Be Mean to Your Code with Gauntlt and the Rugged Way // Velocity EU 2013 Workshop

@ W I C K E T T / / # V E L O C I T Y C O N F / / @ G A U N T LT

B E M E A N T O Y O U R C O D E W I T H G A U N T LT A N D T H E R U G G E D W AY

J A M E S W I C K E T T / / @ W I C K E T T


@ W I C K E T T

• Austin, TX

• Gauntlt Core Team

• LASCON Founder

• Cloud Austin Organizer

• DevOps Days Austin Organizer

• DevOps, Ruby, AppSec, Chef, Cucumber, Gauntlt


R E Q U I R E M E N T S

• Virtual Box

• Vagrant

• Gauntlt Box

• Pre-downloaded

• Ruby 1.9.3

• Git

• Bundler

• Reliable Internet

O R

O P T I O N 1 O P T I O N 2


bit.ly/gauntlt-demo-instructions

I N S T R U C T I O N S

http://bit.ly/gauntlt-demo-instructions


W H Y D O E S T H I S M AT T E R ?


P E O P L E M AT T E R


– H E N R Y H A Z L I T T

T H E B R O K E N W I N D O W FA L L A C Y


B E S I D E S L O S S , B R E A C H E S C A U S E C Y N I C I S M A N D D I S T R U S T


S O F T W A R E H A S C H A N G E D


S O F T W A R E A S A S E R V I C E


S O F T W A R E A S B R I C O L A G E


B O LT O N F E AT U R E A P P R O A C H


F R A G I L E C O D E A S A S E R V I C E


D E P L O Y T I M E L I N E S H AV E C H A N G E D


D E V A N D O P S H AV E F O U N D A N E W R E L I G I O N


S E C U R I T Y H A S N O T C H A N G E D


C O M P L I A N C E D R I V E N C U LT U R E : P C I , S O X , …


P E O P L E P R O C E S S T O O L S


W E H AV E A P E O P L E P R O B L E M


T H E R AT I O P R O B L E M


D E V: O P S : S E C U R I T Y

1 0 0 : 1 0 : 1


L A N G U A G E G A P


S E C U R I T Y D O E S N ' T A LW AY S S P E A K T H E L A N G U A G E O F T H E B I Z / D E V / O P S T E A M S


A B D I C AT I N G R E S P O N S I B I L I T Y P R O C E S S


Y O U N E E D E X P E R T S T O T E S T F O R S E C U R I T Y


F O R M A L I Z E D V I A A U D I T O R S A N D C O M P L I A N C E A N N U A L LY


D E V - > S V N | | G I T


O P S - > T X T | | W I K I S


D E V - > G I T < - O P S


S E C U R I T Y - > S O U R C E F O R G E !


S I G N S T H AT S E C U R I T Y I S M O V I N G I N T O A N E W E R A


A N A LY T I C S , M O N I T O R S , L O G S , T E L E M E T R Y, T E S T I N G , C O N F I G M A N A G E M E N T


AT TA C K C H A I N S A N D S I G N A L S

http://www.youtube.com/watch?v=jQblKuMuS0Y

http://www.youtube.com/watch?v=jQblKuMuS0Y


V U L N E R A B I L I T Y E X P L O I TAT I O N I S A T I M E L I N E


D I S C O V E R Y V U L N E R A B I L I T Y E X P L O I T


S Q L S Y N TA X E R R O R S D B TA B L E N A M E S L A R G E R E S P O N S E S I Z E S


I N S T R U M E N T F U L L AT TA C K C H A I N S A N D W AT C H F O R S I G N A L S


R U G G E D


http://www.slideshare.net/wickett/putting-rugged-into-your-devops-toolchain

http://www.slideshare.net/wickett/putting-rugged-into-your-devops-toolchain


https://speakerdeck.com/garethr/security-monitoring-penetration-testing-meets-monitoring

https://speakerdeck.com/garethr/security-monitoring-penetration-testing-meets-monitoring


D E T E C T I O N E A R L I E R


security tools today


E N T E R G A U N T LT


G A U N T LT I S A N O P I N I O N AT E D F R A M E W O R K T O D O R U G G E D T E S T I N G


G A U N T LT = S E C U R I T Y + C U C U M B E R

http://www.flickr.com/photos/35231744@N00/286858571/

http://www.flickr.com/photos/35231744@N00/286858571/


C O D E

B U I L D T E S T D E P L O Y

F E E D B A C K


C O D E

B U I L D T E S T D E P L O Y

~ 1 2 M O S . L A T E R

S E C U R I T Y


C O D E

B U I L D T E S T S E C U R I T Y D E P L O Y

F E E D B A C K


A S T O R Y F R O M 2 0 1 0 …


D E V O P S ( + S E C U R I T Y ! )

