Battalion: Automating Recon Created by: Stewart Olson - @abraxassc2 Patrick Garrity - @eidolonpg
Agenda Who are we? Anatomy of a Pentest Existing Tools & Issues Introducing Battalion Future Development Questions!
Who are we? Stewart Olson - @Abraxassc2 Works at Nth Generation Computing ~5 years of experience in IT/Sysadmin Recently focusing more exclusively on security Pat Garrity - @eidolonpg Works at Nerdery, Inc. as a Sr. software engineer Published: Lock-Free Algorithms for Thread Safe Programming Speaker at CIGCSE & MICS This project is independent from our jobs
High-Level Pentesting Process
What is Battalion? It was designed to answer the question, “Given a website and the companies name, what useful data can automatically be gathered?”, in short, it attempts to automate recon Why? Save time Better allocate time and resources Sift through large amounts of data for key information How? Use scripts, parsers, tools, and techniques to take resulting data from one action and present it as input for another tool
Where does Battalion fit in? Recon (Duh?) DNS Enumeration Email Address Scavenging Scanning Open Ports? Vulnerabilities? Gaining Access Exploiting vulnerabilities Phishing, etc. Reporting
Structure of Battalion Some of Many Outputs: Subdomain & IP Lists Users involved in breaches Open Ports Versions of technologies and associated vulnerabilities Two Simple Inputs: Domain Name Company Name
Battalion Domain Scanning Process (partial) Collected Data Vulnerabilities Data Open Ports WPscan data Subdomain & IP Lists Host data (apache, nginx, etc.) API data on IPs and hostnames More in place and more to come!
Brief Sample Domain Scan
Battalion User Scanning Process (partial) Collected Data Current and former employees Whois Data Likely valid email addresses Email addresses involved in breaches Phishing targets and, coming soon, automated phishing campaigns Breach Detection Process Google dorks for past/current employees Name to email transformer HaveIBeenPwned API response analysis for valid format detection HaveIBeenPwned API for breaches
Existing Toolset Future Toolset Many Custom Scripts WPScan DNSRecon EyeWitness NMAP DNSTwist Ruby whois Whatweb TheHarvester Shodan’s API HaveIBeenPwned’s API More custom tools PassiveTotal API Recon-ng XSS Testing tools Gobuster/Dirbuster Metagoofil Twitter API SET Joomscan Better reports More Dorks More Scan Options Passive->Aggressive Integrate with other tools and services
Repository https://github.com/theabraxas/Battalion Try Battalion!!! Repository https://github.com/theabraxas/Battalion Contributors Welcome! Special Thanks: @Viss @Sneakerhax @xcc @001SPARTaN Questions: @AbraxasSC2 @eidolonPG