Going on everyone Sam here with late sports cards for 10 box Tuesdays 10 box treasures football mixture number 180 random team style Look again at your end results as always you can find these on the website under the results tab as well as a link in chat Phil Kay up top with the Texans Jason S with the Saints Stephen are with the Broncos and Derek P with the Colts on the bottom. So good luck here everybody Let's do it We'll start with Domros team all or optic team all right Yeah, I know good luck ice man. You're better off in 23 products as well tune in Wilson sign a lot So you got some shots there for sure Hello CPAT that is John Mechie they finally use them this one there Red stars Mike will and boy Serves like the first time I saw corporate Cordero this year CPAT. Yeah, I know Let's look to what my Corbin auto. Yeah. No, that's pretty solid. I would I would grade it if it looks good Milan Prism draft hobby, what's a ram? Let's go Ramam. I love it 2023 Panini prism draft. I swear. I couldn't find this anywhere Two-point game now Sam Four packs in here, it's gonna mall out There's all four take that and empty Leonard for net McKell Jones McKell Jones Anybody will anybody in college will be a random to all Currently a free agent. Where did you play? Okay, so he's on the Chargers and the Cowboys practice squad that'll go Chargers by longest tenure Chargers by longest tenure Devontae Smith to 249 a Micah Parsons to not numbered base and will Anderson Got to Kari Robertson. These guys are sure is a free agent But he got he's been everywhere All right, where's he the most? I see the longest 30th August September October October October November So that'd be the Rams right there. It's gonna go to the Rams By longest tenure Yes, Chargers Trenton Simpson silver and to Lee to Lee to a pillow to who is on the Chargers This one there Los Angeles Jake Hainer to 99 Zay flowers To 49 Anthony Richardson and Tana McKee Silver Brian Robinson jr. Christian and volus nice one there Patriots signing day a lot of that's in New England Manning it really does the pen shop. I've had to come back as soon as like two three weeks Sometimes it I mean a couple years ago. It's like a year. Yeah, it's not a lot better It's got a lot better over the past couple of years, but it's a typical stuff I'd say over a month around. Yeah, that's me a month and two That's safe drum for it to 199 nice one there for the Browns Silver Brian breezy and Jalen wide-amiris guys been pissing me off for two years now Because he's like you have to like add up where he was Of course, he's a free agent because he's a bot Yeah, no, I think they're they're a lot more caught up survive since like the the scary times, but Yeah, this will go Colts. Why don't I go Colts most recent and longest tenure? 65 business days It's not terrible honestly read to 299 Zach Evans starting out Washington on the snakeskin Hutchinson and Josh Downs 23 legacy That's definitely fair I know for big cards like here. I think you're talking about the palo. So I Know I that's still being redeemed, right? Should you get that back? Yeah, you're still waiting on the Palo right Devante Adams to a hundred One two three top four five six bottom on this card right here. So go for the rest of the duals of legacy It's gonna be a one. We'll go to the top. We'll go to the top with the Travis My home's under the lights. I like SGC. Yeah, yeah, I like SGC too Very killed to 125 especially for vintage. I like SGC a lot came out real nice. Let's go. There you go, Shai Purple nice Clayton tuned to 10. There you go. Iceman nice one there, buddy the starter in Arizona right now Bijon Blue colored grading slag, I don't think you can do that Milan. Oh Grading okay, I see it never mind. I know what you mean like the cases that you put on the outside that no That'd be smart three strows in a purr. You want to send in? Yeah, it's not a bad idea strive Miles Murphy going to the Bengals Silver rookie auto Brian breezy for the Saints to at 35 Miles Garrett's 299 Lannister and Zach Evans Yeah, it all depends on what the true RPA is like out of NT. It's a huge difference T-Law, that's like the hardest thing to explain to somebody Well, why it's the same player basically the same card. Why does this do that? It's like well, I don't know People are annoying. That's why Dak Prescott Vita Vaya to 299 Whatever I wanted. That's fair to set up differently where you want to display it. Yeah Allen blast from the past your boy His he was it was more favored that he'd go under eight and a half points. He was like negative. He was like plus 200 to go over and like minus 111 ride with reddish. Oh, yeah 400 points rammed to all at the end kind of day Oh, yeah I would always I'm betting against camera all the time 23 certified now DJ more to 349 CJ Gardner Johnson will Anderson 149 for the Texans rank San Diego State lost to Grand Canyon. Oh That's bad 149 my homes yikes grand can that's got a pretty significant dent in it.  