Gauntlt: Go Ahead, Be Mean to your Code

Gauntlt: Go Ahead, Be
Mean to Your Code

Tuesday, December 18, 12

Would you vote for this talk
as the best if...?

A. If its funny
B. If it useful to my job
C. Dude, I know you want to win
the iPad, you are down to 4 min
and 37 seconds, stop surveying
and start talking!

@wickett
Sr. DevOps Engineer
Mentor Graphics,
Embedded Software
Division
CISSP, GWAPT, CCSK,
GSEC, GCFW
james@gauntlt.org

gauntlt.org


A BRIEF HISTORY
OF INFOSEC


WE HAD
CINEMA


WE MADE FREE
PHONE CALLS

WE WERE COOL


WE COULDN’T STOP THE
VIRUSES AND WORMS


INSTEAD OF ENGINEERING
INFOSEC BECAME ACTUARIES


“[RISK ASSESSMENT] INTRODUCES A
DANGEROUS FALLACY: THAT
STRUCTURED INADEQUACY IS
ALMOST AS GOOD AS ADEQUACY
AND THAT UNDERFUNDED
SECURITY EFFORTS PLUS RISK
MANAGEMENT ARE ABOUT AS
GOOD AS PROPERLY FUNDED
SECURITY WORK” - MICHAL ZALEWSKI


“IS THIS SECURE?”
-YOUR CUSTOMER


“ITS CERTIFIED”- YOU


NO PAIN, NO GAIN


Put your code through the Gauntlet



Your web app You


generic w3af
garmr sqlmap

fuzzers curl

sslyze nmap

Your web app You


GAUNTLT ALLOWS DEV AND
OPS AND SECURITY TO
COMMUNICATE


install gauntlt

$ gem install gauntlt

# download example attacks from github
# customize the example attacks
# now you can run gauntlt

$ gauntlt

# gauntlt looks for *.attack in its
# directory

Examples > https://github.com/thegauntlet/gauntlt/tree/master/examples


@slow nmap.attack
Feature: nmap attacks for example.com
Background:
Given "nmap" is installed
And the following profile:
| name | value |
| hostname | example.com |
| tcp_ping_ports | 22,25,80,443 |

Scenario: Verify server is open on expected ports
When I launch an "nmap" attack with:
"""
nmap -F <hostname>
"""
Then the output should contain:
"""
80/tcp open https
"""
Scenario: Verify that there are no unexpected ports open
"""
nmap -F <hostname>
"""
Then the output should not contain:
"""
25/tcp
"""

Feature: Run sqlmap against a target

Scenario: Identify SQL injection vulnerabilities
Given "sqlmap" is installed
And the target URL is "http://localhost?id=1"
When I launch a "sqlmap" attack with:
"""
python <sqlmap_path> -u <target_url>
"""
"""
sqlmap identified the following injection points
"""



setup steps
"""
"""
"""
"""


verify
tool
setup steps
"""
"""
"""
"""


verify
tool
setup steps
When I launch a "sqlmap" attack with: set
""" conﬁg
"""
"""
"""



"""
attack!
"""
"""
"""



"""
attack!
"""
env
param
"""
"""



"""
attack!
"""
env
Then the output should contain: get
param conﬁg
"""
"""



"""
"""
"""
assert
"""



"""
"""
"""
assert
"""

needle



"""
""" haystack
"""
assert
"""

needle


Given /^"sqlmap" is installed$/ do
ensure_python_script_installed('sqlmap')
end

When /^I launch an? "sqlmap" attack with:$/ do |command|
sqlmap_path = path_to_python_script("sqlmap")

command.gsub!('<target_url>', target_url)
command.gsub!('<sqlmap_path>', sqlmap_path)
run command
end


step deﬁnition ensure_python_script_installed('sqlmap')
end


run command
end


step deﬁnition ensure_python_script_installed('sqlmap') ruby
end


run command
end


end


step deﬁnition command.gsub!('<target_url>', target_url)
run command
end


end


step deﬁnition command.gsub!('<target_url>', target_url)
run command
end
execute


Supported Tools

• curl
• nmap
• sslyze
• sqlmap
• Garmr
• generic command line

Try it yourself at
http://gauntlt.org/
with the new gauntlt
video tutorial!


Gauntlt: Go Ahead, Be Mean to your Code

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

Similaire à Gauntlt: Go Ahead, Be Mean to your Code

Similaire à Gauntlt: Go Ahead, Be Mean to your Code (20)

Plus de James Wickett

Plus de James Wickett (20)

Dernier

Dernier (20)

Gauntlt: Go Ahead, Be Mean to your Code