[HN Gopher] Open-Source Detector of CISA's Known Exploitable Vul...
___________________________________________________________________
Open-Source Detector of CISA's Known Exploitable Vulnerabilities
Author : alaeddine001
Score : 111 points
Date : 2024-01-16 07:29 UTC (15 hours ago)
(HTM) web link (github.com)
(TXT) w3m dump (github.com)
| yieldcrv wrote:
| useful for bug bounties?
| retrochameleon wrote:
| Useful for scanning your network for devices with known
| vulnerabilities.
| jas- wrote:
| Doesn't metasploit, OpenVAS and others already do a lot of
| this? Why not contribute modules there vs. write a new
| framework?
| RamblingCTO wrote:
| It seems to be using nuclei, metasploit etc. under the
| hood. I hope they recontribute the recipes though.
| alaeddine001 wrote:
| Yes everything added is open-sourced: Metasploit:
| https://github.com/Ostorlab/agent_metasploit Nuclei:
| https://github.com/Ostorlab/agent_nuclei OpenVas (not
| used though due to many issues):
| https://github.com/Ostorlab/agent_openvas Asteroid:
| https://github.com/Ostorlab/agent_asteroid
| scoot wrote:
| No. The companies offering bug bounties have already done more
| than the bare minimum. Finding a vulnerability for a bug bounty
| requires actual work.
| yieldcrv wrote:
| this seems to be airing a frustration that has moved beyond
| accuracy in the process, companies offering bug bounties may
| have done the bare minimum _at one point in time_ but every
| production push they do changes that, and potentially
| reintroduces simple scannable vulnerabilities.
| alaeddine001 wrote:
| We did test it on Bug Bounty targets (see article) and found
| 2.5% of programs to suffer from at least one of these issues.
| alaeddine001 wrote:
| https://blog.ostorlab.co/known_exploitable_vulnerabilities_
| c...
| batch12 wrote:
| Most programs won't pay for scanner output and will require
| work that demonstrates the impact of the finding, etc. Several
| programs I've seen actually state that automated scans are out
| of scope and ask the bounty hunter not to use them. With that
| said, this may be a good recon tool to hunt for bugs, if its
| allowed by the target. I am not sure how much better itd be
| than Qualys or Nessus, etc though.
|
| I like the idea for personal use. I was just looking for
| something similar the other day and for once I'm happy I don't
| need to build it.
| NKCSS wrote:
| Looks nice. Only critique I would give is the fact that they use
| public DNS IP's in the examples to scan hosts I know they expect
| the target audience to know better, but you'd be surprised
| alaeddine001 wrote:
| Good catch, we should indeed make that explicit.
| pythonguython wrote:
| Can you explain this? DNS resolves to an IP address, then that
| is scanned. What am I missing?
| wrs wrote:
| It can be rude/unwise/dangerous (depending on the target) to
| run a scanner on somebody else's public IPs.
| doakes wrote:
| I think the DNS IPs are just example IPs to be scanned.
| You're not supplying a DNS to use for domain lookups. Using
| them in the example is perhaps confusing that there's some
| sort of DNS argument required.
| frantic2821 wrote:
| Is anyone dealing with a large volume of vulnerabilities and
| getting tired of vulnerability scanners giving mundane results
| and not explicitly saying what to fix for your environment? We
| are looking for beta users to try out our MVP; it's all based on
| open-source too, and we are offering the service for free! There
| are actual experts with over 20 years of experience who will look
| through the vulnerabilities and prioritize according to your
| environment at the end of our MVP to make sure the user doesn't
| waste more time investigating solutions and can go back to
| working on their product. Automating is nice, but you do need a
| human to look through at the end we feel
|
| apologies for hijacking your post OP but I am curious if people
| flocking to such a post would be interested in being beta users
| for us too
| jollofricepeas wrote:
| It's not the results.
|
| It's what happens after.
|
| More scanners aren't what we need because vendors still can't
| meaningfully answer the most important questions:
|
| - Is the vulnerability valid based on the environment it was
| found in? Solve this and you'll reduce enterprise
| vulnerabilities by probably 30-40%.
|
| - What are the compensating controls? Identify these
| automagically and reduce the vuln risk scores based on what
| controls are found, you will remove another 30% of vuln work
| for engineering teams
|
| We don't need any more scanners. We need better asset and vuln
| management.
| SteveNuts wrote:
| Exactly. A lot of times the vulnerability exists in something
| you're not using, but it still shows up in reports.
|
| Sifting through that and writing up why that vulnerability
| doesn't actually apply to your environment and showing
| evidence of such is an incredibly time consuming process.
| It's honestly easier to just patch it, a lot of times.