Let's go Brennan W. Brennan Mark Andrews Hell, yeah, love that dude. Is that Korean Ganyan? No, it's not the Aztecs and must be Brandy Moss Chase Brown to at 349 Let's go Grand Canyon. Hell, yeah, I'm in I'm grand Canyon way. Absolutely. I have not shady. I have not so Yeah, T law that is Aaron Rodgers piece of the game to a hundred one ninety nine. I got you Brennan Gcs little motto. Hell, yeah, I love it DK certified stars. Hey banks to at 25 for the Giants Grand Canyon anelopes. Hell, yeah Gold team Garrett Wilson Jack Campbell to 275 Travis Kelsey John Taylor 15 of 15 for the Niners Nice one there Actually did go the Grand Canyon shape Pretty cool. Cool. That's pretty cool. Nice 299 George Kittle and freshman fabric rookie jersey order 399 Tyler Scott They have like helicopter tours you can take in that stuff is the way cooler way to go I went to like the big damn Hoover Dam a couple other spots where you can like observe That's cool Do note mosaic no huddle now. Yeah, I was a kid in Vegas. So I wasn't interested in all the All the Vegas things the Vegas stuff. I'll take a dang you beat me to it the helicopter tour Yeah, let's go shy Madison I'll go a helicopter tour with you Tyree killed disco hi it and Brian branch although we go to Vegas I don't know if we're making it to the I don't know if we're making it out there Ty's a spears nice one there too at 50 do a dice roll on the Carbon copies one two three left four five six right There'll be a three. We'll go to left with Joe burrow And if there's any other team that is on the left Mims Take all the base cards matrix disco of Alec Pierce Henley Sean Clifford London Hooker blue Daniel Jones To at 75 Michael Vic Bennett and Emmanuel Forbes Yeah, I've never I don't think I'd ever go to Vegas. There's a couple There's a couple like really popular cities people love I would never step foot in with Danny and Tomlinson Will Anderson Shire Brown big I mean I would go to Vegas, but I wouldn't be What is that good stuff going on there and which one Vegas? Yeah, I mean I would probably do Vegas at some point I wouldn't really enjoy it. I don't think though That is Trell Davis to 10 Ten Anderson Travis Kelsey fair CJ Stroud Michael Meyer my big thing with big vacation spots I don't like going to places that doesn't feel like a vacation because you're too busy doing stuff I feel like that's the that'd be my only gripe with Vegas I feel like I'd just be busy the entire time and I'd come back like less relaxed Could just sit out by the pool and watch the bets flow. That's what I would do You don't need to honestly sure I'll tell they're crazy also very sure five-star restaurant I'm gonna show is all in the same TJ Watt Micah Parsons disco Marta Mopu Colby Wooden and base Yeah, no, I went to New Orleans.  I came back for that. I was not happy You don't have to watch that's true. You don't have to walk a block Sharpener Jake Ainer rookie auto nice one there for it the Saints Kelly Ringo disco Leviss Sanders and Vlami Fogat. They'll probably pay way. I have to imagine they'll pay with my body for his bachelor party's thinking about Fish concert at the Vegas sphere on 420. Oh my god Told John about that. He's Justin Herbert.  He says some things. I can't repeat. Oh, yeah Good news gracious fish on 420. The spirit I Worked with a guy when I was in high school who was like a huge fit you followed fish everywhere. Yeah Randy White To at 75 CD Lam DJ Johnson Tyler Scott get good Cajun anywhere. Yeah, I wasn't a fan Shot over Nola handful. Yeah, if it's close, I mean if it's close I don't want to fly to New Orleans like I'm not I'm not doing that again And my other one I would never do I I don't think you could pay me enough money to go to Nashville, Tennessee What I no chance. I'm ever going to Nashville there. There is zero parts about Nashville. I would like Everything that Nashville stands for I'm like against chicken Yeah, good KFC hot chicken do Want to go to Nashville for it There I don't like country music. I'm not a I don't like live music in general Really don't like country music. So already out on that hater.  That's fair take Bigsby to 199 nice one there for the Jags Henden Hooker to 25 nice one there on the turquoise Congrats on that Lions that's what I'm saying about exactly because I don't I don't really drink much like I'm not a big drinker. So Chase Brown rookie Jersey Auto Nice one there for the bangles So like cities that are like heavily like based on having a lot of fun without like which I like there's nothing against that I'm not like anti-drinking or whatever, but like it's just not my scene really Do gold standard now see there you go Shady that now you're speaking my language Shady. I speak in my language Drake London to 14 and to 75 Ty J. Spears Got a notch and send it to 99 nice on their lines Got Jake Heiner to 49 three colored patch for the Saints. Nice one there. No, la Josh Allen heart of gold to 199 for the bills Michael Pittman, Jr. 5 by 24 on the Midas touch Very cool one there. I already know we're gonna have an empty box. Look at how bad the peeling is on this next one That's what I'm saying. That's what I'm saying Rishi rice to 199 again, that's super peeled up there. I'll send an empty box wrapper. That's really bad. Sorry about that chiefs mosaic choice now Yeah, that was that's like the worst one I've seen out of gold standard this year and gold standards had its its share of bad bad peeling issues stripping gold box Wait, really? Oh, yeah in the homes. That's right. Geez. We got a black gold. It looks like That's pretty cool Luke schoonmaker and Clayton tune We have