automation - willis vandevanter

Building on an AppSec Pipeline with Burp Suite data - Part 2

In this two part series we are going to take Burp Suite Project files as input from the command line, parse them, and then feed them into a testing pipeline. The series is broken down into two parts: Getting at the Data (i.e. from the CLI to feeding the

burpsuite-project-parser

Building on an AppSec Pipeline with Burp Suite data - Part 1

In this two part series we are going to take Burp Suite Project files as input from the command line, parse them, and then feed them into a testing pipeline. The series is broken down into two parts: Getting at the Data (i.e. from the CLI to feeding the

automation

odle ruby gem: piping security data

I recently (May 2018) published odle which is a Ruby gem and binary that takes XML data from various security tools and outputs their JSON equivalent. The goal is to be (1) simple, (2) fast, and (3) work on many platforms with only one dependency – nokogiri. Quick Example of Piping

automation

Exploiting CVE-2016-4264 With OXML_XXE

Recently ColdFusion was shown vulnerable to XXE based attacks in OXML documents; CVE-2016-4264. The blog post linked gives an example building the file using python; cool! It’s easy to backdoor files in a similar fashion with OXML XXE. The fastest way to do this is using the “Overwrite File

automation

Finding Hosts Using SSL Certificate Organization And Censys

Finding hosts or domain names associated with a company where the domain name does not include the name of the company can sometimes be difficult. There are common ways to do it such as ASN or scope information (e.g. bug bounty ToE or IP block). One technique that I

automation

Cloud Metadata URL List

I landed the SSRF Cloud Metadata technique in a few different scenarios recently. If you haven’t seen the talk BHUSA 2014 - Bringing a Machete to the Amazon I recommend it. To make life a little easier created a living URL list for Metadata broken down by cloud. There

notes

Search all Github Repositories for an Organization

gumbler is a script I wrote to search through git commits and introduced in the blog post “Searching Through Git Commits”. Recently I wanted to run Gumbler across all repositories for an organization, the steps are discussed below. First, we need to grab a list of repositories for the ORG.

notes

Searching Through Git Commits

gumbler is a script I wrote to search through git commits. Examples from github are discussed below. .gitignoreA gitignore file is used to specify files that should not be tracked by git (source gitignore). In the default case, gumbler will read the gitignore file for the project and search every