@ernestmueller, @iteration1, @bproverb and friends


R E S T E N D P O I N T S

Ruby Script

Questionable Payloads

Invalid Sessions

Large Payloads


C O L L E C T I O N O F S C R I P T S M E R G E D I N T O O U R T E S T R U N N E R


I N ’ S A N D O U T ’ S A R E E A S Y T O M E S S U P


C U C U M B E R A N D O U T S I D E I N T E S T I N G


T H E S TA R T O F G A U N T LT


O U T S I D E I N T E S T I N G F O R S E C U R I T Y T O O L S


O U T P U T F R O M S E C U R I T Y T O O L S I S H A R D T O D E C I P H E R


B E M E A N T O Y O U R C O D E


C O D E

GARMRNMAP

SQLMAPARACHNI


C O D E

SQLMAPARACHNIGARMR

NMAP


C O D E

ARACHNIGARMRNMAP

SQLMAP


C O D E C O D E C O D E

GARMRNMAP

SQLMAPARACHNI


B U T W H AT A B O U T T H E P E O P L E


C O N V E R S AT I O N A N D C O L L A B O R AT I O N I S T H E C O R E O F G A U N T LT


D E V

O P S

S E C U R I T Y

*.attack• Execution Knowledge

• Testing Logic Captured

• Repeatable


G A U N T LT I N A C T I O N


*.attack

something.attackelse.attack


Attack Structure

Feature

Background

Scenario

Description

Setup

Logic


Attack Logic

Given

When

Then


Attack Step: Given

Setup steps

Check Resource Available

Given “arachni” is installed


Attack Step: When

Action steps

When I launch an “arachni-xss” attack


Attack Step: Then

Parsing Steps

Then the output should not contain “fail”


G A U N T LT P H I L O S O P H Y


R U N S E C U R I T Y T O O L S I N A R E P E ATA B L E , E A S Y T O R E A D W AY


G A U N T LT D O E S N O T I N S TA L L T O O L S


G A U N T LT S H I P W I T H P R E -C A N N E D AT TA C K S A N D S T E P S


B E PA R T O F T H E C I / C D P I P E L I N E


H A N D L E S T D I N , S T D O U T, A N D E X I T S TAT U S


G A U N T LT I N U S E


AT A G A M E D E V S H O P

• Check for XSS (cross site scripting) [Arachni]

• Check for new login pages [Garmr]

• Check for insecure refs in login flows [Garmr]

• Extended XSS testing [Custom Arachni] (PR coming soon)


M E N T O R G R A P H I C S

• Smoke Test integration on environment build

• Checks REST services [curl]

• Tests for XSS [arachni]

• Injection attacks [sqlmap, dirb]

• Misconfiguration [dirb]

• SSL checks [sslyze]


AT C A B F O R W A R D

• Ruby Dev Shop

• Integrated into CI for customers

• GITHUB -> TravisCI -> Unit Tests / Integration Tests / Gauntlt


G I T H U B . C O M / G A U N T LT / G A U N T LT

http://github.com/gauntlt/gauntlt


$ gem install gauntlt


!Feature: nmap attacks for example.com Background: Given "nmap" is installed And the following profile: | name | value | | hostname | example.com | ! Scenario: Verify server is open on expected ports When I launch an "nmap" attack with: """ nmap -F <hostname> """ Then the output should contain: """ 80/tcp open http """ Scenario: Verify that there are no unexpected ports open When I launch an "nmap" attack with: """ nmap -F <hostname> """ Then the output should not contain: """ 25/tcp """

Given

When

Then

When

Then


H A N D S O N


E V E R Y T H I N G Y O U N E E D …




O P T I O N 1


O P T I O N 1 - C O N T I N U E D


O P T I O N 2


$ vagrant ssh !

vagrant@precise32:~$


$ cd gauntlt-demo


$ rvm use 1.9.3


$ cd ./examples

$ gauntlt ./hello_world/hello_world.attack

04_Hello World with Gauntlt.md


$ gauntlt --steps /^"(\w+)" is installed in my path$/ /^"arachni" is installed$/ /^"curl" is installed$/ /^"dirb" is installed$/ /^"garmr" is installed$/ /^"nmap" is installed$/ /^"sqlmap" is installed$/ /^"sslyze" is installed$/ /Î launch (?:a|an) "arachni" attack with:$/ /Î launch (?:a|an) "arachni-(.*?)" attack$/ /Î launch (?:a|an) "curl" attack with:$/ /Î launch (?:a|an) "dirb" attack with:$/ /Î launch (?:a|an) "garmr" attack with:$/ /Î launch (?:a|an) "generic" attack with:$/ /Î launch (?:a|an) "nmap" attack with:$/ /Î launch (?:a|an) "nmap-(.*?)" attack$/ /Î launch (?:a|an) "sqlmap" attack with:$/ /Î launch (?:a|an) "sslyze" attack with:$/ /^the "(.*?)" command line binary is installed$/ /^the DIRB_WORDLISTS environment variable is set$/ /^the file "(.*?)" should contain XML:$/ /^the file "(.*?)" should not contain XML:$/ /^the following cookies should be received:$/ /^the following environment variables:$/ /^the following profile:$/


bundle exec gauntlt --format html > out.html


• Google Group > https://groups.google.com/d/forum/gauntlt

• Wiki > https://github.com/gauntlt/gauntlt/wiki

• IRC > #gauntlt on freenode

• Weekly hangout > http://bit.ly/gauntlt-hangout

• Issue tracking > http://github.com/gauntlt/gauntlt

https://github.com/gauntlt/gauntlt/wiki

http://bit.ly/gauntlt-hangout

http://github.com/gauntlt/gauntlt


B E TA I N V I T E T O U D E M Y C L A S S ? E M A I L J A M E S @ G A U N T LT. O R G

mailto:[email protected]

Be Mean to Your Code with Gauntlt and the Rugged Way // Velocity EU 2013 Workshop

Technology

Transcript of Be Mean to Your Code with Gauntlt and the Rugged Way // Velocity EU 2013 Workshop