two autos in this one too Keenan Allen and Will Anderson, Jr. on the mosaic group Got to 25 on the green Ryan Tannehill for the Titans in focus Yeah, that one was not Cool one here 17 to 25 Clay Matthews senior That's on that one Cowboys, I mean not Cowboys Browns. You'll see why I said Cowboys. There's a Roger Staubach black gold six of eight Congrats on that one. There you go. Cowboys Got Jaden Reed to 80 for the Packers and a Ray Lewis to 80 for the Ravens No close 48 of 80 All right, NT collegiate Again any guys still in college in this we pull like an Arch Manning or Caleb Williams will be ran through all at the end Two booklets in this interesting. We've got two ninety nine is Odell Beckham, Jr. Cool one there God for the Eagles tanner of a key. Nice one there Eagles. God. All right So Roshan Johnson's a bear Bijan's a falcon overshones a cowboy and Keondre Covern is a Saint is a chief All right, so chiefs. So we've got bears is Matt M Keith's falcons Keith is Falcons Cowboys Brandon M and then she's Charles. Yeah, so that'll be a random to these four teams Nice one still though Going to the Chargers on the booklet that is gonna be a Quentin Johnson Nice one there horned frogs. No, I haven't watched it. Yes, Shady. Yeah, same here Shady. Not yet. I have to though Yeah, right. So yeah, we just Kyle just sent that honestly Shipey is like oh now Phoenix is coming back Zach Sharpen a ice one there to 99 on the RPI for the Seahawks. That's Seattle We've got a Hand and Hooker booklet RPA to 49 for the Chop the pen when he signed that go into the Lions Nice one there Detroit 25 of 49 Derek Henry going to the Titans on the two-color patch nine of 39 Congrats or fuse a trustee low I'm not getting one more three. It's always breaking my heart and four of 25 Marvin Mims Nice one there. Congrats on that one Brian. You are the Seahawks.  Don't get me wrong, but like Jesus man, Sam's ready to type today. This is gonna be my fourth treasure chest I've had to random out of freaking energy this year So we got and there's another booklet on the back to that's what really All right, we've got a Barry Sanders to 99 Nice one there lions Nice Tom Brady that is to 25 treasure moments I Was passing yards in a season in his career Calvin Austin 21 of 25 Nice one for the Steelers. There you go. Should fire the cannons Okay. All right. It's only a rookie triple. Okay, you're ten five of ten three three color patch Is Jalen waddle four of 25 rookie triple booklets Malik Willis it's all in Traylon Birx and Hassan Haskins. Let's go. No random Congrats Titans. That's awesome Malik Willis Traylon Birx and Hassan Haskins. Congrats on that one. They're Titans on the rookie triple booklet. Very nice We've got 40 of 99 is gonna be a for the Dolphins On this piss to a Tyree kill and Jalen waddle to 99 Chad Mooma Nice one there to 49 Congrats on that one Jags That was like lighting a huge firework And it didn't go off 42 of 49 is a money tumor. Nice one there for it the Giants same spoiler. Oh, yeah Oh, yeah Scott s I am jealous 40 of 99 Kyle Hamilton. Congrats on that buddy. Let's go true. RPA My guy 66 of 99 go into the Titans Malik Willis three colored patch booklets of the Titans got both booklets It's kind of random It's nice one there to 99. All right a couple of randoms to do Got the quad and then we've got the points Lighting a huge firework.  It's so true shape. I'm a quad was what? Pijon is there's falcons Cowboys Doing the points random to start us off all 32 teams have a chance to win this roll the dice We're gonna go seven times one two three four five six and seven going to the Panthers It's like the break gods are punishing you geez. I'll be in tomorrow And then random on the quad as well. No, I feel that I feel that I feel that I feel that I feel that We got the Bears Roshan Johnson B. John's a falcon overshones a cowboy and Coburn is a chief You go eight times one Two three four five six seven and eight going to the Bears. I just won their bears All right quick recap here joysies we had The triple for the Dolphins Jalen waddle Calvin Austin Marvin Mims Derek Henry Josh Allen Aden Hutchinson Jake Hainer patch Tank Bigsby chase brown and Aaron Rogers autographs Chad Mooma a Monty tumor Kyle Hamilton to 99 Zach Charbonnet Tana McKee Clay Matthews Brian Tannehill Rishi Rice Michael Pittman Jr. Chase Brown Henden Hooker Jake Hainer Tyler Scott John Taylor Miles Murphy Jalen Wadamire Jerome Ford Christian Gonzalez Tully Tully Tully Palotto Chikari Roberson McKell Jones Seemed to get the Rams cheese first edition booklet was Malik Willis we had the rookie triple for the Titans four of 25 That is Willis Traylon Berks the Sondhaskins Henden Hooker to 49 and a Quentin Johnson to at 99 For the break everybody. Thanks again for the fill up next is the iMac mixer


