Milliways

Deep Dive: External Attack Surface Mapping - First Steps (Part 1 of 2)

Milliways Workshop Dome
Intent of this workshop is to shed light on the techniques and methodologies around OSINT reconnaissance. Everything that we explore throughout this workshop can be achieved using open source tooling and scaled up effectively. This journey won't be just a scratch of the (attack) surface, but a true deep dive in what is happening behind all of the steps and the reasoning behind it. This is part one of our OSINT recon adventure.
External attack surface mapping is an important capability to have in the toolkit for everyone working on internet security, for both defensive and offensive sides of the coin. With it we can gain a good visibility of what kind of services and information is exposed to the public internet - the results may surprise you. As you know, inventory management is a huge issue for entities large and small, but when you add network security and service configuration to the mix it gets even more difficult. Intent of this workshop is to shed light on the techniques and methodologies around the subject matter. Everything that we explore throughout this workshop can be achieved using open source tooling and scaled up effectively. This journey won't be just a scratch of the (attack) surface, but a true deep dive in what is happening behind all of the steps and the reasoning behind it. Workshop structure: 1. Acquiring target - Crunchbase, ASNlookups, registrar relationships 2. Expanding the scope - asset discovery 3. Diving deeper - port scanning, service discovery The participants should have a laptop with a Linux based operating system (or virtual machine) with internet connectivity to carry out the hands-on part of the workshop. Testing range for the scope will be provided.

Additional information

Type Live Workshop
Language English

More sessions

8/15/23
Milliways
Hardware Hacking Village
In this 2h workshop, I will teach you to work with the tiny components that modern electronic devices are made of. We will assemble an electronic kitten, that purrs when touched correctly, and hisses when touched wrong. It will work, and is guaranteed to remove your fear of hand-assembling surface mount designs.
8/15/23
Milliways
Milliways
The session proposes a quick overview of Frida, a dynamic instrumentation framework, and how it can be used to enhance our work during the runtime analysis of a mobile application. It will be a walkthrough on how hooking and rewriting functions in runtime may be helpful against anti-reverse engineering measures and SSL pinning mechanisms.
8/15/23
Milliways
Milliways
Hardware FIDO U2F tokens are security devices which are meant to defend user second factor keys from physical and remote attacks. In this presentation different security features and implemented by FIDO U2F tokens and how they are meant to protect a user from various attack scenarios. We will focus on the open source implementation of FIDO U2F token developed and Common Criteria certified by Federal Office for Information Security (BSI). Having access not only to the source code of the token ...
8/15/23
Milliways
Milliways Workshop Dome
Come learn how to hack networks without needing to piss off your housemates, local coffee shop, or the Feds! Bring your laptop and by the end of this workshop, everyone can walk away having intercepted some packets and popped some reverse shells.
8/15/23
Milliways
Milliways
MITRE ATT&CK (Attack Framework among friends) is intimidating sight at first, but is a great tool for risk identification, threat analysis, red teaming, DFIR and security management. Brief introduction to the topic with various examples.
8/15/23
Milliways
Hardware Hacking Village
Solder your own pathlighter badge to illuminate your surroundings at night.
8/15/23
Milliways
Milliways
This talk will show you how many interfaces have to communicate in order to fly experiments on a sounding rocket. We will give you insights into the procedures and the complexity of a research campaign and the actual flight of the rocket itself. In particular, we look at the hardware and software used in the Ground Support Equipment (GSE) and the Service Module (SM) within the rocket.