Paul Mueller

Pentester for Black Lantern Security (@BlackLanternLLC). Specializing in web applications and appsec. Wannabe cryptography nerd.

[Paul Mueller @paulmmueller]

We are finally fully publicly releasing my new BLS tool Badsecrets! (https://t.co/esgTOFqDKL). Can detect the use of known cryptographic secrets by looking at the cryptographic products they produce and checking against list of leaked keys, or against common passwords.

[Paul Mueller @paulmmueller]

@irsdl also, how often do you see mac disabled these days?

[Paul Mueller @paulmmueller]

@irsdl I haven't seen the talk, do you have a link? I am working through your additions now, the resource module is a good idea, i had no idea that was possible. If I hit any snags I'll let you know. Might not take everything right away.

[Paul Mueller @paulmmueller]

@Burp_Suite Any chance you could make the tab pop-out thing require more than 1 pixel of movement? I pop my tabs out accidentally like 100 times a day 😆

[Paul Mueller @paulmmueller]

Big upgrades to Badsecrets https://t.co/esgTOFqDKL in version 0.3.x

Upgraded CLI!

Supply your own custom secrets file that will work alongside the defaults with -c

Also, some modules will give you the hashcat command to facilitate bruteforce cracking when no secret is found

[Paul Mueller @paulmmueller]

@Jhaddix Particularly if they are pushing into post-exploitation, this is an awful idea. They are going to look identical to someone there to do them existential harm to the SOC once they start generating crowdstrike alerts.

[remy🐀 @_mattata]

Aaaaaaaand prompt injection in VT’s new feature. Puppies can’t be malicious.

(Not the creator, sent to me)

https://t.co/9bDNbNk65w

[Paul Mueller @paulmmueller]

@Jhaddix @krrohit210302 I am very interested in your 'additional tactics' if you were ever willing to share :D

[Paul Mueller @paulmmueller]

@Jhaddix I know the point of your tweet was "no command line tools" and "quick" but if instead thoroughness was your priority, c99 is just one of 80+ modules in BBOT https://t.co/wt5MNhbGHU, roughly half of which are focused on subdomain enumeration.

[Paul Mueller @paulmmueller]

Just added an eleventh Badsecrets module that can detect the use of known secrets in express.js signed cookies https://t.co/esgTOFqDKL

[Paul Mueller @paulmmueller]

@irsdl adding to our BBOT bypass403 module
https://t.co/6NxmpwWEHH

[Soroush Dalili @irsdl]

#ASPNET web form tip when bypassing certain WAF rules using #COOKIELESS:

✔️WAF blocks `/admin/main.aspx`
✔️WAF uses canonicalization & not case sensitive

Possible bypasses:
🍪/admin/(S(X))/main.aspx
🍪/admin/Foobar/(S(X))/../(S(X))/main.aspx
🍪/(S(X))/admin/(S(X))/main.aspx

[Paul Mueller @paulmmueller]

@Jhaddix @mattjay @BlackLanternLLC We were definitely surprised at how common this is.

It's 'unpatchable' because the vulnerability is human carelessness, but web frameworks can and should be making this almost impossible, and many already do.

[Paul Mueller @paulmmueller]

@Jhaddix @mattjay @BlackLanternLLC Which means the other part of the effort is collecting such keys. It's a little sparse for some of the modules at the moment, that's where i'm really hoping the community can pitch in.

[Paul Mueller @paulmmueller]

@Jhaddix @mattjay @BlackLanternLLC Whereas Trufflehog is looking at a repo to find unknown secrets, Badsecrets is determining when a known secret is in use when all you have is the product of it - I.E., was this cookie signed with a key found all over GitHub?

[Paul Mueller @paulmmueller]

Read more on our blog (https://t.co/1JBolZaRaz).

[Paul Mueller @paulmmueller]

We are finally fully publicly releasing my new BLS tool Badsecrets! (https://t.co/esgTOFqDKL). Can detect the use of known cryptographic secrets by looking at the cryptographic products they produce and checking against list of leaked keys, or against common passwords.

[Paul Mueller @paulmmueller]

Similar to Blacklist3r, but covering many more platforms, and 100% python (no more booting up a windows box to check for known dotnet machineKeys), and much faster. Best of all, there's already a BBOT (https://t.co/wt5MNhbGHU) module to help you find these issues at scale.

[Paul Mueller @paulmmueller]

@irsdl I absolutely love this vulnerability. We've written a pure python version inspired by your tool in BBOT https://t.co/QEQ4ohxJie. We even have another module that takes the hints, makes a custom wordlist of words that match the prefix, and runs FFUF against it

[Paul Mueller @paulmmueller]

@MeAsHacker_HNA BBOT can do almost all of this with a single command
https://t.co/wt5MNhbGHU