Okay, we're good. Excellent. Our next talk is being helped by Fabian Mihailovic. He's gonna tell us about vulnerable web applications. So without further ado, please welcome Fabian. So, hi everybody. The topic today is don't scan, just ask. Basically, a new approach of identifying web applications, network reconnaissance and actually exploiting them. Therefore, we developed a tool called the SpiderPic, a colleague of me, Richard and me. And basically, the tool tries to model business relationships of a company and identify web applications in order to attack them and reduce some of the problems we have with classical network reconnaissance. The table of contents basically is to give an overview of what we do today, what restrictions that does have, what enhancements could be made, then a presentation of the tool we developed. Sadly, we won't release it due to German law and stuff, but we will explain you how it works and you will be able to implement yourself pretty easily, I hope. And then I will show you some statistics of a real-life scenario, how it could look like, how it works in practice. And at the end, we do have the conclusion. So what do we have at the moment when it comes to classical network reconnaissance?  And if you want to attack a certain company, you can look up IP ranges in that databases. You can have a look there, you can see information on the domains, which networks. Of course, we do have reverse DNS. We can try to resolve additional host names. If we have an IP of the company and hence maybe access some web applications and stuff. If you do have access to a DNS server of the company, which is misconfigured, you might have luck and perform a DNA zone transfer to identify new targets as well. Then we have those classical information, just Google for it, search forums, search social networks. Or, for example, you could send packets to the systems, analyze how it is routed, which hops it takes and hence maybe identify new routers, new components, which might be hosted in additional network segments and hence identify new networks as well. Or you could brute force DNS names and all that kind of stuff. So that's nothing new. That's been there for years. We used it to identify targets. If we do have a company in scope and you do have tools like standard Linux tools, who is Dick, all that kind of stuff. Maltigo, which is a pretty nice tool and sums up all the tasks and one simple to use tool in which you can perform all the tasks with just a few clicks. However, that's not like business works in reality. You could say we have one target, let's just call it company A with some nice web service, databases whatsoever. And you do have satellite companies, which are connected to that company that might be branch offices, some partner firms from acquisitions and stuff. And you might have service providers, sure, like payment providers, which take your payments. You might have separate web hostels, because you don't host everything yourself. There might be service standards that take your way or manage your warehouse and stuff. So that's how reality looks. You have one target, but you have many satellite firms connected service providers. So you do have a whole measure. In reality, what we see with network reconnaissance is basically we concentrate on that target. We look up net blocks, IP addresses, URLs. That's basically what we work with. And if we do that for a company and we know what we look for, because we look for a company A, we hopefully might get all that information. For the other companies connected to that one, we hopefully might identify most of the information as well. But as long as you don't know which service providers and other companies are connected to the whole context, you probably won't see that whole part. You just will see this and maybe some of those, but you won't see all service providers and company connected to that one in scope. So that brings us to the restrictions we do have at the moment. The scans are solely based on a technical level. We really concentrate on IPs. We concentrate on net blocks, URLs and stuff. We don't take any business relationships into account. And actually, we might get an incomplete view because you can only search for in the databases and stuff what you know. If you know the company A has named A, you just can search for A, but you probably will never use or look up service provider B. So not all targets are identified because if you are an attacker, you probably don't go just for one company in scope if you can attack company B which provides you with the same result. If you're interested, let's say the classical example credit card data and it is hosted on company B as well and company B is an easier target. So just attack company B, why attack company A? So, yeah, furthermore, we don't take any business relationships into account. And the enhancement might be to build a logical network of systems that are somehow connected together independent of the actual owner of the system. Just based on the goal to get your job done to reach the goal you have. And therefore, actually, we developed a tool we call spider pick. And that's what the talk is about. What I want to show you what could be an approach of going new ways. So spider pick now tries to identify web applications in an automated manner and tries to do that on a business level on just a keyword level. And we structured it in four steps. In the first step, you basically you model the business, then you perform certain search queries, you calculate and rank results and at the end you exploit them. During the modeling the business phase, we tried to model services and relationships of the company in scope. And therefore, we basically will just use a keyword list, a rated one with