don't want
to be exposed that's a good way of
realizing that it is being accessible by
a third party or an outsider than your
organization
so some of the options of uh things you
can do here
is you can pay thousands of dollars a
month and have a big org give a list of
your assets
there's a ton of those we talked about
them again like i was mentioning earlier
this is not the best way to ingest data
or monitor them sometimes it's
incomplete things change
day by day um you can
also work with those oils to get those
open ports asset names
they'll give you the possible cvs that
your assets are vulnerable to
but it's not a complete inventory of
everything you have
you can also go with the smaller ones
intriguing asset notes are also really
good alternatives
big shout outs to jay crane and shabam
shaw uh the two people that are behind
these two companies
but they have downfalls and this is
nothing against them they're good
friends of mine not here to bash on
anybody but they're still in early
stages
they're still trying to figure out how
to scale how to get really good data for
each other customers
and make sure it's complete their
product isn't complete yet they're still
controlling or they're still collecting
data um
it's getting there don't get me wrong
but i just want to say there are
different options you don't have to go
with the big guys like risk iq
and all the other ones that i mentioned
there are some bigger startups that are
coming out and doing this a little bit
different
and better than the uh older ways of
doing this
the options that i showed of using tools
and chaining them together a mass
up finder sublister find domain enter
whatever tool name you have here
like i mentioned you can also scan the
ipv4 or scan asn
depending on how large your organization
is if you have the resources to do it
good for you
if not you got to find a way of getting
better data
or pay for the data that you have my
favorite option personally and you know
it's not going to be a
talk by me if i don't mention bug bounty
programs if you have a bug money program
work with your hackers ask them how did
you find this asset how did you know
this thing was being hosted on port 3000
and you found the
ipa address but couldn't access it we
can't access this domain but
obviously you have found a way to access
by ip what tools did you use was it a
source that you
specifically paid to get this collect
data from your reports and analyze that
so the hackers are willing to share with
you and how they have done these
understand it like take some time and
work with your teams internally and see
why this happened the way that why was
this thing exposed why was this thing
online what was this thing
um who owns this domain or
infrastructure whatever it is internally
and really really analyze it and maybe
host a recon challenge and if you don't
believe me uh big shout outs to security
trails actually they just uh partnered
with hamas
and they did a competition where
they were actually paying or i think
it's actually still going on for another
few weeks
they're paying hackers to submit data um
to their
platform which is a great way for them
to collect data don't get me wrong but
you can do that on your own too like hey
give us a list of everything you
can find on our company and want to know
how you did it people may do it if you
have a bug binding program if you have a
uh the funding for it you have a bug
binding program a successful program
that you work with hackers on regularly
this is also another way of doing it so
i talked about all this stuff
i want to talk about my solution i don't
think i have a really
you know one model fits all solution but
i have some stuff that i want to talk
about
so far we know all the tools the vendors
you can use the most efficient way of
discovering assets
everything's there we talked about that
it's not a 100 coverage
but it gives you a good starting point
to discover and track some of your
assets
some of the things that you can do this
is kind of a do's and don'ts is actually
create a dedicated environment for
testing sites and make sure it's always
protected so if you're doing
dev.site.com make sure no one can access
that because if they can't access it you
don't have to worry about what's out
there
because no one can actually see it it's
good to have the list so no you want to
have a list of those
you might want to create a process to
deploy and track those assets internally
but if it's protected you don't have to
worry about somebody owning that
environment
and getting in and also find a way of
a process where you can actually um take
these assets down i
mentioned earlier on in the in my slides
that you know
once you have these assets coming down
what happens to the dns record is it
just still pointing to the thing that i
was pointing to a month ago since the
box is down
or the other way if you took down the
dns record is the ips is still up and
accessible
you want to think about those things
again make sure you keep track make sure
you have some way of collecting data
from your teams
and also help vendors it doesn't help
when you go to a vendor and say well
i don't know what i own figure it out
they're going to figure it out but
at the end of the day you know your
infrastructure better your engineers
know what to look for what they own so
work with them as well and that's
obviously the opposite is almost the
same thing but the opposite don't expose
your assets
uh don't just take down your assets by
deleting it delaying the record or just
deleting the box and saying you'll be
fine
don't just rely on vendors for
everything really find a way how you're
going to take down that data
how you're going to collect data from
them and what are you going to do next
with that data that you're
getting from the vendors have a really
good process of
i actually have a process of going
through that data
and how you want to uh manage it and
what are the things that you look for
and don't wait until later if you're on
a security team at a startup
start thinking ahead your company's
going to even grow and grow more
every year so don't wait three years
from today to do this start thinking
about how am i going to start tracking
all these things
so my thoughts on this again as i've
mentioned
there is this is still a very immature
and young
it's still growing we're getting there
it's it's not 100 there but a lot of
companies are doing some really good
research
uh again improve and create your
processes really work with your teams
you really want to i want to
make sure that there's something that
you guys take away if you folks take
away from this talk is to really work
with your teams
to create a process to track all these
different data you work with your
vendors
you create your own tools on top of
these different vendors you work with it
doesn't hurt to run amass if you really
know how to use these tools doesn't have
to be a mass
but running a tool here and there to see
what kind of data you have work with
your red teams your blue team to see if
they can do it
and obviously really analyze your data
that you get from your bug binary
program
and other security teams if you think
i've missed anything so far i would love
to hear your thoughts i'll be in the
chat obviously but
i also would love to hear from you so if
you want to tweet at me and let me know
i would really appreciate it um again
this is
something very very new i think the
asset management
attack surface management industry is
going to be the next big thing
but it's also up to us to make sure we
work with the entire industry whether
it's with your hackers whether you're
working with your vendor
and also doing some additional research
and work together really to get this
entire thing to push forward other than
that i just want to thank you again for
listening to me
i appreciate you all for having me and a
big thank you to the recon village
uh for hosting this year at def con
again thanks