| kjok wrote:
| I've seen startups claiming to solve these with reachability
| analysis. I think upgrading libs regardless could be a better
| solution, particularly for high-risk vulnerabilities.
| frantic2821 wrote:
| But is upgrading libs ENOUGH? and does that make you feel
| confident that you are secured? We are not claiming to
| solve using reachability analysis or claiming to solve
| anything but saving dev their time at this point!
| Aaronstotle wrote:
| When I was responsible for resolving vulns in my previous
| companies' docker images, in many cases upgrading the
| libraries was enough to resolve the vuln.
|
| My role, and others like me, need to get that critical
| vuln number down. Meaning yes, upgrading libs was enough.
| frantic2821 wrote:
| Mind me asking how big your organization was at that
| point? And were you the one responsible for patching
| after if something didn't resolve with upgrading libs?
| FuriouslyAdrift wrote:
| I've gotten more use out of Microsoft's "Security Score" to
| identify and advise on mitigation in my environment than most
| other "automated" options.
|
| Paying a managed service to advise is also an option. I have
| heard Huntress is pretty good. I am sure there are others out
| there.
| frantic2821 wrote:
| Yeah we have realized the same. The 'automated' options
| don't cut it anymore or like don't give answers specific to
| your environment, that's why we are offering _human
| expertise_ to have a look-through and confirm it for free
| at this point in our closed beta. We mostly want to run
| this service /microproduct for now and see how we can tune
| the controls specific to one's environment
| frantic2821 wrote:
| also, is it just me or is Huntress' website down?
| frantic2821 wrote:
| That is exactly what we are targeting! We know it's hard
| hence looking for users for whom we can tune the controls
| better for someone's specific environment - we will be able
| to do this as we have years of experience. This is kind of a
| side project/service we are going for and not our main
| business, so we are not looking to sell anything, but we are
| looking to understand the problem and space better.
|
| Complete support is provided through Slack to (or however you
| wish), so you know you don't have to wait for any kind of
| support.
|
| We know there are plenty of scanners out there. Hence we are
| using an open-source one and working on how we can improve
| the 'what happens after' part by using human-led expertise to
| save others their time
|
| - Is the vulnerability valid based on the environment it was
| found in? Solve this and you'll reduce enterprise
| vulnerabilities by probably 30-40%. --> Having a human expert
| confirm and filter the list is what we are offering to our
| closed beta users for now so yes that is what we are
| targeting to solve!
|
| - What are the compensating controls? Identify these
| automagically and reduce the vuln risk scores based on what
| controls are found, you will remove another 30% of vuln work
| for engineering teams --> We have a list of controls we've
| identified, but we know each environment is different, hence
| looking for users we can tune our controls to
|
| We are particularly looking for users who are in small
| organizations looking to grow rapidly. Ultimately, we are
| looking to save other devs time by taking over the cumbersome
| work.
| arejaytee wrote:
| Interested
| frantic2821 wrote:
| @areyjaytee Best way to reach you? Spruced up a quick landing
| page (ignore the UI for now) -
| https://labs.stack.io/vulnerability-scanner
|
| Please sign up and let me know when you do so we can share
| more?
| DistractionRect wrote:
| Edit: my first comment was a bit harsh.
|
| The more toned down version is I find the whole thing
| suspect. It costs someone time to do this, so "free"
| doesn't scale. That someone would want to Trivy install,
| tuning, monitoring for "free" in return for remote access
| seems like a big red flag.
| frantic2821 wrote:
| It's an unused account as I created a new one using my
| company email! Every account has started somewhere? I'm a
| new hire to market the side projects we are starting on
| and getting user feedback, understanding the problem more
| to solve it.
|
| And yes, the current model cannot scale for sure as
| there's a human piece at the end. We aren't looking to
| scale at the moment, just exploring if there can be a
| solution to this space we can come up with.
|
| Again, like I mentioned above, just looking for users we
| can actually help as this is a common problem many face
| if they aren't at a big organization.
|
| Also mentioned this isn't our main business, something we
| are experimenting with hence we are in closed beta and
| offering to do it for free for only a few. We have human
| labour costs to lol
|
| We offer to install it for you for ease or can guide you
| on installing it yourself, and we will obviously be
| signing NDAs and whatever a user would like to build
| trust. We are literally in the business of
| DevOps..nothing malicious my man, just exploring a
| different kind of MVP but I understand the distrust
| DistractionRect wrote:
| Seems like you started a reply before my toned down edit.
| Apologies for the harshness. I can understand it as a way
| to explore the problem space more and probably as a
| funnel to upsell other devops services.
|
| I also get that products, and people, have to get a start
| somewhere - unfortunately scammers and mal actors look
| similar. I figured it was worth raising for others to
| consider, but did so near the bottom on the comment chain
| rather than top level so as to not derail discussion.