details like text numbers, imprints, product names and all that kind of stuff. The interesting part here is that the whole basis we use for the search from now on consists only of or can consist only of usual terms of the company. You don't have to provide any technical details at all. Then we perform the search where we query search engines in an automated manner. We sum up the results, we perform who is queries, check them as well. We crawl identified web pages and check for external links to new web pages. And at the end, we sum it all up, remove duplicates, build a sorted list in which we score how probable the web page is part of the company in focus. And at the end, we pass them to a exploitation framework and hopefully get access to the system or some nice vulnerabilities out of it. So let's dig into the steps and to the four steps. The ideas, web applications connected to a company probably contain stuff like an imprint, independent of the host or service provider. They probably contain terms like product names and all that kind of stuff. And we do have keywords that are bad, like product names. Probably you will end up with Emma soon which hosts hundreds, thousands of those products. And you'd have terms which are very specific. For example, a text number. Not every web page will contain a text number of company A. Probably it will just be on the web page of them. And they're impressive. So what we did is quite simple. We just assembled a list as a first step in which you just have the business terms and you sign a score. And you do have significant terms and non-significant ones. Like company names rated very low. And for example, a certain imprint or text number gets quite a high score in practice. It shows that with 200 terms, you already can work pretty well. And that a scoring from one to 100 should be sufficient. So the next step actually is the main part. What happens now is that we take the keyword list and you go to different search engines, Google, Bing, Yahoo. It's basically up to you. And you start to search for the keywords. And interpret the results and build up a result set. Basically, we use that table, whereby we use the full qualified domain name as identifier, because that's actually a certain target. And if you use that as identify, you already can remove duplicates. And if you search for a term, let's say you searched for the company imprint and you identified it right here. We add that row and assign a score of nine, which was assigned to that certain item. And if you search for a product name and you end up with the same FQDN again, within a new page, we add the new score again up to that one. And so the score increases. And actually, based on the keywords, which are referenced to a certain FQDN, the score is increased. And the more relevant keywords, the website takes the higher the score gets. So the next step then is that we resolve the IP and perform who is queries for the FQDN and the IP. And if the who is information now contains terms of the list as well, or maybe even the company name, then it's definitely a hit. And we can already mark it as hit, because if who is information contains the company name, it's probably hosted by them. And then you can add additional steps. For example, I wrote a module. If you have a company, you know, just operates within European market, you can completely add a filter and just take systems into account which are hosted within Europe. So you could easily add additional steps to fit to your business. But when we now come to to implementation, as I said, it's pretty easy. Mainly the main component can be written within 500 lines of pearl code. That's that's what we did. Because it was quite simple and straightforward. We integrated Google and Bing as search engines. We didn't even use a database. We just took all the results in the memory and wrote dumps to the disk from time to time because it runs quite a while. And if it crashes or goes down for some reason, you want to lose don't want to lose all the results. And query Nick and write databases is something you should take into account. Every database provides you data within different formats. So you have to keep this in mind when parsing the data. And you have to keep in mind that you can't query as fast as you would like to. Because the service will block you.  However, as you do get 100,000 or 200,000 of result. And if you throttle just by one second, you will end up with days or even weeks to tool running. So you should try to rotate service. When it comes to the search engines for pearl, at least you do have many modules. Sadly, none of them did really work. Many of them were quite deprecated than the old ones. But using curl and regular expressions, you can easily implement the search engines yourself. Google, for example, provides the custom search API that can be used. You can do 1000 queries per day for free. However, that won't be sufficient for a real search. So if you want to use the service efficiently, you have to buy a search key, which is charged on the amount of search queries to execute. And for a normal list with 250 keywords, it will result in around 200 dollars. One important thing you have to consider when implementing is that you consider different languages. If you search for