Gauntlt: Go Ahead, Be Mean to your Code

Gauntlt: Go Ahead, Be Mean to Your Code

Tuesday, December 18, 12

Would you vote for this talk as the best if...?

A. If its funny

B. If it useful to my job

C. Dude, I know you want to win the iPad, you are down to 4 min and 37 seconds, stop surveying and start talking!

@wickettSr. DevOps Engineer

Mentor Graphics, Embedded Software Division

CISSP, GWAPT, CCSK, GSEC, GCFW

james@gauntlt.org

gauntlt.org

A BRIEF HISTORY OF INFOSEC

WE HADCINEMA

WE MADE FREEPHONE CALLS

WE WERE COOL

WE COULDN’T STOP THEVIRUSES AND WORMS

INSTEAD OF ENGINEERING INFOSEC BECAME ACTUARIES

“[RISK ASSESSMENT] INTRODUCES A DANGEROUS FALLACY: THAT STRUCTURED INADEQUACY IS ALMOST AS GOOD AS ADEQUACY AND THAT UNDERFUNDED SECURITY EFFORTS PLUS RISK MANAGEMENT ARE ABOUT AS GOOD AS PROPERLY FUNDED SECURITY WORK” - MICHAL ZALEWSKI

“IS THIS SECURE?”-YOUR CUSTOMER

“ITS CERTIFIED”- YOU

NO PAIN, NO GAIN

Put your code through the Gauntlet

Your web app You

Your web app

sslyze

fuzzers

sqlmapgarmr

w3afgeneric

GAUNTLT ALLOWS DEV AND OPS AND SECURITY TO

COMMUNICATE

$ gem install gauntlt

# download example attacks from github# customize the example attacks # now you can run gauntlt

$ gauntlt

# gauntlt looks for *.attack in its # directory

install gauntlt

Examples > https://github.com/thegauntlet/gauntlt/tree/master/examples

Scenario: Verify server is open on expected ports When I launch an "nmap" attack with: """ nmap -F <hostname> """ Then the output should contain: """ 80/tcp open https """ Scenario: Verify that there are no unexpected ports open When I launch an "nmap" attack with: """ nmap -F <hostname> """ Then the output should not contain: """ 25/tcp """

nmap.attack

wickett$ gauntlt

@slowFeature: nmap attacks for example.com

Scenario: Verify server is open on expected ports When I launch an "nmap" attack with: """ nmap -F www.example.com """ Then the output should contain: """ 443/tcp open https """

1 scenario (1 failed)5 steps (1 failed, 4 passed)0m18.341s

running gauntlt with failing tests

wickett$ gauntlt

@slowFeature: nmap attacks for example.com

Scenario: Verify server is open on expected ports When I launch an "nmap" attack with: """ nmap -F www.example.com """ Then the output should contain: """ 443/tcp open https """

1 scenario (1 passed)5 steps (5 passed)0m18.341s

running gauntlt with passing tests

Feature: Run sqlmap against a target

Scenario: Identify SQL injection vulnerabilities Given "sqlmap" is installed And the target URL is "http://localhost?id=1" When I launch a "sqlmap" attack with: """ python <sqlmap_path> -u <target_url> """ Then the output should contain: """ sqlmap identified the following injection points """

setup steps

verify tool

setup steps

verify tool

set config

attack!

env param

attack!

env param

getconfig

assert

needle

assert

needle

haystack

Given /^"sqlmap" is installed$/ do ensure_python_script_installed('sqlmap')end

When /^I launch an? "sqlmap" attack with:$/ do |command| sqlmap_path = path_to_python_script("sqlmap")

command.gsub!('<target_url>', target_url) command.gsub!('<sqlmap_path>', sqlmap_path) run commandend

step definition

step definition ruby

step definition

execute

Supported Tools

• curl

• nmap

• sslyze

• sqlmap

• Garmr

• generic command line

Try it yourself athttp://gauntlt.org/

with the new gauntlt video tutorial!

Gauntlt: Go Ahead, Be Mean to your Code

Technology

Transcript of Gauntlt: Go Ahead, Be Mean to your Code

Mean Mean Richards Ogden

Kids Who Start Ahead, Stay Ahead Parental Workshop.

Young Professionals Australia: Get ahead and stay ahead

201505 OWASP AppSecEU 2015 SecDevOps · Gauntlt in SecDevOps? BDD-based framework for executing many security tools/scanners: • Integrates scanners like Arachni, ZAP, sqlmap, etc.

SCHINDLER AHEAD Schindler Ahead DoorShow is the … · SCHINDLER AHEAD DOORSHOW INFORMED PASSENGERS. GREAT ENTERTAINMENT. Schindler Ahead DoorShow is the new advertisement and information

Transformation Ahead Transformation Ahead

P&O: Staying ahead means thinking ahead

contents · PDF fileRadiation health sciences and radiation ... and ahead to its role in the third ... Sustainable energy is sometimes taken to mean only renewables such as solar,

Get Ahead! Stay Ahead! July 1st Insights Mangalamleave.mitplreports.com/MangalamNewsletter/4.pdfGet Ahead! Stay Ahead! July 1st, 2019 Happy Monsoon Season Celebrate monsoon with us

Racing ahead - Bombay Stock Exchange Racing Ahead with Excitement and Entertainment 02 Racing Ahead with Entertainment 04 Racing Ahead with Excitement 06 Racing Ahead with Expansion

Continuous Opportunity: DevOps & Security - … · OWASP Ames Continuous Opportunity: ... • OWASP Bricks • PHAN ... Running the Gauntlt. Continuous Opportunity: DevOps & Security

2016 LOOK-AHEAD - ligneconfederationline.ca · 2016 LOOK-AHEAD Excavation of running tunnel from Parliament to Rideau ... 2016 LOOK-AHEAD Bus loop construction ... 2016 LOOK-AHEAD

201505 OWASP AppSecEU 2015 SecDevOps - Christian Schneider · Gauntlt in SecDevOps? BDD-based framework for executing many security tools/scanners: • Integrates scanners like Arachni,

Mean = 86 MS mean = 82 PhD mean = 93

· Web viewResources here at Durham College. Strategies for success while attending Durham College - planning ahead. Hybrid delivery of courses- what does it mean? How can you as

We think ahead to stay ahead - 152.32.73.214:8080

AHEAD COSMOS and COMPASS Studies. The AHEAD Study.

Generating Random Numbers. Mean, Variance, Standard Deviation Mean: –mean(x) Variance: –mean((x-mean(x).*(x-mean(x))) Standard Deviation –std(x)

ONE STEP AHEAD - Röchling Global · nologies and new processes that will be successful on the market. New, however, does not necessarily mean fast. Developing inno-

SCHINDLER AHEAD Schindler Ahead DoorShow is the · PDF fileSCHINDLER AHEAD DOORSHOW INFORMED PASSENGERS. GREAT ENTERTAINMENT. Schindler Ahead DoorShow is the new advertisement and