Hacker News Reader

Comment by glutamate | Hacker News Reader

We definitely need to do something like this. Trying to set up vulnerability scanners in CI for my open source project, I realized that open source DevSecOps is a shitshow: hard to use tools, lots of focus on GUI tools that are harder to script, and proprietary tools and platforms.

To be honest it feels like vested interests are keeping it that way: professionals want to keep the tools manual so they can charge by the hour; and tool vendors obviously have no interest in open source tools

View on HN

The professionals I know and myself work solely with open source tools and open source frameworks... It is certainly a libre open source push in infosec.

And the community of practitioners are giving back to the community in all dimensions, code, knowledge, talks, support, heck even governments and institutions five free insights; mitre, nist, cis for instance.

With a few exceptions such as Nessus and Qualys.

Any chance you could share what open source tools and frameworks you work with? I would be grateful for that.

CIS, https://www.cisecurity.org/

CIS audit, https://www.auditscripts.com

Mitre Attack, https://attack.mitre.org/

NIST, https://www.nist.gov/cyberframework

CISA, https://www.cisa.gov/cybersecurity

OWASP top 10, https://owasp.org/www-project-top-ten/

Cloud security alliance, https://cloudsecurityalliance.org/

Higher level standards: Iso27001

IEC62443

Tools:

AD: Bloodhound / Sharphound

PingCastle

Web:

Owasp ZAP

Burpsuite

Basically download the Kali linux distro

+++++++++++++++

Conferences:

Blackhat

Defcon

Hope

Great list thanks

Thanks.

Have you tried using OWASP ZAP? We're focusing on automation and feedback gratefully received. I'm also on the OpenSSF Security Tools Working Group and making security tools easier to use is definitely one of our priorities

First of all great product, I found a lot of XSS when using the GUI. Also I managed to get this scripted with zap-cli with an unauthenticated scan, not too much work. I don't like to complain about specific open source project so please take this as feedback.

I gave up on trying to do an authenticated scan. Docs/ Forum answers always say "First get it to work in the GUI, then try running on command line." Well that's not helping me very much, because "getting it to work in the GUI" is not reproducible and shareable in the same way as a code/script showing clear steps. Secondly, getting authenticated scans to work when your login form is protected by a CSRF token is very much not trivial (don't think I got this to work in any tools). But if your forms are not protected, you have a vulnerability.

My feeling is that the right kind of tool is really a library, so that one can script the login process which may be quite complex with 2FA.

Regarding 2fa - For TOTP there is a Linux command line tool called oathtool. For SMS, set up Twilio. For U2F you can emulate a device with an ECDSA library.

For CSRF you'll want browser automation, like Chrome Headless. Alternatively, you can load a page and extract a token from the DOM in a normal scraper.

>To be honest it feels like vested interests are keeping it that way: professionals want to keep the tools manual so they can charge by the hour;

As a security professional, get out of here with that non-sense. You've run into a challenging problem and still think there is some conspiracy. What we do is highly technical and often customer specific (e.g. automate 2fa due to some weird requirement rather than the customer disabling it for the test account). There is no market in automating a lot of this work, packaging it in a nodejs library for you to use, and writing docs.

My "challenging problem" is that I use CSRF tokens, which is a minimal requirement of any non-toy project.

I haven't tried it in Zap, but there is definitely a Burp add-on that takes care of this for you. Probably several.

Zap is pretty scriptable as well, so there are likely solutions for it also. What have you tried?

Sadly, the commercial tools are also kind of a shitshow. We've got one (very expensive one) that emits risk reports with "high" rating where the message is clearly a programmer saying "not implemented yet."

Oh, and it also crashes with null pointer errors.

One of the (expensive) tools we used would always flag the word "key" regardless of context. Have an array of postal suffixes that includes "St", "Rd", "Key"? That gets flagged as a high level cryptographic vulnerability. Same for "Press any key to continue" or any variable name that contains the word key, regardless of context. These obvious false positives erode trust in the product by developers and are used by their PMs as proof that security scans serve little purpose other than causing missed deadlines. The vendor refused to correct any of them, claiming it's better to be safe than sorry but offered us the ability to turn off checking for hardcoded cryptographic keys as a work around, which of course wouldn't catch actual cases of hardcoded keys, which sadly does happen.

That certainly sounds like Tenable's (Nessus) Security Center.

That piece of software is some of the worst, verbose, bug-ridden garbage I've been required to work with.

Have you tried Snyk? I've found it to be the simplest to use and completely free for public repos

I get a lot of false hits and plainly incorrect PRs opened; My project is a monorepo (lerna/npm), not sure if I have it set up incorrectly or snyk doesn't play with monorepos

Fund communities around products like Security Onion. Champion portioning at least a part of budget allocated for support to the direct support of active open source contributors.

That’s the only way to break the consultancy chain - stop paying the wolves to guard the henhouse.

Reply on news.ycombinator.com