Germany, you will get other results than if you search in Spain. So you have to search in different languages to get all your results you want. And you have to disable filters, not that Google just removed some of the results. Same for Bing. You have the Bing API, which needs an app ID in order to use it, but you can request it at Bing developer center for free. You can use Bing as search engine completely for free. You just have to throttle your queries because, yeah. Here we don't have languages. We do have markets, but it's basically the same. You have to consider different markets. You will get different results here as well. And you have to disable the adult filter as well, because otherwise some results might get removed. And then you can easily just use those URLs. It's pretty straightforward. Just use Curl and resolve those domains. You can put your query in here. You get the number of results per page. You can use your pointer where in the results set you want to be. You define the language, which basically is that one. And that kind of stuff. So same for Bing. It can be integrated, both of them pretty, pretty easily. Yeah. The next step is now we have got a scored list with the search results. And we can assume that hopefully if the stuff works in front of the list, we will have web pages linked to the company. And web pages that are connected to a company probably contain links to new company web pages, contain external links. So what we can do right now is that we take a result set, the top of the list, and we just crawl it. And that way we will be able to identify new web pages, and which can just append them to the list as well. Furthermore, if we crawl those pages, we already do perform the first part of the vulnerability assessment later on, because now we can get all the formula and URLs and form fields which are on the page and can store them in the database. So we already did the crawling part. Here, in order to do this, we used a framework called Peter. Right here, I have to give credits. The framework is a private framework developed in multiple years by different security consultants working at diverse companies. And we just made a few slight modifications to that tool in order to integrate SpiderPik into it. So that's won't be released as well and has not been written completely by me. But basically, the crawler is written in Perl, go through the site in order to perform the first part of the VA and external links and it uses that database structure. You can see for each website, you get with the external URLs, for each internal URL, it gets the content, it gets the forms on that page, which are interesting for the actual attacks later on. It gets the form fields assigned to the forms, it gets HTML comments, it gets emails address and all the kind of stuff. So with that information, you can already do pretty much stuff like you could check out which webpage takes credit card data, which webpage contains the log in, which page uses which technology, how much attack surface, how much forms does the webpage have? You already get all those information. What happens right now is that now we are at a point where we search for pages, we got them, we crawled them, we appended the additional results to the list, now we have a score list. If you use a graph to print it, it's not scientific at all, it's basically a trial and error with some assumptions, that's the graph. I did for the real life scenario you will see later on, I guess it was like 130,000 results and that's basically the number assigned to the results and that's the score and you can see that it has that function. So we do have very much pages that we identified which have one or two score points, so they just contained one term like maybe a product and they, which as can say they are probably irrelevant, we won't take them into account anymore, then we do have pages with a very high score that's probably Amazon or some kind of pages which take all the links and search terms you look for and hence in every search query you find those results, so you can cut down to that area which you take a look at and you can see it's like only 300, so out of 100 or 200,000 results we can cut it down to 300 results that actually look promising with a score which lies between a very high one and a very low one and we have to take a look at those ones manually. That's besides assembling the keyword list, the only step which now is manual, so you have to take that list and click on each page but for 300 pages that can be performed within minutes it doesn't take too long. So and now we have targets and we have the information we got from our crawler and the database, so we do have the targets and we do know the forum fields and all the dynamic parts of the web application. So what we can do now is and again that's Peter hasn't completely written by me it's part of other people's work but we integrated Peter to run it against those web pages. There are fuzzers for cross-site scripting, SQL injection, so they are run against the information on forums stored in the database. We start a web application, fingerprint automatically which gets the MD5 hash of the websites and checks whether it's a known product like WordPress or whatsoever. We do have cookies, session