|
| Edit: fighting autocorrect, detail -> derail
| frantic2821 wrote:
| all good! I'm pretty new to the entire tech space as I'm
| the new hire brought in, so I understand and your
| response also helped me understand I should try building
| more trust in the copy
|
| Yeah a possible upsell or doesn't have to be if this
| service is actually useful to anyone out there. We will
| potentially start charging a small fee (dependent on so
| many other factors, but hey you'll be getting an actual
| human expert in this age of automation to speak to
| eitherways) on this months from now - we haven't decided
| or thought of anything further as we don't know yet if
| people feel this is enough of a pain to be open to
| solutions, as obviously one can do it themselves to but
| at what cost of time?
|
| any other feedback you may have on such a service or
| legitimate places to find users this can help would also
| be appreciated!
| frantic2821 wrote:
| no worries, lol I responded before to your original
| comment before I saw the edit.
|
| it's 'free' only for the closed beta as duh we are
| clearly stating there's a human expert at the end who
| will be reviewing and going through with it.
|
| We also know this model is not going to scale because of
| the human aspect, but we know this is a problem most
| people face if they are from small organizations, so we
| are looking to see how we can solve for steps AFTER the
| scan. This is just our first step as we try to learn
| more.
|
| Trivy was the choice of scanner for now, but we don't
| tend to stick with it as there can be better scanners out
| there depending on the environment- it's just what we
| chose for the start, open to discussions if a user has a
| preference for a different scanner
| hangonhn wrote:
| This is all very cool but also seems involved. Your value
| proposition is enough that we may be willing to do some
| work to set it up. However, the question I have is how much
| and is that enough to sustain your operations? Your
| solution looks very interesting but we wouldn't want to do
| all that work only for your company to disappear or get
| acquired because of cash flow problems.
| frantic2821 wrote:
| Would you like to chat more? Feel free to sign up and I
| can reach out via email.
|
| We are not going to be acquired or disappear as we have
| been in this business for over 20+ years and we plan to
| stay independent.
|
| We also won't have cash flow problems as like I
| mentioned, this is a side project for us at the moment
| and not our main source of income.
|
| We are just looking to test if this would be useful to
| anyone out there, hence it's free for the people that
| join our closed beta.
|
| Happy to chat more if you more questions
| frantic2821 wrote:
| @hangonhn and @arejaytee, I realized I may have come
| across as too pushy in asking you both to sign up as
| there seemed to be some interest. Totally understand if
| you maybe sketched up to sign up. Feel free to let me
| know any other way I can reach out or drop your questions
| here and I can try answering them
| letters90 wrote:
| Scan Created? Scan Created where? ...
|
| Usage Instructions seem lacking.
| alaeddine001 wrote:
| Indeed the README page assumes familiarity with the scanner.
|
| Updated the readme with the basic commands and referenced
| another tutorial with in-depth info:
| https://docs.ostorlab.co/tutorials/run-your-first-scan.html
| quesera wrote:
| I think the "Scanning a Domain" subheading (and body text,
| including subcommand name!) should be "Scanning a Host", etc.
|
| www.example.com is not a domain name, and AFAICT there is no
| attempt to enumerate hosts in a domain and scan them all.
| alaeddine001 wrote:
| There is, see the section "Targetting all subdomains".
|
| You can do so by adding your domain name generation tool of
| your choice, or all. The ones supported for now are `subfinder`
| and `amass`.
|
| Agent Subfinder: https://github.com/Ostorlab/agent_subfinder
| Agent Amass: https://github.com/Ostorlab/agent_amass
| quesera wrote:
| That's interesting. But it's under a separate subhead and
| takes additional config and different syntax (though the same
| subcommand name, which is awkward)..
|
| I think the confusion still remains. Scanning "domain-name
| www.example.com" will not scan a domain. (And www.example.com
| is not a domain name, but maybe I'm being prescriptivist
| here? Have we colloquially abandoned the distinction between
| hosts and domains? Even if so, I'd argue that a network tool
| should not use the colloquial sense, but I can go check for
| kids on my lawn if that would be more fruitful...)
| alaeddine001 wrote:
| You are right, worth fixing.
| boleary-gl wrote:
| Hello! ProjectDiscovery team member here - great to see the
| community leveraging Nuclei templates in new and exciting ways!
|
| Be sure to let us know how we can help, and you are welcome to
| open issues on GitHub or join our Discord if you have questions.
| mdaniel wrote:
| That repo also has no license information that I can tell,
| although the pip install is Apache 2
| <https://github.com/Ostorlab/ostorlab#readme>
___________________________________________________________________
(page generated 2024-01-16 23:02 UTC)