analyzes, we start as else as we fire up third party tools like SQL map and map Nikto and run it against them and at the end aggregate the results into one report. That's the interesting part right here. At the end we get a report with vulnerabilities out of keywords. At the beginning we never provided any IP or any domain we just put in business terms, nothing technical and at the end we get actual vulnerabilities out of it so that's pretty cool. If you would run that against a big known company we might get the following results. We used 287 keywords, we ran it seven days including the actual vulnerability assessment. I mean it could be optimized but I think it's okay, you can fire it up and it runs. The costs were 200 dollars but just due to Google basically if you don't integrate Google if you just use Bing or maybe Yahoo I don't know whether Yahoo is for free but if you integrate it you basically can go out with zero dollars and we identified 150,000 unique FQDNs and that's the point of the tool basically. It's not rocket science what we do here but you can't do it manually you can't perform all those searches and check everything so that's the idea of the tool to basically take a lot of work from you. I applied a filter since the country just operates within European Union and just filtered out all systems not host within the European Union and we came up with those and we took you can see right here that were the 300 systems that I took and checked manually and at the end I found 223 applications connected to that company and not just on company systems but on external systems like customer services, marketing campaigns for which marketing agencies created their own pages and stuff and what shows it works pretty well is that the official web pages were within the top 10 of the different countries so it shows we go into the right direction and vulnerabilities yes yeah we identified some yeah so that brings me to the conclusion at the end classical network reconnaissance is good but it doesn't take all the specs into account that the moment we operate on a very technical level and we should elevate it to a more business level and try to really check for how the network the company has within its business looks like and try to attack it and that's what spiderpick was developed for thereby you should note that really based on a keyword list I say it again but based on a keyword list you get actual vulnerabilities and besides assembling the keyword list and besides yeah checking the result set you don't have to do anything everything is completely automatic furthermore spiderpick provides you with some interesting information and for example how much results does google find and how much does being find google didn't find how they correlate and stuff so it's pretty interesting to see how search engines and stuff works so which brings me to the conclusion that companies should not only focus on protecting their own systems because as a attacker you will attack or go the most easiest way so you should choose your service providers with caution and you should try not to spread sensitive information across multiple systems if possible so I have to give credits to Richard who developed the idea and tool along with me and now it's up to you for questions and thank you very much for your interest thanks very much I think we do have time for one or two short questions can you please put your hand up if you have a okay you go there I'll get this one put your hand up yeah hello um did you will you try to to um in a future version to add a module that um accesses existing databases like business registries and stuff like that to map out the companies if you have a specific target in mind for business intelligence purposes or stuff like that yeah that's that's that's a very good idea I never came up with it what we did actually to develop the keyword list is that we did it manually we looked up text numbers on official web pages we looked up product names in the assembly but that's indeed a very good idea you could even automate then could just say the company name is a.com or yeah and then completely yeah that's indeed that's a very very good idea I will consider that for for the next version cool I would just like to ask everyone who's leaving the room now to please do it quietly and move out of the front door so we can let new people in from the back we do have another question back there please put your hand up again no first row right here right here okay we'll get to you we do have another question from the IRC in the meantime I'll come to you net hunter 80 asked if the the company was tested if it was Sony no comment no comment there okay um do you intend to provide this even if you can't release the tool do you intend to provide it as a service sorry uh even if you're unable to release the tool are you going to provide as a service um I haven't thought about that yet it might be possible yes to to actually implement a web page where you can upload your keyword list and at the end you might get the results that yeah that that might be possible but I didn't think about that but yeah I will take it in mind but at the moment nothing like that is planned okay that's all the time we got unfortunately thank you again Fabian again if you